T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:119- Finding
Mandatory Promotional Content and Author-Controlled Traffic Diversion
- Content
View full analysis
- Remediation
View remediation
Security audit
AI 行业资讯专家与小红书内容创作
Security checks for vulnerabilities and agentic risk
Overview
The skill broadly matches its stated AI-news content purpose, but its real-data workflow handles web-search results unsafely and should be reviewed before installation.
Install only if you are comfortable reviewing and modifying the workflow first. Replace execSync shell-string examples with argument-array execution, escape all search-result fields before generating HTML or Markdown, disable automatic browser/directory opening unless explicitly requested, remove author-controlled promotional contact text, and avoid the unpinned npx search command.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
references/openclaw-integration.md:56- Finding
Shell Command Injection Through Interpolated Web-Search JSON
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/create-xiaohongshu-content.js:185- Finding
Unescaped Search Data Injected Into Automatically Opened HTML
- Content
View full analysis
🔥 AI 日报
${dateTime.year}.${dateTime.dateDisplay}今日重磅${newsItems[0]?.title || '暂无重磅'}${newsItems.slice(0, 3).map(news => ```` Additional external fields are inserted into detail pages: ```javascript ${pageNews.map((news, i) => `📌 ${news.title}`).join('')}`).join('')} ``` The resulting file is written and automatically opened: ```javascript const htmlContent = generateHTML(newsItems, config, dateTime); fs.writeFileSync(path.join(outputDir, 'cover.html'), htmlContent); console.log(`✅ HTML 封面已保存\n`); console.log('🌐 正在打开 HTML 预览...'); openHTML(path.join(outputDir, 'cover.html')); ``` The browser launch is implemented as follows: ```javascript function openHTML(filePath) { try { if (process.platform === 'darwin') { execSync(`open "${filePath}"`); } else if (process.platform === 'win32') { execSync(`start "" "${filePath}"`); } else { execSync(`xdg-open "${filePath}"`); } ...[truncated 2333 chars]${startIdx + i + 1} ${news.time}${news.title}${news.source}- Remediation
View remediation
', '>') .replaceAll('"', '"') .replaceAll("'", '''); } ``` 2. Apply escaping to `news.title`, `news.time`, `news.source`, and any future externally supplied field. 3. Validate input types and enforce conservative maximum lengths before rendering. 4. Add a restrictive Content Security Policy, for example: ```html ``` 5. Avoid automatically opening generated HTML derived from network content. Require explicit user confirmation or provide an inert preview. 6. Do not allow remote images, frames, forms, scripts, plugins, or network connections unless explicitly required. 7. Add security tests using script tags, SVG event handlers, image error handlers, iframe elements, and malformed closing tags. 8. Consider using a well-tested templating system with automatic escaping enabled by default. ]]>
T08 · Insecure Dependencies
Warning
- Location
README.md:54- Finding
Unpinned Runtime Package Execution Through npx
- Content
View full analysis
- Remediation
View remediation
tavily-search "..." ``` 3. Add a package manifest and lockfile containing registry integrity metadata. 4. Verify the package publisher, repository, release provenance, and expected executable name. 5. Use an approved internal registry or vendored, reviewed dependency where feasible. 6. Run third-party search tooling in a restricted environment without sensitive environment variables or unnecessary filesystem access. 7. Document the exact package identity and checksum so users can verify what will execute. 8. Periodically re-audit the pinned dependency before updating it. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (31)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill claims to retrieve the latest 24-hour AI news, but the document explicitly states that the bundled Node.js script cannot perform that search directly and may fall back to built-in demo data. It also describes invoking external scripts via child_process/execSync, which is operational behavior not surfaced in the top-level purpose. This mismatch can mislead users into trusting freshness and behavior that are not guaranteed, increasing the chance of inaccurate output or unexpected local execution.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/run-full-flow.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 由 OpenClaw 主流程负责搜索，然后调用生成脚本。参考 `references/openclaw-integration.md`。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 由 OpenClaw 主流程负责搜索，然后调用生成脚本。参考 `references/openclaw-integration.md`。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 脚本 `create-xiaohongshu-content.js` 是独立 Node.js 脚本，**无法直接调用 OpenClaw 的 `web_search` 工具**。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 脚本 `create-xiaohongshu-content.js` 是独立 Node.js 脚本，**无法直接调用 OpenClaw 的 `web_search` 工具**。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 脚本 `create-xiaohongshu-content.js` 是独立 Node.js 脚本，**无法直接调用 OpenClaw 的 `web_search` 工具**。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 脚本 `create-xiaohongshu-content.js` 是独立 Node.js 脚本，**无法直接调用 OpenClaw 的 `web_search` 工具**。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 脚本 `create-xiaohongshu-content.js` 是独立 Node.js 脚本，**无法直接调用 OpenClaw 的 `web_search` 工具**。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 脚本 `create-xiaohongshu-content.js` 是独立 Node.js 脚本，**无法直接调用 OpenClaw 的 `web_search` 工具**。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 脚本 `create-xiaohongshu-content.js` 是独立 Node.js 脚本，**无法直接调用 OpenClaw 的 `web_search` 工具**。
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The natural-language instructions throughout the file are presented only in Chinese, and the skill does not indicate that users may choose another language or that the locale is intentionally restricted. Under the stated policy, forcing a specific language without user opt-in can be a language/locale policy violation.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
The README instructs users to run
npx skills tavily-search ...without pinning a specific package version.npxmay fetch the latest package at execution time, which creates a supply-chain risk if the package changes unexpectedly or is compromised. In a skill intended to drive automated content generation, this increases exposure because users are encouraged to execute the command directly from documentation.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill description is broad and lacks clear activation boundaries, negative examples, or conditions for when it should not run. In agentic environments, ambiguous scope can cause the skill to be invoked in unintended contexts, leading to unnecessary web queries, file creation, or content generation that the user did not specifically request.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description and instructions require generating Xiaohongshu copy in a Chinese social-media format, but the file does not explicitly state this as an opt-in locale/platform restriction or offer alternative language output. This can violate language/locale policy when the skill is invoked in contexts where the user has not chosen Chinese output.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill relies on external web search for real-data mode, but the description does not clearly warn users that queries, topics, and accessed URLs may be sent to third-party services. This creates a privacy and compliance risk, especially if user-supplied search terms contain sensitive business interests or internal research topics.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill states that it outputs files and opens the generated HTML/output directory automatically, but this side effect is not prominently disclosed as a user warning. Automatic opening of generated content increases risk because untrusted or malformed content may be rendered locally without an explicit confirmation step, and file-system side effects may surprise users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The title and content indicate the skill output is fixed in Chinese ('AI 资讯汇总'), with no indication that the user can choose another language or that the locale restriction is required. This is a natural-language policy concern because it imposes a specific language without opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The markdown file's title and all listed source items are written in Chinese, but there is no accompanying note that the skill is intentionally locale-specific or that users may choose another language. Under the policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The entire skill documentation, including headings, usage instructions, and cron payload text, is presented exclusively in Chinese. Per the policy rule, forcing a specific language without user opt-in or a documented justification can be a natural-language policy violation.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest describes a skill for collecting recent AI news and generating Xiaohongshu copy plus an HTML cover. In this guide, the main flow uses
child_process.execSyncto invoke a local script, introducing local code execution as an operational capability that is not inherent to the declared business purpose and expands what an integrating agent may do.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file presents all user-facing instructions and configuration labels exclusively in Chinese, including the title, section headings, and modification steps. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code forces zh-CN locale formatting and generates all user-facing content in Chinese, including timestamps, HTML lang metadata, and copy text. Under the language/locale policy, a fixed language is a violation unless the skill clearly offers opt-in or documents a justified region-specific constraint.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script invokes OS-level application launchers via execSync to open a browser and file explorer. Although the paths are derived from local script-controlled values, automatically spawning external applications expands the skill's side effects beyond content generation and can surprise users or be abused in higher-privilege/automated environments to trigger unwanted execution flows or GUI actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script automatically opens the generated HTML in the default browser immediately after writing it, without explicit user confirmation. Since the HTML embeds unescaped news fields such as titles and sources, a malicious or malformed input item could lead to active script/content execution in the browser or at minimum unwanted navigation/UI activity.
- Content