Weibo Timeline Monitor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:37 AM UTC
• Version: 0.1.4

Overview

This Weibo monitoring skill is purpose-aligned, but it creates an ongoing scheduled agent task using an authenticated browser profile without clear lifecycle controls.

Review before installing. The skill does not show evidence of credential theft, remote payload execution, or data exfiltration, but running the cron installer will create a recurring OpenClaw task that uses your logged-in Weibo browser profile and keeps writing local digest files until you remove it. Use it only if you are comfortable with that ongoing automation, and prefer adding your own uninstall/disable steps and validating the task name.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: scripts/install_cron.sh:8

Finding

Persistent OpenClaw Scheduled Task Without Lifecycle Controls

Content

View full analysis

Vulnerability Details

File Location: scripts/install_cron.sh, lines 8-25
Vulnerability Type: T06: System Persistence
Risk Level: High

Vulnerable Code:

bash

PROMPT_DIR="${HOME}/.openclaw/prompts"
PROMPT_FILE="${PROMPT_DIR}/${NAME}.prompt"

mkdir -p "${PROMPT_DIR}"

cat > "${PROMPT_FILE}" <<PROMPT
使用 weibo-fresh-posts 技能。
要求：
1) 使用 browser 的 profile=openclaw、target=host 打开 https://weibo.com。
2) 抓取前必须点击左侧“最新微博”。
3) 按发帖时间写入 YYYY-MM-DD HH:mm，禁止使用抓取时间。
4) 发帖内容列必须写原始贴文正文，不能写成总结。
5) 若卡片正文被截断，进入原帖详情提取完整正文。
6) 抓取窗口为最近 ${WINDOW} 分钟。
7) 按原始链接去重，写入 ~/weibo-digest/YYYY-MM-DD.md。
PROMPT

openclaw cron add \
  --name "${NAME}" \
  --every "${INTERVAL}" \
  --session isolated \
  --message "$(cat "${PROMPT_FILE}")" \
  --timeout-seconds 240 \
  --no-deliver

Technical Analysis

The installer creates a persistent prompt under ~/.openclaw/prompts and registers a recurring OpenClaw cron task. The scheduled task survives the installation process and continues launching isolated agent sessions at the configured interval.

The recurring task operates the openclaw browser profile, which the documentation expects to be authenticated to Weibo. Although this persistence supports the advertised monitoring functionality and requires the user to run the installer, the project does not provide an uninstall mechanism, task expiration, execution-count limit, or confirmation that clearly presents the persistent resources before creating them.

Attack Path

1. The user follows the installation instructions and runs scripts/install_cron.sh.
2. The script creates a prompt file under ~/.openclaw/prompts.
3. The script registers the prompt as a recurring OpenClaw cron task.
4. OpenClaw subsequently launches isolated agent sessions at every configured interval.
5. Each session accesses Weibo through the existing openclaw browser profile and writes collected data to the local digest.

...[truncated 734 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit confirmation immediately before registering the recurring task.
• Display the task name, interval, prompt path, browser profile, timeout, and exact command that will be persisted.
• Add a documented uninstall script that removes both the OpenClaw cron entry and its prompt file.
• Support an optional expiration time or maximum execution count.
• Detect an existing task with the same name and request confirmation before replacing or duplicating it.
• Document commands for listing, disabling, and deleting installed tasks.
• Use restrictive permissions for the prompt directory and file, such as directory mode 0700 and file mode 0600.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/install_cron.sh:6

Finding

Path Traversal Through Unvalidated Cron Task Name

Content

View full analysis

Vulnerability Details

File Location: scripts/install_cron.sh, lines 6-13
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code:

bash

NAME="${3:-weibo-fresh-posts}"

PROMPT_DIR="${HOME}/.openclaw/prompts"
PROMPT_FILE="${PROMPT_DIR}/${NAME}.prompt"

mkdir -p "${PROMPT_DIR}"

cat > "${PROMPT_FILE}" <<PROMPT

Technical Analysis

The third command-line argument is accepted as NAME without validation and is interpolated directly into PROMPT_FILE. Shell quoting prevents ordinary shell metacharacters from being interpreted as commands, but it does not prevent filesystem traversal.

A value containing ../ can cause the resulting path to resolve outside ~/.openclaw/prompts. The cat > "${PROMPT_FILE}" redirection creates the selected file or truncates an existing one before writing the generated prompt. The destination must end in .prompt because that suffix is appended by the script, and all parent directories must already exist or be otherwise reachable.

Attack Path

1. An attacker convinces a user or automation system to invoke the installer with a crafted third argument containing traversal components, such as ../../target.
2. The script constructs PROMPT_FILE by concatenating the trusted prompt directory, the attacker-influenced name, and .prompt.
3. Filesystem path resolution processes the ../ components and escapes the intended prompt directory.
4. The shell redirection creates or truncates the resolved .prompt file using the invoking user's privileges.
5. The script writes the generated task instructions to that unintended destination and attempts to create a cron task using the same attacker-influenced name.

Impact Assessment

Exploitation can create or overwrite files ending in .prompt at locations writable by the invoking user. This could corrupt user configuration or place agent instructions in another prompt-cons ...[truncated 356 chars]

Remediation

View remediation

Remediation Suggestions

• Validate NAME against a strict allowlist before using it in either a path or command argument. For example:

  bash

  if [[ ! "$NAME" =~ ^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$ ]]; then
    printf 'Invalid task name\n' >&2
    exit 1
  fi
  

• Explicitly reject path separators, traversal components, control characters, whitespace, and leading dashes.

• Canonicalize the destination and verify that it remains beneath the canonical PROMPT_DIR before opening it.

• Create files using restrictive permissions and avoid overwriting existing files without explicit confirmation.

• Use a fixed filename derived from a safe identifier rather than allowing an unrestricted command-line value to become part of a filesystem path.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The text explicitly says the skill is '面向中文用户' (for Chinese users), which imposes a language/locale constraint in natural language. The document does not indicate that other languages are supported or that the user can opt into this locale-specific behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

本地安装（OpenClaw）

bash

mkdir -p ~/.openclaw/workspace/skills
cp -R . ~/.openclaw/workspace/skills/weibo-fresh-posts

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The section titled '本 Skill 强制约束' mandates specific Chinese output content and format, including fields such as 发帖内容 and 内容总结, without indicating that the user can choose another language or locale. This is a natural-language policy concern because it forces a specific language context rather than offering an explicit opt-in or documenting a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The document defines the entire markdown schema in Chinese, including fixed Chinese header labels such as '微博关注摘要', '发帖时间', and '内容总结'. This appears to impose a specific language/locale format on generated artifacts without stating that the user can choose another language or that the constraint is region-specific and required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The natural-language instructions are entirely in Chinese and prescribe a specific language/locale for the skill behavior, but the script provides no opt-in, fallback, or explanation that this is a region-specific requirement. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file describes a file-write operation in the '写入与结果摘要' section, including returning the output file path, but it does not warn the user that the skill will create or modify a file. For markdown files, behaviors affecting user data should be disclosed so users understand the impact before running the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code creates ~/.openclaw/prompts and writes a new prompt file via a heredoc, which modifies user files on disk. Although the script prints the file path after completion, there is no disclosure before the write, no confirmation prompt, and no inline comment/docstring warning the user about this side effect.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.