ClawHub
Back to skill

Security audit

智能记账本

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Chinese-language local expense tracker that stores entries in a local JSON file; packaging has cleanup issues, but no hidden exfiltration or unsafe behavior was found.

Install only if you are comfortable with a Chinese-language expense tracker keeping your spending history in a plaintext local data.json file. Consider removing sample data, protecting the skill directory on shared machines, and preferring a fixed or removed @openclaw/sdk dependency before production use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:75
Finding

Unnecessary and Unpinned Third-Party SDK Dependency Expands the Supply-Chain Attack Surface

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:75-77, clawhub-manifest.json:27-29, skill.json:10-12
Vulnerability Type: Unnecessary third-party dependency with a mutable version range
Risk Level: Medium

Vulnerable Code

SKILL.md:75-77

bash
# Install dependencies
npm install @openclaw/sdk

clawhub-manifest.json:27-29

json
"dependencies": {
  "@openclaw/sdk": "^2026.3.2"
},

skill.json:10-12

json
"dependencies": {
  "@openclaw/sdk": "^2026.3.2"
}

Technical Analysis

The project instructs users to install @openclaw/sdk and declares it with the caret range ^2026.3.2. However, the executable implementation never imports this package. Instead, index.js:1-8 defines a local SDK simulation, and its only actual imports at index.js:10-11 are the built-in Node.js fs and path modules.

The unused dependency unnecessarily enlarges the package's software supply chain. The caret range permits npm to resolve later semantically compatible releases that were not necessarily included in the reviewed artifact. It may also resolve transitive dependencies. If the package, a permitted future version, or one of its transitive dependencies becomes compromised, package installation could introduce attacker-controlled code.

This audit found no evidence that the currently declared SDK is malicious. The risk arises from requiring an unnecessary, externally maintained, and non-exact dependency.

Attack Path

  1. A user follows the installation instructions in SKILL.md or installs the skill through tooling that processes its dependency manifest.
  2. npm resolves @openclaw/sdk using the mutable ^2026.3.2 range, together with any transitive dependencies.
  3. A compromised compatible release or transitive package is selected.
  4. If the compromised package defines an installation lifecycle script, npm may execute it with the privileges of the user performing t ...[truncated 728 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove @openclaw/sdk from clawhub-manifest.json and skill.json, and remove the corresponding npm install instruction, because the current implementation does not use the package.
  2. If SDK integration is required, import and use only the necessary API rather than retaining both a local simulation and an external dependency.
  3. Pin the dependency to an audited exact version instead of using a caret range.
  4. Commit a valid npm lockfile containing resolved versions and integrity hashes.
  5. Review direct and transitive dependencies with automated vulnerability and provenance checks before publication.
  6. Where operationally appropriate, install dependencies with lifecycle scripts disabled and explicitly allow only reviewed packages that require installation scripts.
  7. Correct the missing comma after the version field in skill.json so security and installation tooling can parse the manifest reliably.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The description says the skill supports Chinese natural-language input and all examples and headings are in Chinese, but it does not indicate whether other languages are supported or that Chinese is an intentional locale-specific limitation. This can violate a language/locale policy when a skill implicitly forces one language without user opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill states that financial data is stored in a local JSON file but does not clearly warn users that sensitive expense records will persist on disk. Financial records can reveal habits, locations, and personal circumstances; if users assume the data is transient, this creates a privacy and data-exposure risk, especially on shared or unmanaged systems.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The usage examples present generic triggers such as “记录”, “添加”, “查询”, “统计”, “列表”, and “明细” without documenting when they should invoke this skill versus other skills. These verbs are common in everyday assistant interactions and, without exclusion conditions or a fixed invocation format, could cause unintended activation collisions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest description, tags, category, keywords, and embedded README consistently present the skill only in Chinese and the usage examples explicitly state it supports Chinese input. There is no indication that users can choose another language or that the Chinese-only scope is a documented regional constraint, which creates a locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This JSON data uses Chinese-only category and description values such as "餐饮" and "记账：今天午饭花了" with no indication that language selection is optional. Under the policy, locale or language constraints should not be forced unless the skill offers user choice or clearly documents a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill persists potentially sensitive expense records, including descriptions and dates, to a local JSON file without any disclosure, consent flow, retention controls, or access protections. Financial spending history can reveal private habits and health-related information, so silent local storage increases privacy risk, especially on shared systems or insecure deployments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The parsing logic and user interaction strings are hard-coded for Chinese phrases and the Chinese currency suffix 元, so the skill only works for Chinese-language requests. There is no indication that the user can choose language/locale or that the Chinese-only constraint is explicitly documented as a justified regional limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The command recognition for adding, querying, and listing expenses depends entirely on Chinese trigger terms such as 记账, 查询, 统计, 列表, and 明细. This enforces a specific language for operation without any opt-in, fallback, or documented locale policy exception.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script's console messages and example inputs are entirely in Chinese, which imposes a specific language on users without any indication of opt-in or locale selection. This matches the policy concern for language or locale restrictions expressed in natural-language strings within code.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description is written only in Chinese and presents the skill as Chinese-language by default. Per the policy, forcing a specific language without user opt-in or documented locale justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.