ClawHub
Back to skill

Security audit

Diankeyuan Contacts

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward local contact manager; the main caution is that it stores and deletes contact records in a plaintext JSON file.

Install only if you are comfortable keeping these personnel/contact records in a local plaintext JSON file at the disclosed hard-coded path. Back up the file before using delete or update commands, and restrict local file permissions if the data includes phone numbers, email addresses, WeChat IDs, or sensitive notes.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
manager.py:10
Finding

Plaintext Storage of Sensitive Contact Data Without Enforced File Permissions

Content
View full analysis

Vulnerability Details

File Location: manager.py:10, 17-19, 22-25, 59-68
Vulnerability Type: Plaintext sensitive-data storage with insufficient local access controls
Risk Level: Medium

Vulnerable Code

python
DATA_FILE = Path("/Users/aibin/.openclaw/workspace/diankeyuan_contacts.json")
python
def load_data():
    """加载数据"""
    if not DATA_FILE.exists():
        return {"meta": {"version": "1.0.0", "totalMembers": 0}, "departments": {}, "quickSearch": {}}
    with open(DATA_FILE, 'r', encoding='utf-8') as f:
        return json.load(f)

def save_data(data):
    """保存数据"""
    data["meta"]["updatedAt"] = datetime.now().strftime("%Y-%m-%d")
    with open(DATA_FILE, 'w', encoding='utf-8') as f:
        json.dump(data, f, ensure_ascii=False, indent=2)
python
member = {
    "name": name,
    "role": role,
    "office": office,
    "phone": "",
    "email": "",
    "wechat": "",
    "addedAt": datetime.now().strftime("%Y-%m-%d"),
    "updatedAt": datetime.now().strftime("%Y-%m-%d"),
    "notes": notes
}

Technical Analysis

The application stores personnel records in an unencrypted JSON file at a fixed, documented path. The data model can contain names, roles, office locations, telephone numbers, email addresses, WeChat identifiers, and free-form notes.

The application opens the file using ordinary Python file operations but does not enforce restrictive permissions, verify file ownership, reject symbolic links, or validate the security of an existing file. The resulting permissions therefore depend on the process umask and the state of any pre-existing path. If the file is readable or writable by unintended local principals, sensitive contact data can be disclosed or modified.

The fixed path is also disclosed in SKILL.md:48, making the storage location easy to identify. The code does not transmit this information over a network, and exploitati ...[truncated 1490 chars]

Remediation
View remediation

Remediation Suggestions

  1. Create the parent data directory with owner-only permissions (0700) and verify that it is owned by the expected account.
  2. Create the data file with mode 0600 rather than relying on the process umask. Check and correct the permissions of existing files before reading or writing them.
  3. Reject symbolic links and unexpected file types. Where supported, use no-follow semantics and verify the opened file descriptor with fstat.
  4. Write updates atomically to a securely created temporary file in the same protected directory, set its mode to 0600, flush and synchronize it, and then replace the destination.
  5. Validate the ownership and mode of both the directory and file on every load. Refuse operation when either is writable by unintended users.
  6. Consider field-level or file-level encryption for phone numbers, email addresses, WeChat identifiers, and sensitive notes. Keep encryption keys outside the data file and restrict access to them.
  7. Minimize retained personal information and avoid storing optional sensitive fields unless required by the Skill's purpose.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill explicitly states it reads from and writes to a local JSON file, but it does not declare any tool scope or permissions boundaries. That creates an authorization and transparency gap: users and platforms cannot clearly see or constrain the file access the skill requires, increasing the risk of unintended filesystem access or misuse if the implementation is broader than the documentation suggests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill supports deletion and automatic saving, but it provides no warning about irreversible changes and shows deletion as a single-step action. This makes accidental or socially engineered data loss more likely, especially because contact records appear operationally useful and there is no mention of confirmation, undo, backup, or audit behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The delete_member function removes a contact from the in-memory structure and immediately writes the updated data back to disk. Although it prints a success message afterward, there is no prior confirmation prompt, cautionary comment, or user-facing warning that the action is destructive.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring and command-line help are entirely in Chinese, which effectively forces a specific language for all users. The file does not indicate that this is an intentional region-specific tool or provide any opt-in or alternative language behavior.

Content

No source excerpt is available for this finding.