导购对比分析

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:41 AM UTC
• Version: 1.0.0

Overview

The skill mostly does the advertised retail performance comparison, but it depends on mutable local code and describes automatic sharing of named employee reports without clear authorization controls.

Review before installing. This skill should only be used where the clerk-performance-analysis dependency is trusted, pinned or otherwise controlled, and not writable by less-trusted processes. Treat generated reports as sensitive employee and business data; require explicit approval and verify recipients before sending performance rankings or coaching reports to enterprise messaging channels.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: compare.py:7

Finding

Unverified Local Dependency Loaded with Import Precedence

Content

View full analysis

Vulnerability Details

File Location: compare.py, lines 7-11
Vulnerability Type: Unsafe local dependency loading and Python module hijacking
Risk Level: Medium

Vulnerable Code:

python

import sys
import os
# 使用绝对路径导入 clerk-performance-analysis
perf_analysis_path = os.path.expanduser('~/.openclaw/skills/clerk-performance-analysis')
sys.path.insert(0, perf_analysis_path)
from analyze import analyze

Technical Analysis

The code prepends a mutable directory beneath the current user's home directory to Python's module search path and then imports the generic module name analyze. Because sys.path.insert(0, ...) grants this location the highest import precedence, Python will load and execute analyze.py or a corresponding package from that directory before considering other installed modules.

Python executes module-level statements during import. The implementation does not verify the dependency's cryptographic digest, signature, version, ownership, permissions, or canonical path. Consequently, a party able to create or replace the dependency in ~/.openclaw/skills/clerk-performance-analysis can cause arbitrary Python code to execute when compare.py is imported or run.

The audited project does not itself contain a malicious analyze module. The issue is an unsafe trust boundary around an external, mutable dependency.

Attack Path

1. An attacker gains write access to ~/.openclaw/skills/clerk-performance-analysis, such as through another compromised skill, an insecure installer, overly permissive filesystem permissions, or the same user account.
2. The attacker creates or replaces analyze.py in that directory.
3. The malicious file includes attacker-controlled module-level statements or a malicious analyze function.
4. A user or agent imports or directly executes compare.py.
5. compare.py places the attacker-controlled directory at index zero of sys.path.
6. The stat ...[truncated 1002 chars]

Remediation

View remediation

Remediation Suggestions

1. Package clerk-performance-analysis as an explicitly and uniquely named Python package, and import it through the normal package mechanism rather than mutating sys.path.
2. Pin the dependency to an audited version and verify its cryptographic hash or publisher signature during installation.
3. Install dependencies into a dedicated virtual environment from an authenticated, approved source.
4. Ensure dependency directories are owned by the intended service account and are not writable by less-trusted users or processes.
5. If local path loading is unavoidable:
   • Resolve the path with Path.resolve().
   • Confirm that the canonical path is within an approved directory.
   • Validate ownership and restrictive permissions.
   • Verify the expected module against a trusted digest before importing it.
   • Avoid generic top-level module names such as analyze.
6. Perform dependency installation as a separate controlled deployment step rather than discovering and trusting mutable code at runtime.
7. Run the skill with least privilege and prevent the process from accessing credentials or files unnecessary for retail performance analysis.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

整体上，代码主用途与声明大体一致，确实是在做导购业绩对比分析，并实现了时间对比、横向排名和标杆差距分析等核心场景，也没有发现额外敏感能力、越权访问或无关触发逻辑。但声明中的部分核心能力并未在该代码块中实现，尤其是“能力雷达图对比”和明确的“业绩贡献度对比”缺失；现有实现最多是展示销售占比与集中度洞察，不能等同于完整的贡献度对比能力。此外，部分 benchmark 差距计算对指标字段的读取与前文结构不一致，暗示某些对比能力可能并不能按声明稳定工作。因此应判定为描述与实际行为存在一定不匹配，属于能力宣称超出代码实际实现范围。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The trigger section lists generic intents such as comparing clerks, needing rankings, or analyzing gaps, but it does not define boundaries for when this skill should activate versus when another analytics skill should handle the request. Because the phrases are broad and no exclusion conditions or negative examples are provided, the skill may be invoked unintentionally for loosely related requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill describes automatic generation of employee performance reports and pushing them to a manager over enterprise messaging without any mention of consent, minimization, or authorization checks. Because the data concerns named employees and performance metrics, silent sharing can expose personal or sensitive business information to unintended recipients or broader audiences than necessary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains natural-language descriptions, docstrings, and printed output entirely in Chinese, indicating the skill forces a specific language experience. The policy requires flagging language or locale constraints when the skill does not provide user opt-in or a documented, justified regional limitation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill prepends a writable path under the user's home directory to sys.path and then imports analyze from that location. That makes execution of this skill implicitly trust and execute whatever code exists at ~/.openclaw/skills/clerk-performance-analysis/analyze.py, creating a code-execution boundary far beyond simple comparison logic and enabling supply-chain or local path-hijack attacks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.