Vibe Coding Cn

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:40 AM UTC
• Version: 4.1.0

Overview

The skill is a coherent AI code-generation tool, but its file-writing and folder-opening code has unsafe path handling that could write outside the intended workspace or run shell commands.

Review before installing. Use only in a constrained workspace, avoid untrusted projectId/outputDir values, and inspect generated file paths before allowing writes. Do not enable the optional monitor until dependency and server exposure concerns are addressed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: executors/vibe-executor-v4.1.js:758

Finding

Arbitrary File Write Through Unvalidated LLM-Generated Paths

Content

View full analysis

')) { blocks.push({ path: 'index.html', content: markdown, language: 'html' }); } return blocks; } ``` ### Technical Analysis The filename comes from LLM-generated Markdown and must therefore be treated as untrusted input. The filename regular expression permits periods and forward slashes, including paths such as `../../target/file`. `path.join(this.projectDir, block.path)` normalizes traversal components but does not ensure that the resulting path remains beneath `this.projectDir`. No canonical containment check is performed before directory creation and file writing. A malicious or prompt-injected model response can consequently direct the process to create or over ...[truncated 1439 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: executors/vibe-executor-v4.1.js:387

Finding

OS Command Injection Through Caller-Controlled Output Directory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: executors/version-manager.js:155

Finding

Project ID Path Traversal in Version Metadata Storage

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (129)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the code chunk primarily performs testing, mock-driven execution, or local inspection rather than the declared OpenClaw-only generation workflow, then the documentation materially misstates what is actually being run. That discrepancy weakens user consent and makes it harder to evaluate whether data is handled safely or whether expected guardrails are present.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

If the code chunk primarily performs testing, mock-driven execution, or local inspection rather than the declared OpenClaw-only generation workflow, then the documentation materially misstates what is actually being run. That discrepancy weakens user consent and makes it harder to evaluate whether data is handled safely or whether expected guardrails are present.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the code chunk primarily performs testing, mock-driven execution, or local inspection rather than the declared OpenClaw-only generation workflow, then the documentation materially misstates what is actually being run. That discrepancy weakens user consent and makes it harder to evaluate whether data is handled safely or whether expected guardrails are present.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the code chunk primarily performs testing, mock-driven execution, or local inspection rather than the declared OpenClaw-only generation workflow, then the documentation materially misstates what is actually being run. That discrepancy weakens user consent and makes it harder to evaluate whether data is handled safely or whether expected guardrails are present.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the code chunk primarily performs testing, mock-driven execution, or local inspection rather than the declared OpenClaw-only generation workflow, then the documentation materially misstates what is actually being run. That discrepancy weakens user consent and makes it harder to evaluate whether data is handled safely or whether expected guardrails are present.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the code chunk primarily performs testing, mock-driven execution, or local inspection rather than the declared OpenClaw-only generation workflow, then the documentation materially misstates what is actually being run. That discrepancy weakens user consent and makes it harder to evaluate whether data is handled safely or whether expected guardrails are present.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

If the code chunk primarily performs testing, mock-driven execution, or local inspection rather than the declared OpenClaw-only generation workflow, then the documentation materially misstates what is actually being run. That discrepancy weakens user consent and makes it harder to evaluate whether data is handled safely or whether expected guardrails are present.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

If the code chunk primarily performs testing, mock-driven execution, or local inspection rather than the declared OpenClaw-only generation workflow, then the documentation materially misstates what is actually being run. That discrepancy weakens user consent and makes it harder to evaluate whether data is handled safely or whether expected guardrails are present.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · executors/incremental-updater.js (reported line 419)May include surrounding context.

js

balanced: '平衡策略：适度修改，在保留和重构之间取得平衡',
      aggressive: '激进策略：大胆重构，如果更好的设计就果断修改'
    };
    return instructions[this.conservatism] || instructions.balanced;
  }

  getChangeTypeLabel(type) {

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly replaces user approval with internal agent voting and advertises automatic decision-making without waiting for the user. In a code-generation system that also writes files and orchestrates multiple model outputs, removing human approval substantially increases the chance of unsafe, unwanted, or policy-violating actions proceeding unchecked.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.20.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The lockfile pins the project to ws 8.20.0, and the supplied finding indicates known advisories affecting that exact version: uninitialized memory disclosure and memory exhaustion denial of service. Because this skill is intended for AI team collaboration and likely exposes WebSocket-based communication or control paths, a vulnerable ws dependency can let remote attackers leak process memory or degrade availability by exhausting server resources.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.20.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The package declares ws 8.20.0, which is flagged with known vulnerabilities including memory disclosure and memory-exhaustion denial of service. Even though it is listed under optionalDependencies and described as only for visualization, optional dependencies are still commonly installed and can be exposed if monitoring features are enabled in the OpenClaw environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The entire skill-related checklist is written in Chinese and names the skill Vibe Coding CN, which suggests a fixed language/locale experience. The file does not indicate that users may choose another language or that the Chinese-only constraint is a documented, justified regional requirement, which can conflict with language/locale choice policy.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · CLAWHUB-PUBLISH.md (reported line 162)May include surrounding context.

3. 检查输出

bash

ls -la ~/.openclaw/workspace/output/计算器/

4. 验证文件内容

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file contains user-facing natural-language content exclusively in Chinese, including the title, findings, and recommendations, but does not indicate that Chinese is optional or that the skill is intended only for a Chinese-speaking or region-specific audience. That can violate language/locale policy where skills should not force a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file’s natural-language instructions, examples, and usage guidance are exclusively in Chinese from start to end. Under the language/locale policy, forcing a specific language without user opt-in or documented justification is a policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The document describes generating and saving multiple files to disk, including paths under an output directory, but does not present this as a clear operational warning or emphasize filesystem side effects. In an agent skill context, insufficient disclosure of write behavior can cause users to run the skill without understanding that it will create or overwrite files, increasing the risk of unintended modification of local project contents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations in natural-language content. This release report is entirely presented as a CN variant and all invocation examples are in Chinese, with no indication that users may choose another language or that the locale restriction is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The report explicitly promotes 'Agent 投票审批' and '自动决策，无需用户等待', meaning consequential decisions are made without user confirmation. In an agent skill that generates or modifies projects, reduced human oversight can let incorrect, unsafe, or policy-violating changes proceed automatically, especially when the skill is positioned for end-to-end automation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file presents all instructions, examples, and operational guidance only in Chinese, and it does not indicate that the skill is region-specific or that users may opt into another language. Under the policy rule for natural-language constraints, forcing a single language without user choice is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The markdown says users can trigger the skill by saying '用 vibe-coding 做一个个税计算器', and later shows similar natural-language requests like '用 vibe-coding 做个计算器'. This invocation pattern is not paired with exclusion conditions, trigger boundaries, or a precise list of accepted phrases, so it could overlap with ordinary conversation about coding tasks and cause unintended activation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example forwards user-derived prompt content into sessions_spawn without any user-facing disclosure that the text will be sent to a sub-agent/LLM. In an OpenClaw environment, users may provide proprietary code, credentials, or business data, and this pattern increases the risk of unintended data exposure to downstream model tooling.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The task template wraps raw prompt content as an analysis request and forwards it directly to a sub-agent, which does not isolate untrusted input from system/task instructions. An attacker can embed prompt-injection or policy-bypass text in prompt, causing the downstream agent to follow adversarial instructions, mis-handle data, or produce unsafe actions under the guise of analysis.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The built-in LLM tool example passes the raw prompt directly into generation without any sanitization, compartmentalization, or warning about prompt injection. Because this skill is designed for multi-agent project generation, downstream model outputs may influence planning and code generation, making adversarial prompt content more operationally dangerous than a simple chat response.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Appending untrusted text into message: '请用 JSON 格式回答：${prompt}' is another direct prompt-composition pattern that allows semantic jailbreaks or instruction override attempts to propagate into the LLM session. Requesting JSON does not meaningfully neutralize malicious content embedded in the prompt and may create false confidence in output safety.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: executors/vibe-executor-v4.1.js:389