日用品保质期管理

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:03 AM UTC
• Version: 1.0.0

Overview

This shelf-life manager is purpose-aligned, but it automatically creates a persistent daily agent task and allows data changes through broad natural-language triggers without enough user control.

Review before installing. The skill can create and modify a Feishu Bitable, store its identifiers locally, delete records, and set up a recurring daily agent task. Install only if you are comfortable with automatic reminders and broad Chinese-language trigger phrases; consider requiring explicit confirmation for initialization, deletion, and cron creation, plus a way to disable the scheduled job.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: SKILL.md:91

Finding

Persistent Cross-Session Agent Execution Through a Scheduled Cron Job

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 91–105 and 197
Vulnerability Type: T06: System Persistence
Risk Level: High

Vulnerable code segment:

json

{
  "name": "保质期过期提醒",
  "schedule": { "kind": "cron", "expr": "0 9 * * *", "tz": "Asia/Shanghai" },
  "payload": {
    "kind": "agentTurn",
    "message": "执行保质期过期提醒检查：读取 config.json 获取多维表格信息，查询所有「状态」为「即将过期」或「已过期」且「已用完」为 false 的商品记录。如果有，整理成简洁列表通过飞书发送给当前用户（从消息上下文获取 SenderId）；如果没有，静默结束不发消息。config.json 路径：~/.openclaw/workspace/skills/shelflife/config.json"
  },
  "sessionTarget": "isolated",
  "delivery": { "mode": "none" }
}

The Skill also explicitly states at line 197:

text

- 每日 9:00 定时检查由 cron 任务自动执行，agent 在 isolated session 中运行

Technical Analysis

During automatic initialization, the Skill directs the Agent to register a daily cron task whose payload launches a new agentTurn in an isolated session. This task survives the initiating Skill invocation and repeatedly executes at 09:00 in the Asia/Shanghai time zone.

The recurring task reads persistent configuration, accesses the configured Feishu Bitable database, evaluates product records, and may send messages to the user. The Skill does not require explicit confirmation immediately before registering this persistent task. It also provides no documented workflow to inspect, disable, or delete the scheduled job.

This is system persistence because the scheduled Agent execution remains active across sessions and continues operating after the original interaction has ended.

Attack Path

1. A user invokes the Skill with a shelf-life-related phrase.
2. The Skill reads config.json and finds that initialization is incomplete or that app_token is empty.
3. Automatic initialization creates the Feishu Bitable resources.
4. The Skill invokes cron add without a separate, explicit scheduling confirmation.
5. A persistent daily task is registered wit ...[truncated 1070 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, informed user consent immediately before calling cron add.
2. Clearly disclose the schedule, time zone, accessed data, outbound messaging behavior, and cross-session nature of the task.
3. Make reminders optional rather than an automatic part of first-use initialization.
4. Provide commands to inspect, pause, resume, and permanently delete the scheduled job.
5. Remove the cron job during Skill reset, disconnection, or uninstallation, and clear cron.reminder_job_id after successful deletion.
6. Verify that an existing job ID remains valid before creating another task to prevent duplicate persistent jobs.
7. Apply least privilege to the scheduled operation, limiting it to read access for the required table and narrowly scoped message delivery.
8. Prefer a dedicated reminder mechanism over a general recurring agentTurn when the platform supports one.
9. Add expiration or renewal controls so the schedule does not continue indefinitely without periodic user confirmation.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are broad enough to activate on ordinary conversation, including short phrases like '加个xxx' and even the single word '保质期'. Because this skill performs state-changing actions such as auto-initialization, record creation, deletion, and scheduling cron jobs, unintended activation can lead to unauthorized data changes and background task creation without clear user intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

| 已用完 | 复选框(7) | 默认 false | | 标签 | 单选(3) | 食品/罐装/日用品/洗护用品 |

字段定义（create 时传入的 fields 数组）：

text

商品名称: type=1 (文本)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

| 已用完 | 复选框(7) | 默认 false | | 标签 | 单选(3) | 食品/罐装/日用品/洗护用品 |

字段定义(create 时传入的 fields 数组):

text

商品名称: type=1 (文本)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The query triggers are ambiguous and underspecified, especially phrases like '看一下', '列表', and '都有什么', which can naturally appear in unrelated contexts. In a skill that reads persistent personal inventory data, accidental invocation can disclose stored item names and expiry information to the wrong conversational context or cause confusing cross-skill behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill allows deletion after only a loose '查询确认是哪条记录' step, but it does not require an explicit yes/no confirmation or warn about irreversible data loss. Given the overly broad trigger surface and natural-language matching, a mistaken parse or unintended activation could permanently remove user records.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.