T09 · Insecure Skill Coding Practices
Error
- Location
convert.py:16- Finding
OS Command Injection Through Shell-Based Command Construction
- Content
View full analysis
- Remediation
View remediation
Security audit
随便算算-八字命理助手
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its astrology purpose, but it needs Review because it ships an unsafe shell-based helper and automatically uses local model credentials/configuration for external LLM calls.
Install only if you are comfortable with a Chinese-language astrology skill sending birth details and questions to your configured OpenAI/OpenClaw-compatible provider. Before use, remove or fix convert.py, avoid running it with untrusted input, pin dependencies, and explicitly review which API key/base URL/model the skill will load, including any ~/.openclaw/openclaw.json fallback.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unpinned and Unverified Third-Party Dependencies
- Content
View full analysis
=2.0.0 python-dotenv>=1.0.0 bidict lunar-python ``` The documented installation procedure in `README.md:15-17` invokes this dependency file directly: ```bash python3 -m venv .venv source .venv/bin/activate pip install -r requirements.txt ``` ### Technical Analysis The dependency manifest does not provide a reproducible or integrity-verified dependency set: - `openai>=2.0.0` and `python-dotenv>=1.0.0` permit arbitrary future releases. - `bidict` and `lunar-python` have no version restrictions. - No package hashes are provided. - Transitive dependencies are not locked. Consequently, identical installation commands may install different code over time. If an allowed future release or a transitive dependency is compromised, removed and replaced, or otherwise becomes malicious, that code could be installed without any change to this repository. This finding identifies an unsafe supply-chain configuration; the reviewed evidence does not establish that any currently named package is malicious. ### Attack Path 1. A user follows the documented setup instructions and runs `pip install -r requirements.txt`. 2. The package resolver selects the latest versions satisfying the broad or absent constraints, including their unresolved transitive dependencies. 3. A compromised or unexpectedly modified eligible release is downloaded from the configured package index. 4. Package installation hooks, import-time code, or later runtime code executes in the Skill environment. 5. The dependency runs with the same filesystem, environment-variable, credential, and network access available to the Skill process. ### Impact Assessment The practical scope depends on the privileges used during installation and execution: - During installation, a malicious package may ...[truncated 683 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (46)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
如果运行环境没有注入这些变量，可以复制
.env.example后填写本地配置：bash cp .env.example .env使用方式
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The code clearly supports core astrology computation: bazi chart generation and dayun analysis, including related annotations such as shensha and ten-deity relationships. However, the declared description also claims full-report generation and chat context building, which are not present in this code chunk. The code is strictly a computational backend/CLI module with parsing and data construction, not a report composer or chat-context builder. Additionally, it includes liunian calculation, an analysis capability omitted from the description. Therefore the description does not accurately represent the supplied code's actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents an active skill that performs multiple user-facing operations: generating bazi charts, analyzing dayun, producing full reports, and building chat context. However, the supplied code chunk contains only imported symbols and extensive constant dictionaries/lookup tables with interpretive text. There are no functions, classes, I/O paths, control flow, request handlers, or orchestration logic that carry out those declared tasks. While these data structures may support an astrology system elsewhere, this specific chunk’s actual behavior is limited to defining static reference data. Therefore the description does not accurately represent what this code chunk itself does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The code is clearly related to Chinese astrology/Bazi: it contains heavenly stems, earthly branches, 60 ganzhi mappings, ten deities, element relationships, branch interactions, descriptive texts, and health/fortune lookup tables. It also includes small utility functions such as getGZ(), get_jizhu(), get_year_of_ganzhi(), and get_current_year(). However, the declared description claims broader operational capabilities: running bazi chart generation, dayun analysis, full-report generation, and chat context building. None of those higher-level workflows are present in this code chunk. There is no input handling for birth datetime, no construction of a full four-pillar chart, no dayun/luck-cycle computation logic, no report assembly/output generation, and no conversation/context-building logic. There are also no suspicious undeclared permissions or resource accesses; the mismatch is about overstating implemented functionality relative to what this specific code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear description-behavior mismatch. The declared purpose claims substantial astrology functionality, but the supplied code chunk contains only a stub function with no analysis, report generation, context building, input handling, or external/resource access. Its actual purpose is merely to provide a placeholder return value and prevent import failures.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python for item in zip(options.gans, options.zhis): result = result + "".join(item) + " " #subprocess.call("cls", shell=True) print(result) print(subprocess.check_output("python bazi.py -b " + result, shell=True).decode('gbk'))
Unvalidated Output Injection
High
- Category
- Output Handling
- Confidence
- 95% confidence
- Finding
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
- Content
python #subprocess.call("cls", shell=True) print(result) print(subprocess.check_output("python bazi.py -b " + result, shell=True).decode('gbk'))
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This finding is valid because the skill's stated purpose is astrology chart generation, yet it exposes shell execution using user-derived input. That unnecessary shell capability materially increases risk, since the attacker can potentially turn a chart-generation input into arbitrary command execution.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
User input is transformed into result and then passed as part of a shell command string to subprocess.check_output with shell=True. This is a classic tool-parameter abuse vector: an attacker can supply shell metacharacters or additional commands, causing execution beyond the intended astrology parameters.
- Content
python #subprocess.call("cls", shell=True) print(result) print(subprocess.check_output("python bazi.py -b " + result, shell=True).decode('gbk'))
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python """ complete_dayun_text = format_complete_dayun(complete_dayun) if analysis_type in PROMPT_TEMPLATES: return PROMPT_TEMPLATES[analysis_type].format( bazi_info=bazi_info, complete_dayun=complete_dayun_text, dayun_list="未提供当前三步大运信息。",
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python """ complete_dayun_text = format_complete_dayun(complete_dayun) if analysis_type in PROMPT_TEMPLATES: return PROMPT_TEMPLATES[analysis_type].format( bazi_info=bazi_info, complete_dayun=complete_dayun_text, dayun_list="未提供当前三步大运信息。",
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python """ complete_dayun_text = format_complete_dayun(complete_dayun) if analysis_type in PROMPT_TEMPLATES: return PROMPT_TEMPLATES[analysis_type].format( bazi_info=bazi_info, complete_dayun=complete_dayun_text, dayun_list="未提供当前三步大运信息。",
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python """ complete_dayun_text = format_complete_dayun(complete_dayun) if analysis_type in PROMPT_TEMPLATES: return PROMPT_TEMPLATES[analysis_type].format( bazi_info=bazi_info, complete_dayun=complete_dayun_text, dayun_list="未提供当前三步大运信息。",
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python """ complete_dayun_text = format_complete_dayun(complete_dayun) if analysis_type in PROMPT_TEMPLATES: return PROMPT_TEMPLATES[analysis_type].format( bazi_info=bazi_info, complete_dayun=complete_dayun_text, dayun_list="未提供当前三步大运信息。",
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python """ complete_dayun_text = format_complete_dayun(complete_dayun) if analysis_type in PROMPT_TEMPLATES: return PROMPT_TEMPLATES[analysis_type].format( bazi_info=bazi_info, complete_dayun=complete_dayun_text, dayun_list="未提供当前三步大运信息。",
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
python """ complete_dayun_text = format_complete_dayun(complete_dayun) if analysis_type in PROMPT_TEMPLATES: return PROMPT_TEMPLATES[analysis_type].format( bazi_info=bazi_info, complete_dayun=complete_dayun_text, dayun_list="未提供当前三步大运信息。",
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README states that the skill returns analysis suitable for the user to read in Chinese, which imposes a language choice by default. There is no indication of user opt-in, alternative language support, or a documented reason that the skill must only respond in Chinese.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README says the skill should respond when the user says phrases like “帮我分析一下”, which is a very common, non-domain-specific expression. Without stronger constraints or negative examples, this can cause unintended invocation for generic requests unrelated to bazi astrology.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README explicitly states that the skill can be called even when the user only says “帮我分析一下”, after which it asks for missing birth details. This makes the activation boundary unclear and broad, since a commonplace phrase by itself is treated as sufficient to invoke the skill.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The user-facing requirements and examples are written as Chinese-only interaction patterns, including required input phrasing and example requests, but the document does not state that this is a region-specific skill or offer users a language/locale option. This can violate language/locale policy when a skill implicitly constrains interaction to a specific language without opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file describes generic user requests such as “帮我分析” and broad categories like 'concrete question' and 'time-related questions' as activation conditions. Those phrases are common and underspecified, and the file does not provide negative examples or tighter scope constraints to distinguish when the skill should or should not be invoked.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This file contains user-facing strings and instructions in Chinese throughout, indicating the skill expects and responds in a single language. There is no indication that users may choose another language or locale, which conflicts with the policy against forcing a language without opt-in.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill reads ~/.openclaw/openclaw.json plus multiple environment variables to automatically inherit host model configuration and API credentials. That expands the skill's privilege boundary beyond astrology-specific inputs and can let the skill silently use host secrets or externally configured backends without explicit user or operator consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill assembles detailed birth data, Bazi chart information, and analysis context, then sends it to an external LLM via chat completions. Birth date/time and derived profile data are sensitive personal information, and this code provides no consent flow, minimization, or warning before transmitting that data off-box.
- Content