T08 · Insecure Dependencies
Error
- Location
scripts/daxiang_daily_report.py:139- Finding
Global dependency installation recommended through an unauthenticated HTTP registry
- Content
View full analysis
- Remediation
View remediation
Security audit
大象沟通日报
Security checks for vulnerabilities and agentic risk
Overview
This skill is a real chat-report generator, but it handles sensitive workplace messages with broad automatic collection, local transcript storage, scheduled execution guidance, and an unsafe dependency-install recommendation that users should review carefully.
Install only if you are authorized to process the Daxiang conversations involved. Treat generated JSON and Markdown reports as sensitive records, avoid enabling cron until retention and access controls are clear, prefer manually scoped exports over automatic DX fetching, and do not follow the HTTP global npm install recommendation without a trusted pinned installation source.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/daxiang_daily_report.py:809- Finding
Untrusted chat data is embedded into Markdown reports without contextual escaping
- Content
View full analysis
- Remediation
View remediation
`, ``, `<script>`, `<object>`, and `<a>`. 4. Disable automatic image loading and raw-HTML rendering in the recommended report viewer. 5. Consider rendering untrusted messages inside fenced code blocks or another explicitly inert representation rather than ordinary Markdown. 6. Validate and constrain links to approved schemes and destinations if clickable links are required. 7. Label generated reports as containing untrusted communication data. 8. If reports are passed to an AI agent, isolate quoted chat content from instructions and explicitly direct the agent never to follow commands embedded in report data. 9. Add regression tests using malicious names and messages containing Markdown images, raw HTML, nested links, headings, and table-breaking payloads. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (29)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README promotes collection and analysis of internal communication records but does not warn users about privacy, consent, retention, or handling of sensitive corporate data. In a workplace messaging context, this omission increases the likelihood of unauthorized processing of confidential or personal information.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill is described as collecting and reproducing private communication records, including complete message contents and todo items inferred from chats. This creates a clear sensitive-data exposure pattern because it centralizes confidential workplace conversations into a new artifact outside the original messaging platform's access and retention controls.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documented report format includes full communication records with timestamps, speakers, and exact message text, which materially increases the sensitivity of the output. This makes the generated report a rich plaintext transcript that can expose confidential business discussions, personal data, and operational details if accessed by others.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README documents that generated reports are stored on disk but does not warn that those files may contain sensitive chat content, names, timestamps, and derived todo items. Local markdown storage of internal communications creates a durable secondary copy that can be accessed, synced, backed up, or leaked beyond the original messaging system.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The example report includes named individuals, group names, timestamps, and verbatim chat excerpts, demonstrating direct copying of sensitive internal communications into markdown. Example data in documentation can normalize unsafe behavior and may itself disclose real or realistic internal information patterns.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs the model to include a '完整沟通内容表格' that shows all messages for each contact without reduction. This is a direct data-minimization failure that can reproduce sensitive private conversations, secrets, personal data, or confidential business information into a new artifact that is easier to share or leak.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
All user-facing instructions, descriptions, and examples in the README are presented only in Chinese. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale policy issue unless the constraint is explicitly documented and justified. No language choice or region-specific justification is provided in this file.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 编辑crontab crontab -e # 添加以下行 0 6 * * * /Users/hongfei/.openclaw/skills/daxiang-daily-report/scripts/run_daxiang_report.sh
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 编辑crontab crontab -e # 添加以下行 0 6 * * * /Users/hongfei/.openclaw/skills/daxiang-daily-report/scripts/run_daxiang_report.sh
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Using the trigger phrase "report" is overly broad and can cause the skill to activate during ordinary conversation unrelated to Daxiang data analysis. In this skill's context, accidental activation is more dangerous because the skill processes sensitive internal communication records and may generate or expose reports without clear user intent.
- Content
File System Enumeration
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
- Content
md **排查步骤**： 1. 检查 Python 版本：`python3 --version`（需 3.8+） 2. 检查目录权限：`ls -la ~/.openclaw/workspace-taizi/data/` 3. 查看错误日志 ### 问题2：无法获取大象数据
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The troubleshooting section states that the current version 'needs manual acquisition of Daxiang data' and advises manually exporting chat records, which conflicts with the README's earlier description of automatic daily report generation and cron-based unattended execution. This is an active documentation contradiction about whether data collection is automated or manual, affecting user understanding of the skill's real behavior and operational expectations.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md **排查步骤**： 1. 检查 cron 服务是否运行：`ps aux | grep cron` 2. 检查 crontab 配置：`crontab -l` 3. 查看系统日志：`tail -f /var/log/syslog` ---
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The changelog explicitly highlights "complete display of all messages," reinforcing a design choice to maximize disclosure rather than minimize data exposure. While this line is documentation, it signals a risky product behavior that increases the volume and sensitivity of data copied into secondary storage.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill appears to rely on powerful capabilities such as file read/write, shell, and environment access, yet it declares no explicit tool scope or permission boundaries. This creates unnecessary ambiguity about what the skill may access at runtime and weakens least-privilege controls, especially for a skill that processes potentially sensitive chat data from the workspace.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill is designed to analyze private chat logs and generate summaries, including message-derived insights, but it provides no privacy warning or consent guidance. Users may trigger it without understanding that sensitive interpersonal communications will be processed and surfaced in a report, increasing the risk of inadvertent disclosure.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill auto-fetches private chat and group histories, then persists raw message content locally, which materially exceeds a narrow 'daily report' expectation. In this skill context, that is dangerous because the tool processes highly sensitive interpersonal communications and silently expands collection from summary generation to bulk archival.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The code executes an external CLI and depends on ambient login state and environment-derived paths for access to sensitive messaging data. That makes the skill more dangerous in practice because a simple report request can trigger privileged data access using whatever account context happens to be present on the host.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script automatically retrieves chat and group history through DX CLI without a prominent user warning or consent step. Because messaging content is highly sensitive, silent collection significantly raises privacy risk and can surprise users who expected only local summarization of already-provided data.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 检查dx命令是否可用 try: result = subprocess.run(['dx', '--help'], capture_output=True, text=True, timeout=5) if result.returncode != 0 and 'Daxiang' not in result.stdout: raise FileNotFoundError("dx command not found") except FileNotFoundError:
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 获取私聊会话列表 try: result = subprocess.run( ['dx', 'sessions', 'chats', '--full', '--limit', '100', '--json'], capture_output=True, text=True, timeout=60 )
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python name = session.get('name', '未知') try: result = subprocess.run( ['dx', 'sessions', 'show', uid, '--history', '100', '--json'], capture_output=True, text=True, timeout=30 )
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 获取群聊会话列表 try: result = subprocess.run( ['dx', 'sessions', 'groups', '--full', '--limit', '50', '--json'], capture_output=True, text=True, timeout=60 )
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python name = group.get('name', '未知') try: result = subprocess.run( ['dx', 'sessions', 'show', gid, '--history', '100', '--json'], capture_output=True, text=True, timeout=30 )
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script writes raw fetched message data to disk without clearly warning the user that full chat contents will be stored locally. This is dangerous because local persistence broadens the attack surface through file-system access, backups, indexing, accidental sharing, and retention beyond the immediate reporting task.
- Content
Static analysis
No suspicious patterns detected.