Security audit

Eyes · 大眼看世界（全球新闻·热点新闻·投资分析）- Global News Monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a news-and-market alert assistant, but its outbound messaging path has under-scoped delivery behavior that could send or modify reports in unexpected ways.

Install only after reviewing the cron jobs and message destinations. Do not use the provided hard-coded Feishu examples as-is, remove the BigA config fallback and promotion behavior, and require explicit confirmation before sending reports or changing cron/update settings.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: scripts/eyes-utils.py:263
Finding: Unrelated Product Promotion Is Automatically Injected into Outbound Reports
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:146
Finding: Mandatory Delivery Examples Contain a Concrete Feishu Recipient Identifier
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/eyes-utils.py:249
Finding: Eyes Silently Reads and Reuses Another Skill's Delivery Configuration
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill is described as a news monitor, but its behavior extends into persistent local state, outbound delivery, cron/job management, update workflows, and references to other tooling. This mismatch makes risk harder for users and reviewers to understand and can conceal privileged behavior behind an innocuous description.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Broad everyday triggers can cause the skill to activate on unrelated conversation. In this skill, activation is especially risky because the instructions say '触发即执行' and can lead to searches, file operations, outbound messaging, and other side effects without further confirmation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes shell commands and writes persistent files, but it declares no explicit tool restrictions. That creates an over-privileged design where a conversational trigger can lead to command execution, cron changes, updates, and outbound messaging without a least-privilege boundary.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger set contains multiple generic phrases with weak scope constraints. Because the skill auto-executes and includes persistent and outbound behaviors, accidental invocation can produce unintended message sends, cron actions, or local state changes.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The document defines a fixed branded output format in Chinese and does not indicate that the user may choose language or locale. Since the skill description is bilingual but the operational instructions prescribe one language/style by default, this can violate language-choice policy when interacting with users who did not opt in.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Self-update plus cron reconfiguration allows the skill to change its own code path and persistence behavior from a chat trigger. That expands the trust boundary significantly: a user asking for news could end up authorizing software modification and background task changes, which can be abused for persistence or to introduce new behavior after review.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Installing scheduled jobs and creating marker files establishes persistence beyond a one-shot summarization task. If triggered unintentionally or abused, the skill can continue sending content or modifying local state long after the initiating conversation, increasing blast radius.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This JSON manifest contains only Chinese-language skill names, descriptions, and execution messages, which indicates the skill is designed to operate in a fixed language without offering a user choice or opt-in. Under the policy rule for natural-language violations, forcing a specific language is reportable unless the locale constraint is explicitly justified or optional.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The document title, headings, and all table content are in Chinese, which imposes a single language on users. Under the stated policy, forcing a specific language without user opt-in or documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file-level description and command/help text are entirely in Chinese, and later user-directed strings also require Chinese phrases such as replying with specific Chinese text. There is no indication that the skill is region-specific or that users may opt into another language, which violates the language/locale policy described in the audit rules.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This utility can send content to Feishu/OpenClaw targets, which is a material capability expansion beyond passive news monitoring and analysis. In a skill context, hidden outbound messaging increases the risk of unauthorized data exfiltration, spam, or actions performed on behalf of the user without sufficiently clear consent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill reads shared BigA configuration and reuses its channel/target, then advertises another tool inside the send path. Cross-skill config reuse breaks isolation assumptions and can cause this news skill to send to destinations configured for a different tool, enabling confused-deputy behavior and unexpected disclosure to third-party recipients.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: These strings instruct the user to reply with Chinese phrases such as 帮我安装 and 帮我安装大A to proceed. Because no alternative language option is offered and no regional justification is stated, the skill imposes a language requirement on users.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/eyes-utils.py (reported line 299)May include surrounding context.
python
seg=seg.strip() if not seg: continue for attempt in range(3): p=subprocess.Popen( [openclaw_bin,"message","send", "--channel",channel, "--target",target,

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Messages are transmitted to an external channel without an explicit confirmation step in the sending path. In this skill, that is more dangerous because the tool is framed as a news assistant, so users may not expect operational message delivery or realize content and destination can be pulled from stored config.
Content: No source excerpt is available for this finding.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 87% confidence
Finding: The trigger '大眼' is very short and ambiguous, making accidental activation likely. In the context of this skill, accidental activation is more dangerous because invocation can immediately perform searches and outbound push behavior rather than only generating local text.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: L169-L171 says manual triggering should use message send and even checks whether openclaw message send was called, but elsewhere the same file mandates eyes-utils.py send-segments as the required sender and forbids manual openclaw message send calls (L121-L122, L146-L151, L206-L207). This is an active contradiction in operational guidance, not just missing detail.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: L220 states that manual triggers must send segmented messages via openclaw message send, while multiple earlier sections explicitly require eyes-utils.py send-segments and prohibit manual openclaw message send usage. These instructions cannot both be true, creating intent-code/documentation divergence within the skill specification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The cron entry explicitly sets the timezone to "Asia/Shanghai", and the same pattern recurs in the other scheduled jobs. This is a natural-language/configured locale constraint that does not present user opt-in or explain why the skill must be limited to that locale.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The function signatures and CLI parsing suggest the caller can choose a scene via --scene, but the inline comments state the implementation always infers Beijing time and ignores the provided value. This is an intent/documentation divergence within the code interface itself: the exposed parameter implies controllability that the implementation explicitly overrides.
Content: No source excerpt is available for this finding.