水滴筹众筹助手

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:30 AM UTC
• Version: 2.1.1

Overview

This skill is a disclosed Shuidichou donation and fundraising helper, with the main privacy risk being user-approved phone-number submission to Shuidichou.

Install only if you want a Shuidichou-focused Chinese donation and medical crowdfunding assistant. Do not provide a phone number unless you want it submitted to Shuidichou for a fundraising callback; donation links should be reviewed in the browser before paying.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill description promises two user-facing functions and constrained data handling, but the analyzed behavior reportedly does not fully match that description and sends additional fields to an external API. Description-to-behavior mismatch is dangerous because it can mislead users and reviewers about what data is collected, what functions are actually implemented, and what is transmitted off-platform, especially when personal data like phone numbers is involved.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes shell scripts but does not declare any explicit tool scope or allowed-tools policy. That increases the risk of overbroad execution privileges, weak reviewability, and accidental expansion of what the skill can do at runtime, even if the current documented behavior appears limited.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The donation trigger phrases are broad enough to match ordinary conversation about kindness, charity, or helping others. This can cause the skill to activate unexpectedly and steer users toward external donation links without sufficiently clear intent, which is especially sensitive in a financial and charitable context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The fundraising triggers include general statements about illness and financial hardship, which may activate the skill during emotionally sensitive discussions where the user has not clearly asked to submit contact information. In this context, overbroad triggering can pressure vulnerable users into a lead-capture flow involving personal data disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/donate.sh (reported line 5)May include surrounding context.

sh

# 获取水滴筹捐款项目列表
# 用法: bash donate.sh

API="https://api.shuidichou.com/api/charity/love-home/find-banner-v2"

response=$(curl -s -X POST "$API" \
  -H "Content-Type: application/json" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/register.sh (reported line 6)May include surrounding context.

sh

# 获取水滴筹捐款项目列表
# 用法: bash donate.sh

API="https://api.shuidichou.com/api/charity/love-home/find-banner-v2"

response=$(curl -s -X POST "$API" \
  -H "Content-Type: application/json" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/donate.sh (reported line 7)May include surrounding context.

sh

API="https://api.shuidichou.com/api/charity/love-home/find-banner-v2"

response=$(curl -s -X POST "$API" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \
  -d '{}' 2>/dev/null)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This is a real external transmission of sensitive user data: the script posts a phone number to a third-party service. In the skill context, collecting and forwarding a phone number is part of the advertised fundraising callback flow, which makes the behavior expected, but it is still security-relevant because it handles personal data and lacks in-script consent, minimization, and transparency controls.

Content

Scanner excerpt · scripts/register.sh (reported line 20)May include surrounding context.

sh

fi

# 接口使用 form 表单格式
response=$(curl -s -X POST "$API" \
  -d "mobile=$MOBILE&relation=其他&channel=openclaw-skills" 2>/dev/null)

if [ $? -ne 0 ] || [ -z "$response" ]; then

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends a user's phone number to a remote API endpoint, but the script itself provides no runtime notice, consent prompt, or disclosure at the moment of transmission. Because phone numbers are sensitive personal data, silently transmitting them can violate user expectations and privacy requirements, especially if the script is invoked outside a UI that clearly captured informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Comments and error messages are written only in Chinese, including the usage and validation output shown to users. This can constitute a language-policy issue because the skill forces a specific language for interaction without documenting that constraint or providing an opt-in or alternative locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.