ClawHub
Back to skill

Security audit

aimpact

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed AI-news retrieval and optional notification workflow, with no evidence of hidden code, credential theft, destructive behavior, or automatic persistence.

Install this if you want Chinese AIMPACT AI news reports from the listed ME News APIs. Only configure the cron or Windows scheduled-task examples if you explicitly want recurring delivery, and review any configured message channel because scheduled runs may post there repeatedly using your existing OpenClaw permissions.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T06 · System Persistence

Warning
Location
SKILL.md:76
Finding

Optional OS-Level Scheduled Tasks Create Persistent Agent Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 76–87
Vulnerability Type: OS-level recurring task registration
Risk Level: Medium

Vulnerable Code

bash
# Linux/macOS crontab
0 12 * * * openclaw agent --message "查询 AIMPACT 早报"
0 18 * * * openclaw agent --message "查询 24H 热点新闻榜"
0 22 * * * openclaw agent --message "查询 AIMPACT 晚报"
powershell
# 创建每日 12:00 早报任务
schtasks /create /tn "AIMPACT早报" /tr "openclaw agent --message '查询 AIMPACT 早报'" /sc daily /st 12:00

Technical Analysis

The documented commands register recurring cron jobs or a Windows Task Scheduler entry that survives the current Skill run and repeatedly launches the general-purpose openclaw agent executable.

This persistence is clearly presented as optional and supports the declared scheduled-news delivery feature. There is no evidence that the Skill silently installs a task or intends to create a covert backdoor. Nevertheless, OS-level persistence is not required for the Skill's core manual news-retrieval functionality and therefore exceeds the minimum privileges necessary for that core use case.

The examples also resolve openclaw through the scheduled task's environment rather than using a verified absolute executable path. If executable resolution or the installed binary is later compromised, the recurring task could execute attacker-controlled code. The documentation does not provide explicit consent controls, task verification, least-privilege guidance, logging, or removal instructions.

Attack Path

  1. A user copies one of the documented cron or schtasks configurations.
  2. The operating system stores a recurring task outside the Skill directory.
  3. The task launches openclaw agent every day, including after the original session ends.
  4. The task continues making Agent and network operations until separately disabled or removed.
  5. If the resolved openclaw executable or its runtime environment is subsequently replaced or compromised, the ...[truncated 712 chars]
Remediation
View remediation

Remediation Suggestions

  1. Keep scheduled delivery strictly opt-in and require explicit user confirmation immediately before creating any task.
  2. Prefer a scoped OpenClaw-native scheduler, if available, rather than persistent OS-level task registration.
  3. Use a verified absolute path to the openclaw executable and a dedicated least-privilege account.
  4. Restrict the scheduled operation to the news-retrieval action and avoid granting unrelated Agent tools or permissions.
  5. Document how to inspect and remove every example task, including the corresponding crontab and schtasks /delete procedures.
  6. Add guidance for logging, failure notification, rate limiting, and periodic review of active tasks.
  7. Do not create scheduled tasks automatically during installation or ordinary Skill invocation.
  8. Recommend manual first-run validation of the output and destination before enabling recurring delivery.

SkillSpector

Vulnerability Patterns
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

Claw 外部配置 cron 任务：

前提说明：

  • 本技能不内置、不存储任何渠道凭据。
  • 如需推送，需在 OpenClaw 中预先配置 message 工具及渠道凭据。
  • 若未配置 message 或渠道凭据，则仅输出报告，不执行推送。

推荐时间:

  • 早报: 每日 12:00
  • 晚报: 每日 22:00
  • 热点: 每日 18:00

示例配置:

bash
# Linux/macOS crontab
0 12 * * * openclaw agent --message "查询 AIMPACT 早报"
0 18 * * * openclaw agent --message "查询 24H 热点新闻榜"
0 22 * * * openclaw agent --message "查询 AIMPACT 晚报"

Windows 任务计划程序:

powershell
# 创建每日 12:00 早报任务
schtasks /create /tn "AIMPACT早报" /tr "openclaw agent --message '查询 AIMPACT 早报'" /sc daily /st 12:00

🎯 数据源配置

当前启用信源

源URL类型说明
MetaEra AI 快讯https://agent.me.news/skill/flash/list?page=1&size=20&category=aiAPIME News �

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The section heading and requirement text specify that the output must follow a Chinese-language format, and the template fields later require Chinese titles and summaries. This is a natural-language locale constraint that appears mandatory rather than optional, which can violate language-choice policy when no opt-in or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The source names, scopes, and operating instructions are presented only in Chinese, and the file directs execution based on those instructions without offering any language or locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.