请先说你好.skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:48 AM UTC
• Version: 0.0.2

Overview

This companion skill is coherent overall, but needs Review because it can overwrite a workspace heartbeat automation file and persist future check-in instructions without strong scoping or confirmation.

Install only after reviewing whether you want this skill to manage proactive check-ins. If you use OpenClaw Heartbeat or Cron, back up any existing HEARTBEAT.md, verify the workspace path and environment variables, and prefer pinned installer versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sync_heartbeat_md.py:54

Finding

Unconditional Overwrite of Persistent Workspace Heartbeat Instructions

Content

View full analysis

Tuple[Path, str]: if explicit_workspace: return explicit_workspace.expanduser(), "explicit-workspace" if explicit_workspace_name: return openclaw_home / explicit_workspace_name, "explicit-workspace-name" env_workspace = os.environ.get("OPENCLAW_WORKSPACE") if env_workspace: return Path(env_workspace).expanduser(), "env-workspace" env_workspace_name = os.environ.get("OPENCLAW_WORKSPACE_NAME") if env_workspace_name: return openclaw_home / env_workspace_name, "env-workspace-name" config = read_json(openclaw_home / "openclaw.json") requested_agent_id = agent_id or os.environ.get("OPENCLAW_AGENT_ID") if requested_agent_id: agents = config.get("agents", {}).get("list", []) for item in agents: if not isinstance(item, dict): continue if item.get("id") == requested_agent_id and item.get("workspace"): return Path(item["workspace"]).expanduser(), f"config-agent:{requested_agent_id}" default_workspace = config.get("agents", {}).get("defaults", {}).get("workspace") if default_workspace: return Path(default_workspace).expanduser(), "config-default" return openclaw_home / "workspace", "fallback-default" ``` The generated file contains pe ...[truncated 5853 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:52

Finding

Unpinned npm and npx Installation Executes Mutable Third-Party Code

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill’s documented functionality includes proactive scheduling state handling and delivery tracking, but its stated purpose centers on chat and persona management. Combining benign-seeming conversational activation with persistent outreach state creates a risk of covert or under-consented notification behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The skill’s documented functionality includes proactive scheduling state handling and delivery tracking, but its stated purpose centers on chat and persona management. Combining benign-seeming conversational activation with persistent outreach state creates a risk of covert or under-consented notification behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The skill’s documented functionality includes proactive scheduling state handling and delivery tracking, but its stated purpose centers on chat and persona management. Combining benign-seeming conversational activation with persistent outreach state creates a risk of covert or under-consented notification behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill’s documented functionality includes proactive scheduling state handling and delivery tracking, but its stated purpose centers on chat and persona management. Combining benign-seeming conversational activation with persistent outreach state creates a risk of covert or under-consented notification behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The skill’s documented functionality includes proactive scheduling state handling and delivery tracking, but its stated purpose centers on chat and persona management. Combining benign-seeming conversational activation with persistent outreach state creates a risk of covert or under-consented notification behavior.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md

- Use `scripts/generate_rolecard.py` to scaffold new rolecards.
- Use `scripts/validate_rolecard.py` before saving rolecards.

## Output Rules

1. Keep replies concise by default (1-3 short sentences unless users ask for detail).
2. Match user language preference (Chinese first if user writes Chinese).

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/generate_rolecard.py (reported line 61)May include surrounding context.

python

summary = m.group(1).strip().strip("。.!！?")
            if summary:
                return summary
    return prompt.strip()


def build_rolecard(name: str, prompt: str) -> Dict:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README advertises activation via broad natural conversation ('directly say something') without clearly defining boundaries for when the skill should engage. In an agent ecosystem, vague trigger scope can cause unintended invocation during ordinary conversation, leading to unsolicited persona behavior, state changes, or proactive workflow activation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The quick-start example treats ordinary speech ('你好呀，今天怎么样？') as a trigger without stating any gating conditions. That ambiguity increases the risk that common user utterances accidentally activate the companion skill, causing unwanted context capture or behavior overlap with other skills.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The English documentation repeats the same broad 'just talk' activation model, reinforcing unclear triggering semantics across languages. In a multi-skill environment this can widen accidental activation surface and make routing decisions less predictable.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The English quick-start again presents everyday chat as sufficient to invoke the skill, but does not define when such text should be interpreted as a companion-skill trigger. This can lead to false activations, unintended persona switching or settings interactions, especially because the skill also supports proactive behaviors and stateful roles.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises no explicit tool scope while its documented workflow references scripts that read environment/configuration, read and write files, and may participate in heartbeat/scheduler integrations. That mismatch weakens least-privilege controls and can cause the host to invoke a skill with broader capabilities than users or reviewers would expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description uses broad triggers such as greetings, companionship, persona creation, switching, and natural dialogue, making activation boundaries fuzzy. Overbroad activation can cause the skill to engage in contexts where users did not intend a persona/proactive-capable workflow, increasing the chance of unwanted state changes or data access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Allowing activation from 'natural conversation' without tightly scoped constraints makes this skill eligible to trigger on ambiguous user messages. In a skill that also manages roles, persistence, and proactive policies, ambiguous activation materially raises the risk of unintended behavior beyond simple chat replies.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The default prompt activates on very broad categories like greetings, natural conversation, emotional companionship, and persona flows, which can overlap with ordinary chat that many other skills or the base assistant may also handle. This increases the chance of unintended invocation, causing prompt hijacking of unrelated conversations, confusing persona switching, or inappropriate companion behavior in contexts where the user did not explicitly request this skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document states the workspace 'uses say-hi-to-me for companionship-style proactive greetings' but does not clearly constrain when the heartbeat flow may be invoked, by whom, or under what authorization and delivery conditions. Ambiguous invocation context in a proactive-messaging skill can cause unintended outbound contact, misuse by other components, or triggering in situations where user consent and timing expectations are unclear.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file hard-codes the active time window to "Asia/Shanghai" in both the table and the JSON example. This is a natural-language/configured locale constraint with no indication that the user can opt in to another locale or that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction "Use Chinese-first commands with simple English aliases" imposes a language preference as a policy default. Because the file does not indicate that users may choose their preferred language or opt into this behavior, it constitutes a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document explicitly instructs operators to configure periodic wake-ups and send proactive greetings to a delivery target, but it does not include any user-consent, opt-in, or notification requirements. In a companion-style skill, this can normalize unsolicited outbound messaging and create privacy, trust, and spam-abuse risk, especially if deployed against real user channels without clear user awareness.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill embeds Chinese-specific trigger phrases alongside some English ones for greeting, initialization, and status detection. This creates a built-in locale/language policy choice in the skill behavior without exposing any user opt-in, preference selection, or justification for why Chinese-language handling is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains user-facing natural-language strings that consistently force Chinese output, including command help and runtime replies. Under the policy, a skill should not impose a specific language or locale unless the user is given an explicit choice or the restriction is clearly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The initialization reply and embedded example prompt are presented only in Chinese, continuing the file-wide behavior of forcing one language for interaction. Because no alternate locale path or user choice is offered here, this is a natural-language policy violation rather than just a product preference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The compose_message function always generates greetings and outreach text in Chinese string literals. This is a natural-language policy concern because the skill forces a specific language for user-facing output without opt-in, fallback, or documentation that the skill is intentionally region- or locale-specific.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/sync_heartbeat_md.py (reported line 169)May include surrounding context.

python

return {
            "synced": False,
            "error": "permission_denied",
            "message": f"Cannot write to {heartbeat_path}: {e}",
            "workspace": str(workspace_root),
            "workspace_source": source,
            "task_interval": select_task_interval(session_data),

Static analysis

No suspicious patterns detected.