T09 · Insecure Skill Coding Practices
Error
- Location
examples/quick-start.md:136- Finding
OpenClaw Configuration Is Made Readable by Other Local Users
- Content
View full analysis
- Remediation
View remediation
Security audit
HR Agent Creation
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly matches its stated purpose, but it creates a powerful Feishu-connected agent and changes local OpenClaw configuration with weak safeguards.
Install only in a controlled OpenClaw environment after reviewing the Feishu group ID and service-account permissions. Before production use, enforce least-privilege tool policy outside the generated markdown, keep ~/.openclaw/openclaw.json at 600 or stricter, fix the temporary-file and jq interpolation issues, and document how to unbind the group and remove the created workspace/config entries.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/create-hr-agent.sh:329- Finding
Predictable Temporary Configuration File Permits Symlink and Race Attacks
- Content
View full analysis
/dev/null 2>&1; then print_warning "Agent '$AGENT_NAME' already exists and will be updated" jq --arg name "$AGENT_NAME" \ --arg display "$DISPLAY_NAME" \ --arg workspace "$WORKSPACE_DIR" \ '.agents.list |= map(if .id == $name then . + { "name": $display, "workspace": $workspace, "model": "baiduqianfancodingplan/qianfan-code-latest", "memorySearch": { "enabled": true } } else . end)' "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file" else jq --arg name "$AGENT_NAME" \ --arg display "$DISPLAY_NAME" \ --arg workspace "$WORKSPACE_DIR" \ '.agents.list += [{ "id": $name, "name": $display, "workspace": $workspace, "model": "baiduqianfancodingplan/qianfan-code-latest", "memorySearch": { "enabled": true } }]' "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file" fi # Add the Feishu binding if ! jq -e ".bindings[] | select(.agentId == \"$AGENT_NAME\")" "$config_file" > /dev/null 2>&1; then jq --arg agent "$AGENT_NAME" \ --arg chat "$FEISHU_CHAT_ID" \ '.bindings += [{ "agentId": $agent, "match": { "channel": "feishu", "peer": { "kind": "group", "id": $chat } } }]' "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file" fi ``` ### Technical Analysis All three configuration updates use the fixed path `~/.openclaw/openclaw.json.tmp`. Shell output redirection opens this path before `jq` runs, ...[truncated 1647 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/create-hr-agent.sh:333- Finding
Untrusted Agent Name Is Interpolated into jq Program Source
- Content
View full analysis
/dev/null 2>&1; then print_warning "Agent '$AGENT_NAME' already exists and will be updated" jq --arg name "$AGENT_NAME" \ --arg display "$DISPLAY_NAME" \ --arg workspace "$WORKSPACE_DIR" \ '.agents.list |= map(if .id == $name then . + { "name": $display, "workspace": $workspace, "model": "baiduqianfancodingplan/qianfan-code-latest", "memorySearch": { "enabled": true } } else . end)' "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file" else jq --arg name "$AGENT_NAME" \ --arg display "$DISPLAY_NAME" \ --arg workspace "$WORKSPACE_DIR" \ '.agents.list += [{ "id": $name, "name": $display, "workspace": $workspace, "model": "baiduqianfancodingplan/qianfan-code-latest", "memorySearch": { "enabled": true } }]' "$config_file" > "${config_file}.tmp" && mv "${config_file}.tmp" "$config_file" fi # Add the Feishu binding if ! jq -e ".bindings[] | select(.agentId == \"$AGENT_NAME\")" "$config_file" > /dev/null 2>&1; then ``` The same pattern is repeated in `scripts/create-hr-agent.sh:393-399` and `scripts/test-hr-agent.sh:255-272`. ### Technical Analysis `AGENT_NAME` is controlled through the `--name` command-line option and is inserted directly into double-quoted jq program text. It is not constrained to a safe agent-identifier syntax. Although this does not cause shell command substitution because shell parsing has already occurred, quotation and jq operators embedded in the value can change the jq expression's meaning. An attacker can cause an existence check to select unr ...[truncated 1351 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/create-hr-agent.sh:205- Finding
Generated Agent Declares Broad Execution and Administration Capabilities Without Enforced Safeguards
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
描述强调的是一个可根据需求招聘/创建 Agent 并绑定飞书群聊的 HR Agent，本应以实际创建和配置流程为核心。代码却是 scripts/test-hr-agent.sh，一个显式的测试脚本：检查依赖（openclaw、jq）、验证工作空间结构和配置文件内容、解析 ~/.openclaw/openclaw.json 查找 agent 与 bindings、查询 gateway/agent 状态，并输出模拟对话和在 /tmp 下创建模拟文件。虽然这些测试内容围绕“HR Agent”主题，且包含对飞书绑定存在性的检查，但它们是验证/模拟已存在配置，而不是实现声明中的核心创建与绑定能力。因此代码的实际主要用途与声明的主要用途存在实质性不一致。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 4. `SKILL.md` - 专业技能定义
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs creation of local workspace directories and multiple files, and it modifies ~/.openclaw/openclaw.json, but it does not prominently warn users that it will persist files and alter local configuration. This can lead to unintended configuration changes, overwriting state, or unsafe execution in sensitive environments where local agent configs control broader automation behavior.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 72% confidence
- Finding
This duplicate finding points to the same persistent workspace creation behavior. Because the skill is designed to create long-lived agent state, the danger comes from undocumented retention and possible accumulation of sensitive operational or user information in local files that may later be read, reused, or exposed.
- Content
步骤1：创建工作空间目录
bash mkdir -p ~/.agents/workspaces/hr/步骤2：创建9个身份文件
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 72% confidence
- Finding
This duplicate finding points to the same persistent workspace creation behavior. Because the skill is designed to create long-lived agent state, the danger comes from undocumented retention and possible accumulation of sensitive operational or user information in local files that may later be read, reused, or exposed.
- Content
步骤1:创建工作空间目录
bash mkdir -p ~/.agents/workspaces/hr/步骤2:创建9个身份文件
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Binding an agent to a Feishu group chat can expose the agent to group messages, metadata, and potentially sensitive organizational content, yet the skill lacks a clear privacy and integrity warning about that trust boundary. Without explicit consent and scope warnings, users may connect an agent to the wrong group or underestimate the data exposure and impersonation risks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file consistently presents operational instructions only in Chinese, including the title, setup steps, and usage guidance. Per SQP-3, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This markdown file instructs users to restart the OpenClaw gateway and start agents, and later to overwrite configuration during restore, but it does not clearly warn that these actions may disrupt running services or replace existing local state. Under the markdown-specific SQP-2 criteria, behavior that can affect system integrity or user data should be disclosed to the user.
- Content
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
Q4：配置文件权限问题
bash # 检查权限 ls -la ~/.openclaw/openclaw.json # 修复权限 chmod 644 ~/.openclaw/openclaw.json
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
Q4：配置文件权限问题
bash # 检查权限 ls -la ~/.openclaw/openclaw.json # 修复权限 chmod 644 ~/.openclaw/openclaw.json
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
ls -la ~/.openclaw/openclaw.json
修复权限
chmod 644 ~/.openclaw/openclaw.json
text ## 📊 性能监控
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This shell script presents its help, prompts, status messages, and generated markdown content entirely in Chinese, effectively imposing a specific language/locale on users. The file does not offer any opt-in, locale selection, or justification that this is a region-specific tool, so it conflicts with the policy against forcing a language without user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This shell script presents its title, help text, and simulated agent interactions entirely in Chinese, including all user-facing guidance. Under the policy rules, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.
- Content