Security audit

corn-manager-master

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real OpenClaw cron helper, but it can create persistent message-sending tasks and its recipient-targeting behavior is not safely implemented or clearly controlled.

Install only if you are comfortable with a skill that can create persistent OpenClaw cron jobs and send announcements. Before using it, explicitly verify the cron schedule, message, channel, and recipient; do not rely on the claimed automatic extraction unless you have confirmed the runtime implements it. Avoid sensitive task names or messages if memory/log recording is enabled, and periodically list and delete cron tasks you no longer need.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill claims it will automatically extract the current session context, but the documented command templates hard-code example values for `--channel feishu` and `--to "ou_xxxxxx"`. In practice, this can cause tasks and messages to be created for the wrong recipient or platform, leading to unintended message delivery, privacy exposure, and unsafe automation against an incorrect target.

Context-Inappropriate Capability

Medium

Confidence: 83% confidence
Finding: The skill instructs the agent to write operational checks, records, or exception details into system memory or log files even though that behavior is not necessary for merely creating and verifying cron tasks. This expands the data handling scope and can persist sensitive task content, identifiers, or operational context beyond user expectations, increasing privacy and retention risk.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script hard-codes default recipient and channel values despite claiming it will automatically extract them from the current conversation context. In a scheduling skill, this can cause messages or task results to be sent to the wrong user or platform if operators assume the defaults are context-derived and safe.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The inline documentation states that channel and user_id are automatically extracted from the current session, but the code does not implement that behavior. Misleading documentation in an automation skill is dangerous because users may trust that recipient targeting is context-bound when the script actually falls back to static values or manual overrides, increasing the chance of misdelivery.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill explicitly directs automatic extraction and use of `channel` and `user_id` from the current session without a user-facing notice or consent mechanism. Although these fields are operationally useful, silently reusing session identifiers for message delivery can expose personal or routing data and create actions on behalf of the user without sufficient transparency.

Static analysis

No suspicious patterns detected.