Security audit

Daum Trends Briefing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Daum trends briefing script with an optional user-created cron and Telegram schedule; it has robustness caveats but no hidden or purpose-mismatched behavior.

Install only if you want Daum trend data fetched live and, if you run the cron command, hourly agent turns announced to Telegram. Consider adding redirect limits, response-size limits, and output sanitization before relying on it for automated announcements.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/briefing.mjs:6
Finding: Unrestricted Redirect Following and Unbounded HTTP Response Buffering
Content: View full analysis
{ const u = new URL(url); const req = https.request( { method: 'GET', hostname: u.hostname, path: u.pathname + u.search, headers: { 'user-agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123 Safari/537.36', accept: 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8', 'accept-language': 'ko-KR,ko;q=0.9,en-US;q=0.7,en;q=0.6' } }, (res) => { if (res.statusCode && res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) { // follow redirect (handle relative Location) const nextUrl = new URL(res.headers.location, url).toString(); resolve(fetchText(nextUrl, { timeoutMs })); res.resume(); return; } if (!res.statusCode || res.statusCode < 200 || res.statusCode >= 300) { const code = res.statusCode; res.resume(); reject(new Error(`HTTP ${code} for ${url}`)); return; } res.setEncoding('utf8'); let data = ''; res.on('data', (c) => (data += c)); res.on('end', () => resolve(data)); } ); req.on('error', reject); req.setTimeout(timeoutMs, () => { req.destroy(new Error(`Timeout after ${timeoutMs}ms for ${url}`)); }); req.end(); }); } ``` ### Technical Analysis The HTTP helper follows every redirect recursively without a redirect counter, destination-host allowlist, protocol validation, or private-address restriction. Consequently, a redirected request is not constrained to the expected Daum domains. The helper also concate ...[truncated 1633 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/briefing.mjs:171
Finding: Remote Content Can Inject Additional Lines and Control Characters into Announced Output
Content: View full analysis
k?.keyword) .filter((k) => typeof k === 'string' && k.trim().length > 0) .slice(0, 10); ``` ```js const title = decodeHtmlEntities(stripTags(m[2])).replace(/\s+/g, ' ').trim(); ``` ### Technical Analysis Keywords and `updatedAt` are extracted from remote HTML and inserted directly into stdout without removing newline characters or terminal control sequences. Titles receive whitespace normalization, but other externally sourced fields do not receive equivalent normalization. The expression `lines.slice(0, 12)` limits the number of JavaScript array elements, not the number of physical output lines. A keyword or timestamp containing carriage-return or newline characters can therefore produce more than the documented 12 lines. `SKILL.md` recommends announcing stdout to Telegram “as-is.” This turns malformed or attacker-influenced upstream content into externally delivered message ...[truncated 1366 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.
md
- Entry point: `scripts/briefing.mjs`

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
In this OpenClaw setup, cron jobs typically run an agent turn. The agent can execute the Node script and then announce the stdout to Telegram.

Create a cron job with the CLI (recommended):

bash
openclaw cron add \

Static analysis

No suspicious patterns detected.