Security audit

hi-light Ear Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent HiLight setup helper, but it handles an API key and opens/enables a third-party OpenClaw channel with unsafe defaults that users should review before installing.

Review this skill before installing. Use it only if you trust the @art_style666/hi-light plugin source, avoid dry-run or terminal transcripts with real API keys, rotate any key that was exposed in command history or logs, and set a restrictive dmPolicy and allowFrom list instead of accepting the wildcard defaults.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

Location: scripts/setup_hi_light.sh:3
Finding: Unpinned and Environment-Overridable Third-Party Plugin Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup_hi_light.sh:39
Finding: HiLight API Key Exposure Through Dry-Run Output and Process Arguments
Content: View full analysis
' ``` ### Technical Analysis In dry-run mode, `run_cmd` prints every command argument using `printf '%q '`. When the configuration command is processed, the API key is included in the argument array and is therefore printed without redaction. The dry-run feature consequently discloses the exact secret it is expected to protect. During a normal run, the API key is passed as a command-line argument to both the setup script and the `openclaw config set` child process. Command-line arguments may be observable through process inspection interfaces, process-monitoring agents, audit systems, diagnostic tooling, or command transcripts. When users type the documented command directly into a shell, the token may also be retained in shell history. Quoting prevents shell command injection but does not provide confidentiality. ### Attack Path 1. A user supplies a valid HiLight API key through the documented `--api-key` command-line option. 2. If `--dry-run` is used, the script passes the token to `printf '%q '`, causing the credential to appear in terminal output and any associated logs or transcripts. 3. During a normal run, the token appears in process arguments while the setup script and configuration command are running. 4. A local observer, monitoring service, CI log collector, terminal recorder, or person with access to shell history captures the token. 5. The observer reuses the ex ...[truncated 689 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/setup_hi_light.sh:6
Finding: Default Configuration Permits Direct Messages From All Senders
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Session Persistence

Medium

Category: Rogue Agent
Confidence: 86% confidence
Finding: The skill is designed to persist configuration, including writing channels["hi-light"] settings and updating API key or websocket endpoint values in OpenClaw config. Persisting secrets and connection settings across sessions can create risk if stored insecurely, modified without clear consent, or later reused by other workflows, especially because the skill also instructs collecting an API key and applying it via a setup script.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: hi-light-openclaw description: 以用户可执行的工作流方式安装、配置和排查 HiLight OpenClaw 插件。用户想把 OpenClaw 连接到 HiLight、安装 `@art_style666/hi-light` 插件、把 `channels["hi-light"]` 写入 OpenClaw 配置、更新 HiLight API Key 或 WebSocket 地址、或排查 HiLight 无法连接时使用。 Install, configure, and troubleshoot the HiLight OpenClaw plugin as a user-facing setup workflow. Use when a user wants to connect OpenClaw to HiLight, install `@art_style666/hi-light`, write `channels["hi-light"]` into OpenClaw config, update the HiLight API key or websocket URL, or diagnose why the HiLight channel does not connect. --- # HiLight For OpenClaw

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The document is explicitly split into Chinese and English sections and instructs the agent to provide concrete example phrasing in those languages, but it does not state that the user's preferred language should be asked or preserved. This can violate a language/locale policy when interacting with users who prefer another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language strings explicitly prioritize Chinese first ('中文在前') and present the prompt in Chinese-first form, but there is no indication that the user can opt into another language. This can violate language/locale policy expectations when a skill imposes a language preference without documented user choice or justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The default prompt encourages using the skill to install or configure the plugin and 'fill in my API key' without clearly constraining when the skill should activate or what safety boundaries apply. In an agent environment, overly broad invocation text can cause unintended routing of unrelated requests into a skill that handles sensitive configuration material, increasing the chance of credential exposure or unsafe config changes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The file is explicitly structured as bilingual-only instructions under '# 中文' and '# English', which imposes specific languages rather than offering a user language choice. The policy allows locale constraints only when users can opt in or when the limitation is clearly justified as region-specific, neither of which is stated here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script stores the HiLight API key in OpenClaw configuration and then prints the full channels["hi-light"] object as JSON, which may expose authToken in terminal output, logs, CI job traces, shell history captures, or support screenshots. In this setup-oriented skill, users are specifically encouraged to run the workflow interactively, which increases the likelihood of inadvertent credential disclosure during normal use or troubleshooting.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.