Security audit
Security checks for vulnerabilities and agentic risk
This skill mostly matches a role-based OpenClaw setup, but it needs review because it can overwrite OpenClaw configuration and some Feishu agent instructions unexpectedly route work or review reports to Discord.
Before installing, back up ~/.openclaw and merge changes manually instead of blindly copying. Review and disable any Discord routing unless you intend to share tasks, diffs, or review reports there. Store Feishu, Discord, and model credentials with restrictive permissions or a secret manager, and configure Feishu/Discord allowlists for the smallest audience needed.
声明描述的是一个仿明朝内阁制的多 Agent 协作系统，重点应是 Agent 间协作、角色分工或编排机制。而实际代码并未实现任何多 Agent 协作流程，只执行本地安装与配置健康检查。它访问了用户主目录中的 openclaw 配置文件并解析其中的 agent、人设、模型提供商 API Key 以及飞书/Discord 通道配置，这些行为属于运维/诊断脚本能力，和声明的主要用途存在实质性偏差。因此应判定为描述与行为不匹配。
The instructions tell users to recursively copy files into ~/.openclaw, which can overwrite existing local configuration without warning or backup. In a skill/install context, that can silently replace user settings, change enabled integrations, or break a working environment, creating integrity and availability risk even if no overtly malicious behavior is shown.
The README instructs users to place the Feishu App ID and App Secret into a local configuration file under ~/.openclaw, but it does not warn that these credentials will be stored in plaintext on disk. This increases the risk of credential exposure through local compromise, backups, shell history, accidental file sharing, or overly permissive filesystem permissions.
该技能明确要求“回答用中文”，在未获得用户选择或偏好确认的情况下强制输出语言，属于真实的策略层限制问题。其主要风险不是直接安全利用，而是降低可用性、可访问性与用户控制权；在多 Agent 协作场景下，还可能导致跨代理沟通或面向非中文用户时的信息误解。
The instruction '回答用中文' forces a specific language for all interactions. This is a natural-language policy concern because the file does not provide user opt-in, language choice, or a documented reason that the skill must be Chinese-only.
该技能明确要求将审查报告发送到 Discord 频道，并 @提交者和司礼监，但描述中未对用户披露这一外发行为。审查报告可能包含代码片段、文件路径、缺陷细节、人员标识等敏感信息，若用户未被提前告知或未授权，容易造成数据泄露与越权共享。
The skill rigidly requires Chinese output and a minimum chapter length of 10,000 Chinese characters without indicating that this is configurable or subject to user preference. This can override user intent, reduce accessibility for non-Chinese users, and cause disproportionate resource usage or poor UX when a shorter or different-language response is requested.
The file is entirely written as a fixed Chinese-role instruction and does not indicate that the user may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
The instruction '回答用中文' imposes a fixed language requirement in the skill's natural-language behavior. This is a language-policy constraint and the file does not indicate any user choice, opt-in, or region-specific justification for restricting output to Chinese.
该技能明确要求“回答用中文”，未体现基于用户偏好或上下文进行语言协商，属于对输出语言的硬性限制。虽然这通常不是直接的安全漏洞，但会削弱系统遵循用户请求和平台默认语言策略的能力，在多语言场景下可能导致误导、可用性下降，或掩盖其他指令冲突。
该技能在系统提示中强制要求“回答用中文”，会覆盖或限制用户的语言选择，属于对输出语言的硬性约束。虽然这更偏向产品/可用性与合规问题而非直接安全漏洞，但在多语言场景中可能导致误解、错误执行或无法满足用户明确的语言需求。
技能强制“回答用中文”，但没有提供用户选择或说明业务上必须使用中文的理由。在多语言环境中，这会增加误解、错误翻译和安全关键信息丢失的风险，尤其该角色负责需求澄清与计划制定，一旦语言不匹配，错误会被系统性放大并传递给多个下游代理。
The skill hard-codes a roleplay persona and speaking style ('内务府总管大臣', '自称奴才') without any user opt-in, which can override user expectations and constrain outputs in ways unrelated to the task. While not directly enabling code execution or data exfiltration, it can cause unwanted impersonation, cultural-role coercion, or misaligned responses across unrelated requests.
The file presents the skill entirely in Chinese and frames it as a fixed-role agent for a Chinese imperial context without any indication that users may select another language or locale. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.
The instruction "回答用中文" forces a specific language for all interactions. This is a natural-language policy concern because the file does not provide any user choice, opt-in, or documented justification for restricting responses to Chinese.
The natural-language instruction is entirely in Chinese and directs the agent to adopt a specific Chinese-speaking persona ('你是御膳房总管') with a fixed speaking style. This imposes a language/locale behavior without indicating user choice or opt-in, which matches the language/locale policy violation criteria.
The guide tells users to place the Feishu App Secret directly in a local config file or environment variable, but it provides no guidance on secret hygiene such as file permissions, use of a secret manager, rotation, or avoiding accidental disclosure in logs, screenshots, and shell history. In a multi-agent messaging integration, compromise of this secret could let an attacker impersonate the bot or access Feishu-integrated capabilities tied to the application.
All user-facing comments and status messages are in Chinese, including installation validation results and configuration guidance. This imposes a specific language on users without opt-in or documented locale justification, which matches the language/locale policy violation criteria.
The README instructs users to place sensitive API keys and bot tokens into configuration without any guidance on secure storage, least-privilege scoping, or avoiding accidental disclosure. In practice, this increases the chance that secrets are stored in plaintext, committed to repositories, or copied into insecure files, leading to credential compromise.
The instruction "回答用中文" forces a specific language for all interactions. This is a natural-language policy concern because the file does not indicate any user preference, opt-in, or justified locale restriction.
The instruction requires the agent to use a fixed archaic persona and self-reference style: "循循善诱学究气，自称老夫". This imposes a specific linguistic style on all interactions without indicating user opt-in or offering an alternative, which is a natural-language policy concern under language/locale-style constraints.
The instruction states that after writing, the agent is responsible for archiving the chapter, which is a data-affecting write operation, but it gives no indication that user awareness, confirmation, or disclosure is required. Even if archiving is operationally normal in this workflow, silent persistence can surprise users, create unintended records, or store sensitive draft content without explicit consent.
该技能被定义为上游的“前置优化”与“Plan 生成”角色，会主动改写用户需求并为下游部门分派执行步骤，但文档没有向用户明确披露这一点。这样会让用户误以为系统仅做转述，实际却在扩大、重构或引导任务范围，可能导致下游代理依据被改写的意图执行不符合用户原意的操作。
The description explicitly instructs the skill to use a Chinese imperial-medical persona and to refer to itself as '臣'. This imposes a specific language/style constraint without offering the user a choice or indicating that the locale is required for a region-specific purpose.
SQP-3 applies to all file types and covers language or locale policy violations. The file forces a single language for all instructions without opt-in or justification, which may conflict with an organizational policy requiring language choice or documented locale constraints.
No suspicious patterns detected.
