ClawHub
Back to skill

Security audit

Daily Morning Greetings

Security checks across malware telemetry and agentic risk

Overview

This skill is mainly a morning-greeting tool, but it can create recurring deliveries and automatically use detected Weixin webhook credentials to post messages externally.

Install only if you want this skill to manage recurring OpenClaw morning-greeting schedules and possibly fan out the same generated greeting to a configured Weixin bot. Before enabling it, confirm the cron schedule, primary chat destination, failure-alert destination, whether --deliver-weixin auto is allowed, and which environment variable or OpenClaw config source may supply the webhook.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill instructs the agent to execute local Python scripts, use network access for weather and webhook delivery, read environment variables and local OpenClaw config, and maintain per-chat selection state, yet it declares no permissions. This creates a dangerous transparency and consent gap: operators and policy engines may treat the skill as low-privilege while it can access secrets, local files, and external endpoints.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented behavior goes beyond simple greeting generation: it probes environment variables and ~/.openclaw configuration for webhook credentials, can send content to external Weixin webhooks, and tracks state on disk. That mismatch is security-relevant because it hides credential discovery, persistence, and outbound exfiltration-capable behavior behind an innocuous 'morning greeting' skill, increasing the chance of unsafe deployment and unintended data flow.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The script harvests Weixin webhook credentials from multiple environment variables and scans local OpenClaw configuration to discover delivery targets automatically. For a greeting-generation skill, this broad credential discovery meaningfully expands access to sensitive local secrets and enables outbound delivery to endpoints the user may not have explicitly selected in the current invocation.

Vague Triggers

Medium
Confidence
69% confidence
Finding
“再来个备选版” is less broad than “换一条” but still insufficiently anchored to the morning-greeting domain in the manifest. Because this skill can run local scripts and use per-chat routing logic, an unintended invocation could still cause unnecessary execution or message generation in the wrong context.

Vague Triggers

Low
Confidence
69% confidence
Finding
“再来个备选版” is less broad than “换一条” but still insufficiently anchored to the morning-greeting domain in the manifest. Because this skill can run local scripts and use per-chat routing logic, an unintended invocation could still cause unnecessary execution or message generation in the wrong context.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
When delivery is enabled, the script performs an outbound HTTP POST to a discovered webhook, which can transmit generated content off-host without a strong user-visible confirmation at send time. In an agent skill context, silent external fanout is more dangerous because users may expect local content generation, not network delivery to an auto-detected bot endpoint.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
Reading webhook URLs and keys from environment variables and config files accesses credential-sensitive material that is unrelated to simple message formatting. In a skill environment, this increases the blast radius by letting the skill inspect secrets available to the hosting agent runtime and potentially use them for outbound actions.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def detect_weixin_from_env():
    for key in WEIXIN_ENV_WEBHOOKS:
        value = normalize_text(os.environ.get(key))
        if value:
            webhook = build_weixin_webhook_from_key(value)
            if webhook:
Confidence
97% confidence
Finding
os.environ.get(key

Env Variable Harvesting

High
Category
Data Exfiltration
Content
"webhook_url": webhook,
                }
    for key in WEIXIN_ENV_KEYS:
        value = normalize_text(os.environ.get(key))
        if value:
            webhook = build_weixin_webhook_from_key(value)
            if webhook:
Confidence
97% confidence
Finding
os.environ.get(key

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.