long-doc-agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:21 AM UTC
• Version: 1.0.0

Overview

This report-writing skill is mostly purpose-aligned, but it automatically sends project details externally and runs unpinned local dependency checks in ways users should review before installing.

Install only if you are comfortable with a Windows-specific workflow that stores report inputs under F:/agent/chapters, may spawn multiple writing agents automatically, and sends status details to the configured openclaw-weixin channel. Avoid using confidential reference materials unless notifications are disabled or approved and the reference file retention is acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

• Location: integrate_report.py:75

Finding

Unpinned package resolution and execution during module import

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: references/phase1_guide.md:10

Finding

Indirect prompt injection through untrusted reference material

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: SKILL.md:118

Finding

Automatic external notifications disclose report metadata without per-send consent

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: integrate_report.py:321

Finding

Reference material is stored in a predictable plaintext file without retention controls

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (41)

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · parallel_tracker.py (reported line 260)May include surrounding context.

python

error_seqs = {e['seq'] for e in entries if e.get('phase') == 'error'}

                # 打印进度
                os.system('cls' if os.name == 'nt' else 'clear')
                print(render_progress_table(self.tracker_file), flush=True)

                # 新完成任务时提示

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · parallel_tracker.py (reported line 344)May include surrounding context.

python

error_seqs = {e['seq'] for e in entries if e.get('phase') == 'error'}

                # 打印进度
                os.system('cls' if os.name == 'nt' else 'clear')
                print(render_progress_table(self.tracker_file), flush=True)

                # 新完成任务时提示

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill documents shell execution and read/write access to local files but does not declare any explicit tool scope or permissions boundary. That makes the effective privilege set opaque and increases the chance the skill will run with broader capabilities than users expect, especially because it operates on real filesystem paths and invokes Python commands.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrase "write feasibility report" is broad enough to match common user requests, increasing the chance of accidental invocation. Because this skill performs file operations, shell execution, and external notifications, unintended activation carries meaningful security and privacy risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger phrase "write proposal" is highly ambiguous and may overlap with many ordinary drafting tasks that do not require this skill's privileged workflow. That mismatch can cause accidental use of shell/file features or external messaging in contexts where the user expected simple text assistance.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger phrase "multi-chapter" is too generic to safely select a skill with autonomous execution and external side effects. Overlapping activation can route benign writing requests into a workflow that reads/writes files and sends updates externally.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The Feishu knowledge-base search adds access to an external data source beyond basic document generation, which can expand data exposure and retrieval scope. In this context it may be functionally relevant for gathering reference material, but the manifest does not clearly constrain what may be queried or how retrieved content is handled.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow instructs the system to send WeChat notifications through an external channel after planner completion, which is outside core report generation and results in outbound data transmission. Report topic, chapter counts, and industry details may be disclosed to third-party messaging infrastructure without explicit user approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill describes automatic external notifications but does not clearly warn users that project information will be transmitted to a WeChat channel. Lack of informed consent is especially risky here because the notification is operationalized as part of the normal workflow rather than an optional add-on.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 82% confidence

Finding

The skill is designed to automatically execute batches of sub-agents without manual confirmation, which increases the chance of unintended actions once triggered. In context this autonomy serves workflow efficiency rather than overtly malicious behavior, but it amplifies the impact of broad triggers, external messaging, and filesystem operations.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

**Execution flow** (fully automatic, no manual confirmation):
1. Display outline / current batch status (display only, no waiting)
2. `python parallel_tracker.py clear` to clear previous batch state
3. Start up to 5 concurrent sub-agents (`sessions_spawn`), automatically execute all batches
4. `python parallel_tracker.py wait` to monitor in background until this batch is complete
5. After completion, automatically run `python integrate_report.py convert-batch`

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 81% confidence

Finding

Automatically running follow-on commands after batch completion reduces human oversight and can chain privileged actions together. In this skill, that means shell-driven conversion proceeds as a default consequence of earlier steps, which is riskier when combined with broad invocation and undeclared permissions.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

md

2. `python parallel_tracker.py clear` to clear previous batch state
3. Start up to 5 concurrent sub-agents (`sessions_spawn`), automatically execute all batches
4. `python parallel_tracker.py wait` to monitor in background until this batch is complete
5. After completion, automatically run `python integrate_report.py convert-batch`

**Sub-Agent prompt template**: see `references/phase2_guide.md`

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Automated per-batch WeChat notifications create repeated outbound disclosures during report production, increasing leakage risk and metadata exposure. Because the system runs parallel sub-agents and proceeds automatically, users may not realize status updates containing chapter titles and progress are being transmitted externally multiple times.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Repeated automatic status messages create ongoing external disclosure, yet the documentation provides no user warning about frequency, recipients, or data contents. This is dangerous because users may unknowingly leak chapter titles, workflow cadence, and project progress over time.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The final integration step sends a completion message externally, including report topic, scale, style, and output location details. This can expose sensitive business context and local path information to a messaging channel not justified in the manifest's core purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The final completion message is sent externally without an explicit warning, and it includes business-relevant details plus local output location metadata. This combines privacy risk with potential operational exposure, especially in enterprise environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Natural-language strings throughout the file, including the module description, CLI output, document headings, and default report labels, are fixed in Chinese with no option for the user to select another language or locale. This is a language/locale policy concern because the skill imposes one locale by default rather than offering choice or documenting a region-specific restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code file writes multiple persistent artifacts such as hash records, generated reports, snapshots, config, and glossary files, and also deletes temporary files later in execution, but there is no top-level docstring, comment, or user-facing disclosure warning that running the script will modify files under F:/agent and related paths. Because the tool's purpose is report generation, some writes are expected, but the breadth of filesystem modification is not clearly disclosed to the user in the code interface.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script probes for Mermaid dependencies by executing external commands via subprocess, and later uses subprocess again to render diagrams, but there is no visible warning in the CLI or module description that local executables will be run. This matters because subprocess invocation can affect system integrity and surprises users if they expect a pure document-processing script.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · integrate_report.py (reported line 88)May include surrounding context.

python

]
    for name, cmd in candidates:
        try:
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=10)
            if result.returncode == 0:
                if name == 'local' or name == 'local_node':
                    return 'E:\\lonb\\LobsterAI\\node_modules\\@mermaid-js\\mermaid-cli\\src\\cli.js'  # mmdc 完整路径（render时会用node调用）

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The code explicitly supports invoking Mermaid via npx without pinning a version, which can fetch or run whatever package version the environment resolves at execution time. In a document-processing pipeline handling untrusted content, this introduces supply-chain risk and unpredictability, especially because the external renderer is executed automatically.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · integrate_report.py (reported line 126)May include surrounding context.

python

# 注入 Playwright Chromium 配置
        if os.path.exists(MERMAID_PUPPETEER_CONFIG):
            cmd += ['-p', MERMAID_PUPPETEER_CONFIG]
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        return os.path.exists(out_path)
    except Exception:
        return False

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The surrounding section header and CLI messages present this function as a 'consistency review' that finds cross-chapter inconsistencies, but extract_quantities keys values by the full number+unit string and check_cross_chapter_consistency only intersects identical keys. Because shared keys are already identical, the later numeric inequality check can never meaningfully detect mismatched values across chapters, contradicting the stated intent of the review feature.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The 'ref clear' path overwrites the reference material file with an empty string, which is a destructive operation affecting user data. There is no confirmation prompt, no warning before execution, and no inline comment indicating that this subcommand permanently clears stored content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring and usage-facing descriptions are entirely in Chinese, and later CLI output/messages are also emitted only in Chinese. This imposes a specific language/locale on users without offering opt-in, selection, or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The monitoring and CLI interface prints operational messages such as startup, completion, timeout, and stop notices only in Chinese. Because these are direct user-facing strings, they create a language policy issue unless the skill explicitly offers language choice or states a justified locale restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.