Requirement Checker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:00 AM UTC
• Version: 2.8.0

Overview

The skill is a coherent requirements-document checker, but it needs review because it can send full documents to AI providers, cache API keys in plaintext, and alter the Python environment during install.

Install only if you are comfortable with requirement documents being sent to the selected AI provider and with API keys being copied into the skill's local config.json. Review the configured base_url before use, avoid sensitive documents unless you use a trusted/private endpoint, and prefer installing dependencies in an isolated environment instead of allowing global pip changes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/check_with_llm.py:134

Finding

Plaintext API Key Caching and Unvalidated Transmission Destination

Content

View full analysis

Dict[str, Dict]: """扫描 OpenClaw 配置中的所有可用 provider""" config_path = Path.home() / ".openclaw" / "openclaw.json" if not config_path.exists(): return {} try: with open(config_path, "r", encoding="utf-8") as f: config = json.load(f) models_config = config.get("models", {}) providers = models_config.get("providers", {}) available = {} for provider_name, provider_config in providers.items(): if provider_config and provider_config.get("apiKey"): available[provider_name] = { ...[truncated 4353 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/postinstall.js:15

Finding

Automatic Installation of an Unpinned Dependency into the Global Python Environment

Content

View full analysis

=2.28.0 ``` ### Technical Analysis The Skill's post-install hook automatically invokes pip when `requests` is absent. The primary command uses `--break-system-packages`, intentionally bypassing protections that prevent package-manager conflicts and allowing modification of the global Python environment. The dependency is not pinned to an exact audited version, and no cryptographic hashes, lockfile, isolated virtual environment, or fixed package index is used. Package resolution can therefore change after the Skill has been audited. The installed package and its transitive dependencies are selected ...[truncated 2086 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (57)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Version-history rewriting and metadata modification are privileged maintenance tasks that do not match the stated end-user function of document review. When these capabilities are bundled into a user-facing analysis skill without clear disclosure, they create opportunities for unauthorized project modification and confusing, hard-to-audit side effects.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Version-history rewriting and metadata modification are privileged maintenance tasks that do not match the stated end-user function of document review. When these capabilities are bundled into a user-facing analysis skill without clear disclosure, they create opportunities for unauthorized project modification and confusing, hard-to-audit side effects.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Version-history rewriting and metadata modification are privileged maintenance tasks that do not match the stated end-user function of document review. When these capabilities are bundled into a user-facing analysis skill without clear disclosure, they create opportunities for unauthorized project modification and confusing, hard-to-audit side effects.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Version-history rewriting and metadata modification are privileged maintenance tasks that do not match the stated end-user function of document review. When these capabilities are bundled into a user-facing analysis skill without clear disclosure, they create opportunities for unauthorized project modification and confusing, hard-to-audit side effects.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Version-history rewriting and metadata modification are privileged maintenance tasks that do not match the stated end-user function of document review. When these capabilities are bundled into a user-facing analysis skill without clear disclosure, they create opportunities for unauthorized project modification and confusing, hard-to-audit side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly discusses API auto-detection and LLM-based checking but does not clearly warn that document contents and discovered configuration may be sent to external providers. In the context of requirement documents, this is particularly dangerous because such files often contain business logic, internal processes, customer data, or system-integration details that should not be transmitted without informed consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README describes behavior that goes beyond simple document checking by automatically scanning environment variables and OpenClaw provider configuration, then persisting the selected configuration locally. That creates a credential-discovery and credential-handling capability which increases secret exposure risk, especially if users are not explicitly consenting to scanning and storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README states that the skill will automatically detect environment variables, scan OpenClaw configuration, and save configuration to local config.json, but it does not warn users that credentials may be read and persisted. Silent credential ingestion and local persistence materially increase the risk of secret leakage through local files, backups, logs, or later accidental disclosure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Advertising provider auto-scanning and auto-selection across multiple providers broadens the skill's operational scope beyond requirement-document checking. This increases the chance of unintended access to unrelated model accounts or endpoints and can route sensitive documents to a provider the user did not intend to use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

README 将“请检查需求文档”作为主要调用方式展示，但没有说明必须在什么上下文、针对哪些文件或目录、以及哪些类似表述不应触发。该短语虽然有一定领域性，但仍然较宽泛，且文档未提供负面示例或更精确的触发约束。

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises and instructs use of capabilities that imply shell execution, filesystem access, environment/config access, and network calls, but it does not declare any explicit tool scope or permissions boundaries. This makes the operational surface larger and less auditable, increasing the chance of unintended file access, command execution, or data exfiltration if the skill is invoked in a permissive runtime.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation phrase '请检查需求文档' is broad enough to overlap with ordinary conversation, making accidental invocation plausible. In a skill that can read files, write reports, inspect config, and use networked LLMs, unintended triggering can lead to unexpected processing of sensitive documents or external transmission of their contents.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Additional suggested trigger phrases are also conversational and ambiguous, which compounds the risk of unintended activation. Because the skill context includes directory selection, batch processing, and possible network-based LLM analysis, accidental activation could scale from a single-file action to broad document scanning or report generation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Natural-language policy checks apply to all file types. The user-facing description forces a single language/locale presentation, which can violate language-choice expectations when no opt-in, alternative language, or justification for the locale restriction is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description is entirely in Chinese and describes the skill as a requirements-document checking skill, which implies a language-specific experience. There is no indication that users can choose another language or that the locale restriction is explicitly justified, so this appears to impose a language constraint without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file is in scope for SQP-2, and the update log states that the checklist now includes '自动安装依赖' (automatic dependency installation). Automatically installing dependencies can affect system integrity, but the document provides no warning, confirmation guidance, or cautionary note about that behavior anywhere nearby or in the usage instructions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

标题和全文内容均以中文固定呈现，未说明这是面向特定中文团队/区域的限定文档，也未提供其他语言或用户选择。根据规则，若技能在语言或地区上施加约束而无明确 opt-in 或正当说明，属于自然语言政策风险。

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/llm-enhanced.md (reported line 153)May include surrounding context.

或使用 OpenAI

export OPENAI_API_KEY="sk-xxx" export OPENAI_BASE_URL="https://api.openai.com/v1"

text

### 模型选择

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The template consistently uses Chinese for headings, instructions, and examples across the entire document. Under SQP-3, forcing a specific language without user opt-in or a documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/templates.md (reported line 367)May include surrounding context.

md

| 项目 | 内容 |
|------|------|
| 对接方式 | REST API |
| 接口地址 | https://api.example.com/funds/nav |
| 请求方式 | POST |
| 认证方式 | OAuth 2.0 |
| 超时设置 | 30秒 |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The tool sends full requirement document content to an external LLM via check_with_llm(content, str(file_path)) without any explicit disclosure, consent gate, or data-classification check in this workflow. Requirement documents often contain confidential product plans, customer data, or internal business logic, so silent transmission to a third-party AI endpoint can cause unintended data exposure and compliance violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The batch GWT generation path sends document content to an LLM through call_llm_for_gwt(content, filename) after scanning files, again without clear user disclosure at the point of use or per-document consent. Because this happens in batch mode, large numbers of potentially sensitive requirement files may be transmitted externally, increasing the scale of confidentiality and privacy risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file’s docstring and all user-facing messages are written in Chinese, and the suggested invocation phrase is also Chinese-only. This can violate language/locale policy because the skill implicitly forces a specific language without user opt-in or justification that it is intended only for a Chinese-speaking environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The usage guidance tells the user to invoke the skill with a Chinese phrase only, with no alternative language option. This is a natural-language policy concern because it constrains interaction to one language without explicit opt-in or documented regional scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Auto-detected credentials are written into a local config.json as a side effect, broadening secret exposure beyond the original storage location. This increases the chance of accidental disclosure through backups, source control, workspace sharing, or other tools reading the project directory.

Content

No source excerpt is available for this finding.