门店客流分析

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:40 AM UTC
• Version: 1.0.0

Overview

The skill has a coherent retail analytics purpose, but its Python code loads an unaudited external module from a developer-specific local path before fetching store data.

Review this skill before installing. It appears intended for legitimate retail funnel analysis, but it should not rely on a developer-specific external Python path; ask the publisher to bundle or pin the API client and document exactly what service receives store IDs and date ranges.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: analyze.py:7

Finding

Unsafe External Module Loading Through a Hard-Coded Import Path

Content

View full analysis

Vulnerability Details

File Location: analyze.py, lines 7-9
Vulnerability Type: Python module search-path manipulation and untrusted external dependency loading
Risk Level: Medium

Vulnerable Code

python

import sys
sys.path.insert(0, '/Users/yangguangwei/.openclaw/workspace-front-door')
from api_client import get_copilot_data

Technical Analysis

The script prepends a hard-coded directory outside the audited skill package to sys.path. Because this directory is inserted at index zero, Python gives a module named api_client in that location precedence over modules available from other locations.

Importing api_client executes its top-level Python code immediately. The referenced module is not included in the project, so its implementation, API destination, authentication behavior, TLS configuration, and side effects cannot be verified by this audit. The security of the skill therefore depends on the integrity and permissions of an unaudited external directory.

The documentation also shows a different path, ~/.openclaw/skills/traffic-analysis. Python does not automatically expand ~ when it appears as a sys.path entry, and that documented path is inconsistent with the developer-specific absolute path in the implementation.

Attack Path

1. An attacker gains the ability to create or replace api_client.py, or an equivalent api_client package, under /Users/yangguangwei/.openclaw/workspace-front-door.
2. A user or agent imports or executes analyze.py.
3. The script places the external directory first in Python's module search path.
4. Python resolves from api_client import get_copilot_data to the attacker-controlled module.
5. The malicious module's initialization code executes with the same operating-system permissions as the agent process.
6. The substituted function can intercept store identifiers and date ranges, falsify funnel data, redirect requests, or perform other ...[truncated 903 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the runtime modification of sys.path.

2. Bundle the API client inside the skill package and use an explicit package-relative import, for example:

   python

   from .api_client import get_copilot_data
   

3. Package the skill through a standard Python package configuration so module resolution does not depend on machine-specific absolute paths.

4. If the API client must remain external, inject a validated client object into analyze() rather than dynamically selecting a module through the search path.

5. Restrict ownership and write permissions on all executable dependency locations.

6. Pin dependency versions and use integrity verification for distributed components.

7. Define and enforce an HTTPS API base URL and an allowed-host policy in the client.

8. Update SKILL.md so its import instructions match the secured package layout; use pathlib.Path.expanduser() if user-home expansion is genuinely necessary.

9. Add tests that verify the imported client resolves to the expected package file and that unexpected local modules cannot shadow it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

All user-facing natural-language instructions, triggers, and outputs are presented in Chinese, which effectively forces a specific language experience. The file does not indicate that the skill is region-specific, nor does it offer users an opt-in or alternative language.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are very broad and map to common, ambiguous user requests like asking how traffic is or requesting conversion analysis. This can cause unintended activation of the skill, leading to unnecessary data access, incorrect tool routing, or disclosure of store analytics when the user did not explicitly request this specific capability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module docstring and all user-visible log strings are written exclusively in Chinese, indicating the skill is effectively locked to a specific language/locale. The file does not provide any opt-in, language selection, or justification for this locale constraint, which matches the policy's language-choice concern.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code prepends a hard-coded local workspace path to sys.path before importing api_client, which allows Python to resolve imports from an unexpected filesystem location outside the skill package. In an agent/runtime context, this creates a code injection and trust-boundary violation risk: if that path exists and is writable or contains a trojanized module, the skill may execute attacker-controlled code under the guise of a normal import.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code sends store-specific analysis parameters to an API endpoint via get_copilot_data, which is a network operation involving potentially sensitive business data. Aside from verbose debug logging, there is no confirmation prompt or clear user-facing warning in the code comments/docstring that the skill will transmit this data to a remote service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill explicitly states it will pull data from an API and includes parameters such as store ID and date range, but it does not disclose that network access occurs or that these identifiers are transmitted. This reduces transparency and can result in users or operators unknowingly sending potentially sensitive business telemetry to backend services.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.