Security audit

city-life-copilot

Security checks for vulnerabilities and agentic risk

Overview

This city-planning skill is mostly coherent, but its installer and generated reports create review-worthy supply-chain and local-file risks.

Install only if you are comfortable with it modifying your OpenClaw skills directory, installing unpinned third-party components, using browser automation for social-media pages, and saving route/property/accessibility reports locally. Review scripts/install.js before running it, avoid running it with elevated privileges, and treat generated HTML reports as network-enabled pages rather than fully offline files.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

Location: scripts/install.js:19
Finding: Unpinned Third-Party Components Are Downloaded and Installed as Executable Skills
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/install.js:52
Finding: Shell Command Injection Through Exported Installer Functions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/dispatcher.js:449
Finding: Output Path Traversal Permits Arbitrary User-Writable File Overwrite
Content: View full analysis
{ if (result.success) { console.log('\n🎉 任务完成，文件已保存至:', result.outputPath); process.exit(0); } else { console.log('\n❌ 任务失败:', result.error); process.exit(1); } }); } ``` ```js function parseArgs() { const args = process.argv.slice(2); const params = {}; args.forEach(arg => { if (arg.startsWith('--url=')) { params.url = arg.substring(6); } else if (arg.startsWith('--output=')) { params.output = arg.substring(9); } }); return params; } ``` ```js const outputPath = params.output || path.join(OUTPUT_DIR, `xiaohongshu-${Date.now()}.json`); const result = { url: params.url, locations, routeOrder, rawContent: content }; fs.writeFileSync( outputPath, JSON.stringify(result, null, 2), 'utf-8' ); console.log(`\n✅ 结果已保存至：${outputPath}`); ``` ### Technical Analysis The dispatcher accepts an output filename from `process.argv[3]`, joins it to `OUTPUT_DIR`, and writes with `fs.writeFileSync`. It does not reject `..` path segments, directory separators, or paths that resolve outside the intended workspace. The Xiaohongshu grabber is less restrictive: a value supplied through `--output=` is used directly as the write target. It does not require the path to reside beneath `OUTPUT_ ...[truncated 1665 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: assets/templates/base_card.html:6
Finding: Generated Local Reports Execute Mutable Remote JavaScript
Content: View full analysis
{{title}} @import url('https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=Noto+Sans+SC:wght@300;400;500;600;700&display=swap'); ``` Equivalent remote dependencies appear in every generated-report template: ```html <script src="https://cdn.tailwindcss.com"></script> ``` ```css @import url('https://fonts.googleapis.com/css2?family=Inter:wght@300;400;500;600;700&family=Noto+Sans+SC:wght@300;400;500;600;700&display=swap'); ``` ### Technical Analysis The generated local HTML reports load and execute JavaScript from `https://cdn.tailwindcss.com` whenever a user opens them. The URL is mutable and has no exact version, Subresource Integrity hash, or local verification. The templates also lack a restrictive Content Security Policy. The CDN-hosted Tailwind browser script is active JavaScript, not merely a stylesheet. If the CDN, its account, its delivery path, or the user's network trust chain is compromised, the response can execute arbitrary JavaScript in every opened report. The Google Fonts import is not an executable script, but it creates an additional external request that discloses network metadata and prevents truly offline operation. These remote resources contradict the project's statement that generated reports can be viewed offline. The reports also embed an AMap iframe by design. That iframe is related to the mapping functionality, but it should be isolated with an appropriate sandbox and gov ...[truncated 1196 chars]
Remediation: View remediation
``` 5. Adjust the policy only for functionality that is demonstrably required. 6. If a remote script is unavoidable, use an immutable versioned URL and Subresource Integrity with an appropriate `crossorigin` attribute. 7. Add a `sandbox` attribute to map iframes and grant only the minimum capabilities needed by the embedded map. 8. Document that opening a map-enabled report requires network access, or provide a genuinely offline fallback. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (39)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented feature set emphasizes maps and lifestyle planning, but the observed behavior includes specialized Xiaohongshu scraping, CLI-style grabbing, and writing extracted results to local files, while some headline features are not evidently implemented. Such overclaiming and under-disclosure can conceal riskier data collection or filesystem behavior behind a friendlier description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented feature set emphasizes maps and lifestyle planning, but the observed behavior includes specialized Xiaohongshu scraping, CLI-style grabbing, and writing extracted results to local files, while some headline features are not evidently implemented. Such overclaiming and under-disclosure can conceal riskier data collection or filesystem behavior behind a friendlier description.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
- 脚本 `scripts/xiaohongshu-grabber.js` 专门处理此类链接

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
md
node scripts/install.js

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises installation steps and capabilities that involve shell execution, network access, and environment interaction, yet it declares no explicit tool scope or permissions. In a skill ecosystem, missing scope boundaries increases the chance the agent can invoke more powerful tools than users expect, especially when the skill also writes local files and installs dependencies.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The activation phrasing is broad enough to match ordinary conversation such as expressing fatigue or wanting to go out, which can cause the skill to trigger unexpectedly. In a skill that may scrape websites, install dependencies, or write local files, accidental activation increases the likelihood of surprising side effects without clear user intent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs use of a browser automation component to handle platforms with anti-scraping protections and frames a dedicated script as handling such links. In context, this goes beyond ordinary city-assistant behavior and creates a mechanism for bypassing site defenses, which can expose users to legal, account, and platform-abuse risks.
Content: No source excerpt is available for this finding.

Ssd 2

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill uses softened language to describe handling links from platforms with strong anti-crawling controls while recommending special tooling to get around those controls. Euphemistic framing is risky because it obscures that the behavior is effectively anti-scraping bypass, making users less likely to recognize the security and compliance implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill states that it saves generated HTML cards locally but does not describe filenames, output paths, overwrite behavior, or whether untrusted content may be embedded in those files. Silent local file creation can lead to user confusion, data clobbering, or persistence of scraped content on disk beyond user expectations.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 80% confidence
Finding: Using npx skills without a pinned version makes the installation path non-deterministic and vulnerable to supply-chain risk if the fetched package changes or is compromised. Because this is presented as a recommended install path, users may unknowingly execute unreviewed code from the network.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The HTML document is explicitly marked with lang="zh-CN", which enforces a specific language/locale in the rendered output. Under the policy rules, forcing a locale without offering user choice or documenting a justified regional constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The HTML root sets lang="zh-CN", which forces a specific language/locale in the rendered output. This is a natural-language policy concern because the template does not indicate user opt-in, fallback behavior, or a documented region-specific justification for restricting output to Simplified Chinese.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The HTML document hard-codes lang="zh-CN", which imposes a specific language/locale setting. Under the policy, forcing a locale without user opt-in or a clearly documented region-specific justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The template sets lang="zh-CN" and uses Chinese labels throughout the interface, which imposes a specific language/locale on all users. Under the policy, locale-specific behavior should either offer user opt-in/choice or be clearly documented as a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The title and operating instructions are entirely in Chinese and line 3 states that all requests must be routed according to this document, but there is no indication that users may choose another language. This constitutes a language/locale constraint without opt-in or justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases for '情绪盲盒模式' are very broad and map common conversational language directly into a data-fetching workflow. In this skill, broad intent capture matters because activation can lead to autonomous web fetching, route generation, and file creation without confirming user intent, making unintended tool use and data handling more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow directs the agent to write generated HTML files locally and provide the path, but it does not require informing the user beforehand that persistent files will be created. Silent local persistence is risky because outputs may contain scraped content, location data, or inferred accessibility/property preferences that remain on disk after the interaction.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest describes a city concierge focused on mood-based outings, link-to-itinerary conversion, housing radar, and accessibility support. However, the '硬核管家模式' is defined to automatically trigger broad surrounding-facility scans and commute analysis without further user instruction, turning a housing query into a more expansive neighborhood profiling workflow than the concise description suggests.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The housing workflow says that once certain intent is recognized, the agent should automatically perform a five-dimensional neighborhood scan '无需用户吩咐'. In a property-evaluation context, this expands data collection and analysis beyond the user's explicit request boundary and can infer personal priorities such as commute and family needs without consent, which is risky even if not overtly malicious.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The workflow explicitly instructs the agent to perform web scraping and downstream analysis immediately after detecting accessibility-related trigger words, while avoiding follow-up questions. In this context, that can cause unconsented collection, inference, and processing of sensitive health- or disability-adjacent information based on a single keyword, increasing privacy risk and the chance of acting on incorrect assumptions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The routing rules rely on underspecified keyword matching across multiple modes, with no negative examples, precedence rules, or ambiguity handling. In this skill, misrouting is security-relevant because each mode can trigger different external fetches, analysis flows, and local file writes, so a casual phrase may cause the wrong workflow to run and process unnecessary data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The global rules make local file creation mandatory for all modes without any user-facing disclosure. Because these modes process itinerary, property, and accessibility-related information, mandatory undisclosed persistence increases privacy exposure and creates unnecessary retention of potentially sensitive derived data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill’s stated purpose is city guidance using maps and web scraping, but this code derives filesystem locations from HOME/USERPROFILE and operates in a persistent workspace directory. That local environment and filesystem access is not an obvious requirement of route planning or housing/accessibility assistance as described in the manifest.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest describes a city-life assistant focused on map- and web-based planning features such as mood suggestions, link-based route generation, housing radar, and accessibility support. This file implements a generic file-export pipeline that writes rendered HTML to the local workspace, which is a broader document-generation/output behavior not clearly reflected in the manifest description.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The installer provisions agent-browser and explicitly frames it as necessary for anti-crawl sites, expanding the skill's capabilities well beyond a normal city-assistant function into full browser automation. That increases the attack surface substantially, since a browser automation skill can access authenticated web sessions, interact with arbitrary sites, and be repurposed for unintended automation or data access.
Content: No source excerpt is available for this finding.