workday-calculator

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 10:30 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Chinese workday calculator with some ordinary local install/export behaviors and no evidence of hidden exfiltration, persistence, or destructive activity.

Install this only if you want a Chinese-calendar workday calculator. Review the install location before running install.sh, avoid the optional sudo symlink unless you need a system-wide command, and choose export filenames carefully because existing files at that path can be overwritten.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documented purpose is a simple workday calculator, but the static analysis indicates additional behaviors such as reading local Python files and modifying holiday data/code-generation workflows. This mismatch is dangerous because users or orchestrators may invoke the skill trusting a low-risk calculator while it actually exposes broader local access and mutation capabilities.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

print("-" * 60)
    
    try:
        result = subprocess.run(
            cmd,
            shell=True,
            capture_output=True,

• Confidence: 97% confidence
• Finding: Using shell=True creates a tool-parameter abuse risk because the shell interprets metacharacters, enabling arbitrary command chaining if any portion of the command becomes attacker-controlled. In a skill ecosystem, where wrappers and examples may later be adapted to accept prompts or external input, this pattern is especially risky despite the current hardcoded commands.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file is entirely written in Chinese and references China-specific resources and holiday support, but it does not state that the skill is intentionally China-only or provide an opt-in language/locale choice. Under the policy, forcing a specific language or locale without user choice or clear justification is a natural-language policy concern.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The documentation presents the skill content in Chinese only, and the activation examples are also Chinese-specific, with no indication that users can choose another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is clearly justified.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The automatic trigger phrases are broad enough to match ordinary conversation, which can cause the skill to activate in situations where the user did not intend tool use. In an agent ecosystem, over-broad triggering increases the chance of unnecessary file operations, exports, or execution of auxiliary functionality, especially when the skill also advertises update tooling.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest scope is limited to calculating workdays and excluding Chinese holidays/adjusted workdays. This README documents additional operational capabilities—updating holiday datasets, performing online searches, and generating Python code—that go beyond straightforward workday calculation behavior.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: A workday-counting skill can reasonably use built-in holiday data, but an online search feature introduces a separate network-enabled capability not implied by the manifest description. This is context-inappropriate unless the skill explicitly declares that it fetches holiday information from the internet as part of its supported behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill documentation advertises shell execution, local file reads, and file writes, but the manifest does not declare any explicit tool scope or permissions boundaries. In an agent environment, this can cause the runtime to grant broader capabilities than users expect, increasing the risk of unintended command execution or filesystem access.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The manifest description is entirely in Chinese and states when the skill should be used, but it does not offer any language choice or indicate that Chinese is optional. This can violate language/locale policy when users or host environments are not explicitly opting into Chinese-only behavior.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Linux/macOS
sudo ln -s $(pwd)/scripts/workday_calculator.py /usr/local/bin/workday-calc

# 使用
workday-calc 2025-01-01 2025-01-31

• Confidence: 76% confidence
• Finding: The documentation instructs users to run a command with 'sudo' to create a symlink in a privileged system path. Even though the command itself is common, normalizing root execution in skill docs is risky because it encourages elevated execution of unreviewed local content and can magnify damage if the referenced script is modified or replaced.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: Nearly all comments and echoed user-facing messages are in Chinese, including installation guidance and trigger examples. This imposes a specific language on users without opt-in or justification, which is a natural-language policy concern under the locale/language rule.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This shell script creates installation directories and copies multiple files into them, potentially under /usr/lib/node_modules/openclaw/skills or the user's home directory. Although it logs these actions, it does not ask for user confirmation before modifying the filesystem, which is a safety-relevant operation in an installer.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The package description is written only in Chinese, which can impose a language/locale constraint on users without any opt-in or explanation. The file does not state that the skill is intentionally limited to Chinese-speaking users or a China-only compliance context.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This Python file presents its description, prompts, help text, and runtime messages entirely in Chinese, starting with the module docstring and continuing throughout the script. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The example script provides generic shell command execution via run_command, which is not necessary for a workday-calculation demo and broadens the capability surface. In an agent skill context, examples are often copied into real integrations, so retaining a shell-based helper increases the risk that user-controlled input will later be routed into arbitrary command execution.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print("-" * 60)
    
    try:
        result = subprocess.run(
            cmd,
            shell=True,
            capture_output=True,

• Confidence: 96% confidence
• Finding: The script invokes subprocess.run with shell=True on a command string, which is dangerous because any future change that incorporates user-controlled input into cmd could enable shell injection. Even though the current examples are hardcoded, this pattern unnecessarily exposes command execution through the shell in a skill whose purpose is only to demonstrate workday calculation.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: 技能清单将该技能描述为用于计算时间区间内工作日、排除中国节假日和调休安排；而这里的示例明确介绍“节假日更新工具”，并将“在线搜索节假日信息”列为主要功能。这不是实现工作日计算所必需的明显细节，而是额外的数据维护/检索能力，超出了清单声明的核心用途。

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: This code file contains natural-language strings and comments that consistently force a single language/locale experience. Under the policy, language constraints should either offer user opt-in/choice or be clearly documented as region-specific and justified.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The manifest describes a skill for answering workday and holiday-exclusion calculations, but this file implements a separate operator-facing utility to inspect, add, and generate holiday dataset code. Maintaining internal holiday definitions is related to the domain, but it is a broader behavior than the user-facing calculation capability the skill claims.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The manifest describes a skill for calculating workdays and excluding Chinese holidays/adjusted workdays when users ask about date calculations. However, the code also accepts an arbitrary --export path and writes JSON output to disk, which is a separate file-output capability not justified by the stated purpose of answering workday-calculation queries.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The documentation instructs users to export results to a JSON file and later describes using an update tool or manually editing the script, both of which can modify files on disk. While usage is shown, the README does not include an explicit warning that these actions write or alter local files and may overwrite existing data if the same path is reused.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: The manifest description is written only in Chinese and specifically describes support for Chinese holiday arrangements, which imposes a language/locale context without any indication of user choice or opt-in. Under the policy, language or locale constraints should either be optional for users or clearly documented as a justified region-specific limitation.

Description-Behavior Mismatch

Low

• Confidence: 84% confidence
• Finding: manifest 仅说明该技能用于工作日计算、节假日排除和工作时间计算，但该示例脚本专门演示了“导出功能”，并在帮助信息中将“--export 导出到JSON文件”作为正式选项公开。导出结果文件属于额外的数据输出能力，不是描述中明确声明的范围。

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: The module docstring states the script is for Chinese holiday and make-up workday rules, and all user-facing help/output strings are written in Chinese. This imposes a specific language/locale experience without offering user opt-in or alternative locale selection, which matches the language/locale policy violation category.

Static analysis

No suspicious patterns detected.