Security audit

Ai Court Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent multi-agent OpenClaw skill, but it needs review because it can overwrite live configuration and send potentially sensitive code-review results to Discord without clear controls.

Before installing, back up ~/.openclaw and review the copied files. Use restricted Feishu/Discord bots and private channels, avoid sending full diffs or vulnerability details to broad Discord audiences, and store App Secrets/API keys outside shared repositories with tight file permissions or a secrets manager.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: 该技能文档明确声明会将审查报告发送到 Discord 频道，说明代理存在向外部平台传播审查内容的能力或预期行为，但技能元数据未充分披露这一跨平台数据流。代码审查报告通常包含 diff、文件路径、漏洞说明、提交者身份等敏感信息，若用户未被明确告知或未授权，容易造成敏感开发信息外泄。

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: 文档赋予审计代理主动向 Discord 分发报告并 @人员的能力，这超出了单纯本地审查/评估的职责边界，形成额外的数据出站与通知面。若该能力被误配、滥用或与高敏感仓库联动，可能导致内部代码质量结论、漏洞细节或人员身份被扩散到不适当的外部受众。

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The instructions repeatedly tell users to copy files into `~/.openclaw` using `cp -r .../* .`, which modifies the user's live configuration directory without any warning about overwriting existing files. This can silently replace prior settings, break an existing deployment, or swap communication/provider configuration in ways that cause service disruption or accidental credential misuse.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README instructs users to copy configuration files and fill in App ID and App Secret in a local JSON config without any guidance on secure secret handling. This can lead to credentials being stored in plaintext, accidentally committed to source control, exposed through backups, or read by other local users/processes, especially in a multi-agent system that may access local files.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: 技能说明要求将审查报告发送到 Discord 并 @提交者，但没有向用户提示这会把潜在敏感的代码审查数据共享到外部平台。审查报告可能包含漏洞位置、实现细节、仓库结构和开发者标识，这类未经充分告知的外发会带来隐私、保密和合规风险。

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: 该技能明确规定“回答用中文”，剥夺了用户对输出语言的选择权，属于真实的策略约束问题。其主要风险不是直接安全破坏，而是降低可用性与合规性：当用户需要其他语言、无障碍支持或跨语言审阅时，代理会被固定在中文输出，可能导致误解、审计困难或无法满足用户要求。

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: The skill hard-codes a specific historical persona and speaking style ('自称奴才') without user opt-in, which can override user preferences and cause inappropriate or uncomfortable outputs. While not directly enabling code execution or data exfiltration, it creates a prompt-level control issue that may lead to role-locking, reduced user agency, and potentially problematic language in normal interactions.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The guide instructs users to place the Feishu App Secret directly into a local config file and also shows exporting it as an environment variable, but it does not include explicit guidance on secure storage, file permissions, secret rotation, or avoiding accidental disclosure in logs, shell history, screenshots, or version control. Because this is an agent/messaging integration skill, compromise of the App Secret could let an attacker impersonate the bot or access messaging functionality tied to the Feishu application.

Static analysis

No suspicious patterns detected.