Security audit

intelligent-diagnosis-skill_test

Security checks for vulnerabilities and agentic risk

Overview

This skill is labeled as domain testing but actually reads a local username and uses it to query an internal merchant system, then returns the raw response.

Review this skill carefully before installing. It should be renamed and documented as an internal merchant lookup tool, disclose that it reads `~/.openclaw/username`, require explicit consent before sending that username to the corporate endpoint, and return only sanitized fields needed for the task.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:21
Finding: Undisclosed Local Identity Access and Transmission Outside the Declared Skill Scope
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The workflow directs the agent to read a local username file, use it in an internal API call, and then return the raw API response directly to the user. This creates a clear natural-language exfiltration path from local and internal sources to the end user, with no filtering, authorization check, or output minimization.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill performs an authenticated request to an internal corporate endpoint (merchant-lego.corp.kuaishou.com) that is not justified by the advertised domain-testing function. This creates an opportunity to misuse the agent as a bridge into internal systems and query internal merchant data under the current user's identity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill transmits a locally sourced username to an internal HTTP API without any user-facing disclosure or consent. Even if the value is only a username, silently exfiltrating local identity context to a remote service violates least surprise and can enable tracking, impersonation context, or unauthorized correlation of user activity.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to read a local credential-like file (~/.openclaw/username) even though the declared purpose is only domain testing. Accessing local configuration data unrelated to the user’s request expands privilege unnecessarily and can expose internal identity information for use in downstream requests or disclosure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The display name, description, trigger examples, and operating instructions are all written in Chinese, with no indication that users may choose another language or that the locale restriction is intentional and documented. Under the policy rule, forcing a specific language without opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The examples and workflow describe merchant diagnosis and seller ID lookup rather than domain testing, showing a mismatch between the declared capability and the actual behavior. This kind of deceptive or misleading scoping can hide sensitive actions from reviewers and users, increasing the risk of unauthorized internal-data access.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.