ClawHub
Back to skill

Security audit

成交商品画像分析

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its retail analytics purpose, but it loads code from an unmanaged absolute local path outside the reviewed package before calling the BI API.

Review this skill before installing. Its retail analytics behavior is coherent, but it should not rely on /Users/yangguangwei/.openclaw/workspace-front-door for imports; package or pin api_client inside a trusted dependency path before use. Also verify that users are authorized for the storeId/date range being queried and that Chinese-only output is acceptable for the intended users.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T07 · Tool Hijacking and Spoofing

Warning
Location
analyze.py:15
Finding

Hard-Coded External Import Path Enables Local Dependency Hijacking

Content
View full analysis

Vulnerability Details

File Location: analyze.py, lines 15–17
Vulnerability Type: Local tool and module hijacking through unsafe import-path precedence
Risk Level: Medium

Vulnerable Code

python
import sys
sys.path.insert(0, '/Users/yangguangwei/.openclaw/workspace-front-door')
from api_client import get_copilot_data

Technical Analysis

The code inserts a user-specific directory at index 0 of sys.path, giving that external directory precedence over standard and installed Python module locations. It then imports api_client, which is not included in the audited project and is not subject to any version pinning or integrity verification by this Skill.

Python executes a module's top-level code when importing it. Consequently, any party able to create or replace /Users/yangguangwei/.openclaw/workspace-front-door/api_client.py can cause attacker-controlled Python code to execute when analyze.py is imported or run. The imported function also handles the subsequent BI API request, allowing a spoofed module to modify requests, falsify responses, or capture data.

Attack Path

  1. An attacker obtains write access to /Users/yangguangwei/.openclaw/workspace-front-door, directly or through another compromised process.
  2. The attacker creates or replaces api_client.py in that directory.
  3. A user or Agent imports the Skill or executes analyze.py.
  4. sys.path.insert(0, ...) makes the external directory the first module-resolution location.
  5. Python loads the attacker-controlled api_client.py and executes its top-level code with the privileges of the Agent process.
  6. The malicious implementation can additionally intercept the call to get_copilot_data, capture query data, alter API behavior, or return forged analytics results.

Impact Assessment

Successful exploitation permits arbitrary Python execution with the same operating-system privileges as the process loading the Skill. Depending on those privileges, the ...[truncated 527 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the runtime path modification:
    python
    sys.path.insert(0, '/Users/yangguangwei/.openclaw/workspace-front-door')
  2. Package api_client within a trusted application package, or declare it as an explicit dependency installed into an isolated virtual environment.
  3. Pin the dependency to an approved version and verify its integrity using package hashes or a trusted lock file.
  4. Use package-relative imports when the client is part of the same trusted codebase.
  5. Ensure dependency directories are not writable by untrusted users or processes.
  6. Avoid user-specific absolute paths so deployment does not silently resolve modules from unmanaged locations.
  7. Add startup validation that confirms the imported module originated from the expected trusted path, as defense in depth rather than as a substitute for safe packaging.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script prepends a hard-coded local filesystem path to sys.path, allowing imports from outside the skill boundary. This weakens code provenance and can cause the skill to execute unintended or tampered local modules if that path contains malicious code or is writable by others.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrases are broad enough to match generic analytics questions such as what categories sell well or what the main price band is, which can cause the agent to invoke this skill outside a narrowly intended context. Over-broad routing increases the chance of unintended data access or incorrect tool selection, especially because the skill takes store identifiers and queries a BI endpoint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The natural-language description and all user-facing output strings are Chinese-only, with no indication that the user can choose another language. Under the stated policy, forcing a specific language without opt-in is a locale/language policy concern unless the restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest describes analysis of category, price band, bag shape, color, launch time, and period-over-period change, but the module documentation also declares brandFeature and orderFeature as data sources. Brand distribution and order characteristics like discount/cross-sell are not part of the stated core capabilities, so the documented behavior exceeds the declared skill scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

All user-facing natural-language content in the manifest and README is exclusively Chinese, which implies a fixed language experience. The file does not state that the skill is China-specific or otherwise provide user opt-in for language/locale selection.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module docstring states that orderFeature represents 订单特征（折扣、连带）, implying the skill analyzes order-related characteristics. However, the code only processes category, price range, shape, color, and launch-date features, with no logic using orderFeature, so the documentation overstates actual behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

This code file performs an HTTP/API call to /api/v1/store/dashboard/bi using a store identifier and date range, which constitutes transmission of business-related data. Although the script prints the endpoint and parameters, it does not disclose any privacy or data-transmission warning in comments, docstrings, or other user-facing safety guidance.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.