游戏王日版新闻每日总结

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:55 PM UTC
• Version: 1.0.0

Overview

The skill is coherent with its stated purpose, but it creates an indefinite daily automated agent task without documenting clear limits or removal steps.

Install only if you intentionally want an automated daily OpenClaw task posting to your current conversation. Before enabling it, confirm which account/profile the cron job runs under, how to list and remove the job, and whether you want an expiration date or manual approval for future runs.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: SKILL.md:25

Finding

Persistent Daily Agent Execution Through a Scheduled Task

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-29
Vulnerability Type: T06: System Persistence
Risk Level: High

The following excerpt is translated into English while preserving the command structure:

bash

openclaw cron add --name "Daily Yu-Gi-Oh Japanese News Summary" \
  --schedule "0 10 * * *" \
  --timezone "Asia/Shanghai" \
  --prompt "It is 2026. Summarize yesterday's Japanese Yu-Gi-Oh news, including new cards, rule updates, tournament information, and product releases. Produce a clear Chinese summary and use the correct 2026 date."

Technical Analysis

The openclaw cron add command registers a recurring Agent task that continues to execute after the installation session ends. The schedule causes it to run every day at 10:00 in the Asia/Shanghai time zone.

This constitutes system persistence because the scheduled task survives the original Skill invocation and repeatedly activates an Agent without requiring approval for each execution. The document does not specify an expiration date, execution limit, confirmation step, least-privilege execution context, or task-removal procedure.

The alternative Agent-based setup documented at lines 33-37 requests the same persistent behavior, although the concrete persistence mechanism is shown in lines 25-29.

Attack Path

1. A user or Agent follows the installation instructions in SKILL.md.
2. The openclaw cron add command registers the recurring task.
3. The task remains configured after the original interaction ends.
4. At 10:00 each day, OpenClaw invokes the stored prompt automatically.
5. The Agent performs repeated news retrieval and sends output without obtaining fresh per-run user authorization.
6. The execution continues indefinitely unless the task is manually identified and removed.

Impact Assessment

The scheduled task can repeatedly exercise the tools and permissions available to the OpenClaw Agent und ...[truncated 653 chars]

Remediation

View remediation

Remediation Suggestions

1. Default to a one-time execution rather than creating a recurring scheduled task.
2. Require explicit informed consent immediately before registration, displaying the exact schedule, prompt, execution identity, available tools, destination channel, and expected duration.
3. Add an expiration date or maximum execution count so that the task cannot run indefinitely.
4. Run the task under a dedicated least-privileged account or restricted Agent profile with only the network-search and message-delivery capabilities required for the summary.
5. Document commands for listing, disabling, and removing the scheduled task, including the exact openclaw cron remove procedure supported by the installed OpenClaw version.
6. Ask for confirmation before enabling outbound searches or sending results to a conversation channel.
7. Avoid hardcoding the year. Calculate the previous calendar date dynamically to prevent inaccurate prompts after 2026.
8. Record each execution in an auditable log and provide a clear mechanism for users to suspend future runs.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file describes invoking the skill by sending a generic request to the agent: '帮我创建一个每天早上10点的定时任务，总结昨天的游戏王日版新闻。' While domain-specific in topic, the document does not define exact trigger phrases, boundaries, or negative examples, making activation conditions ambiguous for when this skill should be selected versus other scheduling or news-summary skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file states the skill will '生成中文总结并推送到当前对话,' and later repeats '请用中文总结' and '输出语言 | 中文' as fixed behavior. This is a natural-language locale policy concern because the skill enforces a specific language without documenting user opt-in or offering a language choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.