Security audit

huo15-doc-template / 火一五文档模板

Security checks for vulnerabilities and agentic risk

Overview

This is a company Word-template skill, but it can automatically use local Odoo credentials and unsafe TLS settings during ordinary document generation.

Install only where Huo15-branded Chinese Word documents are the intended default and Odoo credential use is acceptable. Do not use the embedded Odoo retrieval code as written until TLS verification is restored, endpoint scope is constrained, and users explicitly approve credential-backed company-system access.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:6
Finding: Forced Skill Selection and Unauthorized Branding of Generated Documents
Content: View full analysis
**新用户必读！每次生成文档前对照检查，否则文档不合格！** - [ ] **LOGO 是否添加？** —— 页眉必须有 LOGO + 公司名称 + 底线 - [ ] **页码是否添加？** —— 页脚必须有"第 X 页共 Y 页" - [ ] **字体是否正确？** —— 正文仿宋，标题黑体/楷体 - [ ] **页面边距是否正确？** —— 上下 3.7/3.5cm，左右 2.8/2.6cm - [ ] **命名是否规范？** —— 文档类型_客户名称_日期.docx **如果没有完成以上检查，文档不允许交付！** ``` The source instructions state that all Word document tasks must use this skill. They also prohibit document delivery unless a logo and company name are added. ### Technical Analysis The skill declares itself mandatory for every Word-generation request, regardless of whether the user selected it or requested its formatting conventions. It then makes delivery conditional on inserting company branding. These instructions alter the agent's task-selection behavior and output requirements when the skill is loaded. Branding is not presented as an optional feature controlled by the user. This can cause unrelated contracts, reports, quotations, or official documents to contain the skill publisher's identity or assets. The issue is instruction-level behavior rather than a normal document-template default because the skill: 1. Claims exclusive control over all Word-generation tasks. 2. Treats its branding requirements as mandatory. 3. Directs the agent to withhold delivery if those requirements are not met. 4. Applies these requirements without confirming that the company identity belongs to the user. ### Attack Path 1. The skill is installed or loaded into an agent. 2. A user asks the agent to create any Word document. 3. The broad trigger and mandatory-use instruction cause this skill to take control of the request. 4. The skill requires a publisher-selected logo and company name in the document header. 5. The agent inse ...[truncated 772 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:187
Finding: Odoo Credentials Transmitted with TLS Certificate Verification Disabled
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:187
Finding: Implicit Access to Agent Credentials and Global Configuration for Basic Document Formatting
Content: View full analysis
/odoo_creds.json` - `~/.openclaw/openclaw.json` This access occurs as part of automatic company-information retrieval used by document header generation. Creating and formatting a DOCX document does not inherently require access to an Agent credential store or global platform configuration. The implementation therefore violates least privilege by coupling a basic local formatting operation to sensitive credential and configuration access. The user is not required to explicitly request Odoo integration before these files are opened. The selected credential path is partially influenced by the `OC_AGENT_ID` environment variable. Although the observed code does not provide arbitrary direct path input from the document request, environment control can alter which Agent directory the function attempts to access. The principal confir ...[truncated 1705 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Mandating automatic activation for all Word/document tasks removes user choice and increases the blast radius of the skill's hidden behaviors. In this skill's context, that is especially dangerous because a seemingly harmless formatting request can trigger internal-system access and remote downloads without clear notice.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Mandating automatic activation for all Word/document tasks removes user choice and increases the blast radius of the skill's hidden behaviors. In this skill's context, that is especially dangerous because a seemingly harmless formatting request can trigger internal-system access and remote downloads without clear notice.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill reads local credential and configuration files from the agent environment to authenticate to company systems, even though that behavior is not necessary for generic document formatting. This can turn a simple content-generation action into implicit credential use against internal services, increasing the risk of unauthorized access, secret exposure, and lateral movement if the skill is triggered broadly.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code explicitly disables TLS hostname verification and certificate validation before connecting to Odoo. This allows man-in-the-middle interception or spoofing of the server, enabling theft of credentials, manipulation of returned company data, and delivery of malicious content while appearing trusted.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The instructions require specific Chinese document formatting conventions and later hard-code Chinese fonts and Chinese page-number text, while also saying all Word document generation tasks must use this skill. This imposes a specific language/locale behavior without user opt-in or a clearly documented region-specific limitation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: A document-template skill unexpectedly performs network access to internal Odoo endpoints and external logo URLs, creating hidden data flows and side effects unrelated to basic document generation. This expands the trust boundary: using the skill may disclose environment-derived information, contact internal systems, or fetch untrusted remote content without explicit user awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill does not clearly disclose that it will fetch company information and logos from internal systems and external URLs. This undermines informed consent and can surprise users or operators with outbound requests and internal service access during what appears to be a local document-generation task.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger section uses vague automatic keywords without disambiguation, making accidental activation likely. While broad triggers alone are often quality issues, here they become security-relevant because the skill contains hidden filesystem, credential, and network behaviors beyond normal template generation.
Content: No source excerpt is available for this finding.