soft-ip-full-lifecycle-zijian

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:16 AM UTC
• Version: 3.1.44

Overview

The skill is a payment-gated AI review workflow, but it persistently stores user questions and payment state with inaccurate disclosure and weak payment validation.

Review before installing. Use this only if you are comfortable with a local order file under your home directory containing your question and payment metadata. Avoid putting source code, applicant identity details, trade secrets, or complete legal materials in the question, verify the clawtip tooling provenance, and treat the payment-verification code as weak until it validates real signed credentials and cleans up stored data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/service.py:63

Finding

Payment Authorization Can Be Forged Through a Locally Writable Order File

Content

View full analysis

bool: credential = order_data.get("payCredential") if not credential: return False credential_ts = order_data.get("credentialTimestamp") if credential_ts and time.time() - credential_ts > CREDENTIAL_TTL: return False return True ``` ```python pay_status = order_data.get("payStatus", "SUCCESS") ``` ### Technical Analysis The service treats any nonempty `payCredential` value as proof of payment. It does not verify a digital signature, message authentication code, expected credential format, issuer, order number, amount, recipient, or indicator. The expiration check is also optional. If `credentialTimestamp` is absent, the credential is considered current regardless of its age. In addition, an absent `payStatus` field defaults to `SUCCESS`. Because order files are stored under the current user's home directory and are writable by that user, a caller can directly modify the JSON record and satisfy every authorization condition without completing payment. ### Attack Path 1. Run `scripts/create_order.py` to create a legitimate local order file. 2. Locate the resulting file under `~/.openclaw/skills/orders/{indicator}/{order_no}.json`. 3. Add an arbitrary nonempty value such as: ```json { "payCredential": "forged" } ``` 4. Omit `credentialTimestamp`, preventing the expiration condition from being evaluated. 5. Omit `payStatus`, causing the service to use its default value of `SUCCESS`. 6. Run `python3 scripts/service.py `. 7. The script returns `AUTHORIZATION_RESULT=verified` without cryptographically verifying payment. ### Impact Assessment An unprivileged local user who can create or edit their own order file can completely bypass the paym ...[truncated 246 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create_order.py:152

Finding

Encryption Failure Silently Stores Payment Metadata as Plaintext

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:102

Finding

Documentation Instructs Automatic Download and Execution of an npm Package

Content

View full analysis

-i -v 1.0.12 ``` ### Technical Analysis The documented sandbox workflow uses `npx --yes`, which can automatically download and execute a package from the configured npm registry. The package version is pinned, which limits ordinary version drift, but the instruction does not pin or verify an integrity digest. Execution may include package code and applicable lifecycle behavior with the invoking user's privileges. Consequently, compromise of the package release, maintainer account, registry, or package distribution path could turn the documented payment command into a supply-chain execution channel. This finding does not establish that the named package is malicious; the risk arises from automatically retrieving and executing third-party code without an independently verified integrity control. ### Attack Path 1. An attacker compromises the referenced package release, its maintainer account, the configured registry, or the dependency distribution path. 2. A user follows the documented sandbox-payment instruction. 3. `npx --yes` retrieves the package without requiring interactive confirmation. 4. npm executes the retrieved package with the user's operating-system privileges. 5. Compromised package code can access files, environment variables, and network resources available to that user. ### Impact Assessment A compromised dependency could execute arbitrary code with the privileges of the user running the command. Potential scope includes reading or modifying user-accessible files, accessing environment variables such as payment configuration, making network requests, and altering local application data. No evidence in the audited project proves that the currently referenced package performs t ...[truncated 17 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill advertises a substantive compliance-review service, but the documented executable workflow only creates/stores local payment order data and then tells the AI to perform the actual assessment in conversation. This mismatch can mislead users about what code is actually doing, what data is persisted locally, and what guarantees exist around handling sensitive materials; users may provide proprietary source code or legal documents under incorrect assumptions about processing boundaries.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script documentation claims the order file stores only limited fields, but the actual code persists additional metadata including description and resource URL. Misleading data-handling claims are security-relevant because users may disclose sensitive consultation content under false assumptions about what is retained locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script writes the full user-supplied question to a persistent file in the user's home directory. In this skill context, the question may contain copyright application details, legal/compliance facts, or source-code-related descriptions, so silent local persistence creates a meaningful confidentiality risk on shared or backed-up systems.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The script intentionally creates persistent local state by saving order files under the user's home directory. Session/order persistence is not automatically unsafe, but here it retains user consultation content in a compliance-review context where prompts may include sensitive legal or software information, increasing exposure if the endpoint is compromised or shared.

Content

Scanner excerpt · scripts/create_order.py (reported line 181)May include surrounding context.

python

if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="Create order for soft-ip-zijian compliance review service"
    )
    parser.add_argument("question", help="User question / consultation content")
    args = parser.parse_args()

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The console output states the saved file contains only orderNo, amount, and question, but the file actually includes payTo, encrypted_data, slug, description, and resource_url as well. This deceptive or inaccurate notice undermines informed consent and can cause users to provide sensitive information believing storage is more limited than it is.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 62% confidence

Finding

The skill name and service description embed 'zijian' and describe a yuan-denominated service, which suggests a specific locale context, but the file does not explicitly offer any user language or locale choice. Because this is only an implicit signal rather than an explicit hard requirement, confidence is limited.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.