Security audit

VC投资筛选工具

Security checks for vulnerabilities and agentic risk

Overview

This VC analysis skill has a coherent purpose, but it requires persistent storage of user-linked investment research and uses credentials/network calls in ways users should review carefully before installing.

Install only if you are comfortable with the skill storing investment preferences and reports across sessions, uploading reports to Feishu, using configured business-data API credentials, and caching API results locally. Prefer a version that makes archival and credential-file fallback opt-in, pins API hosts, and documents retention and deletion controls.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Unconditional Agent Workflow and Tool-Choice Override
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:212
Finding: Mandatory External Archival of User Identity and Investment Research
Content: View full analysis
create a document using the required name -> write it to a Feishu cloud document -> record it in the index. 1. Use feishu_create_doc to create the Feishu document. 2. If permission is unavailable, save it under workspace/vc-reports/ and upload it when permission is restored. 3. Record the document link in memory/vc-report-index.md. ``` The excerpt is an English translation of the corresponding Skill instructions. ### Technical Analysis The Skill requires every analysis result to be uploaded to Feishu and requires the archived document to contain the user's identity, investment preferences, and query motive. No explicit opt-in, destination confirmation, access-control verification, retention period, or deletion process is defined. Cloud archival is not required to answer a one-time investment-analysis request. Mandatory upload therefore exceeds the minimum privileges necessary for the declared analytical functionality. The local fallback does not eliminate the risk because the instructions require deferred upload after permissions are restored. The report index also makes the information persistently discoverable across sessions. ### Attack Path 1. A user requests an investment or company analysis. 2. The Skill collects the user's identity, interests, and reason for the query. 3. The analysis reveals target companies, sectors, investment strategy, and potentially confidential ...[truncated 791 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/people_data.py:30
Finding: People Data API Credential Exfiltration Through an Unrestricted Base URL
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/cache.py:23
Finding: Plaintext Storage of Complete API Responses Without Explicit File Permissions
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:69
Finding: Cross-Session Retention of User Investment Preferences Without Consent or Expiration
Content: View full analysis
Remediation: View remediation

other

Note

Location: references/user-methodology.md:1
Finding: Named User Attribution and Document Provenance Embedded in the Distributed Package
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (34)

Tainted flow: 'req' from os.environ.get (line 90, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/people_data.py (reported line 72)May include surrounding context.
python
req = urllib.request.Request(url, headers=headers, method="GET") try: with urllib.request.urlopen(req, timeout=15) as resp: data = json.loads(resp.read().decode("utf-8")) data["configured"] = True return data

Tainted flow: 'req' from os.environ.get (line 90, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/people_data.py (reported line 92)May include surrounding context.
python
req = urllib.request.Request(url, headers=headers, method="GET") try: with urllib.request.urlopen(req, timeout=15) as resp: data = json.loads(resp.read().decode("utf-8")) data["configured"] = True return data

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The skill is presented as an investment-analysis workflow, but it additionally mandates version checking via local/remote mechanisms unrelated to the user task. Unrelated side behaviors expand attack surface and can create unexpected network or command-execution paths under the guise of normal use.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill is presented as an investment-analysis workflow, but it additionally mandates version checking via local/remote mechanisms unrelated to the user task. Unrelated side behaviors expand attack surface and can create unexpected network or command-execution paths under the guise of normal use.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as an investment-analysis workflow, but it additionally mandates version checking via local/remote mechanisms unrelated to the user task. Unrelated side behaviors expand attack surface and can create unexpected network or command-execution paths under the guise of normal use.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are extremely broad and overlap with common conversational language such as asking to 'evaluate' or 'research' something. Overbroad activation can cause the skill to engage unexpectedly, leading to unintended data access, retention, external calls, or archival of sensitive user content in contexts where the user did not knowingly invoke the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill mandates archival of analysis results, user identity, preferences, and query reasons to Feishu cloud documents and local fallback storage, but the description does not warn users about this persistence. This is a clear transparency and privacy failure: users may reveal sensitive business interests, investment theses, or personal identifiers without informed consent to long-term storage and retrieval.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The mandatory archival workflow requires storing user-linked analysis and metadata in Feishu cloud docs with local fallback storage, creating a durable repository of potentially sensitive investment activity. Because archival is mandatory for every analysis and includes identifiers, reasons, and source details, compromise or misuse of this store could expose confidential deal flow, strategic interests, and user-specific histories.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares no explicit tool scope even though it instructs use of capabilities consistent with environment access, network calls, and local script execution. Without a least-privilege allowlist, the runtime may grant broader access than users expect, increasing the blast radius if the skill is misused or later extended with unsafe prompts or scripts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The natural-language description, trigger phrases, onboarding content, and required outputs are all specified in Chinese, and the file does not offer any language/locale choice or state that the tool is intentionally limited to a Chinese-speaking or China-specific audience. This can violate language or locale policy when users are not given an opt-in or alternative.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The activation condition is vague, so the agent may interpret many loosely related requests as permission to run the skill. In this skill, ambiguous triggering is more dangerous because execution can cascade into preference collection, historical retrieval, and mandatory archival to cloud/local storage.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to persist user identity, inquiry reasons, and preference history across sessions. Cross-session storage of investment preferences and motivations can reveal sensitive commercial strategy and personal profiling data, especially when collected by default rather than minimally and with consent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The historical lookup feature instructs the agent to fetch and return prior stored reports containing user-linked context. Without strong authorization and minimization controls, this creates a risk of exposing past sensitive analyses or profile data to the wrong requester through ambiguous identity matching or accidental retrieval.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Forcing execution of a local version-check script on every trigger introduces unnecessary command/script execution unrelated to investment analysis. Any automatic script invocation increases the risk of command abuse, tampered local files, or unwanted outbound requests, especially when it runs regardless of user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The document specifies automatic caching of API query results to a local SQLite database, but it does not define consent, retention enforcement, access controls, encryption, or handling of potentially sensitive enterprise query data. In a SaaS/agent setting, persisted local caches can expose business research activity, queried targets, and returned third-party data to other users, operators, or anyone with filesystem access.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file contains all user-facing instructions in Chinese and does not indicate that users may choose another language or that the template is intended only for a Chinese-language audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file’s user-facing prompts and instructions are entirely in Chinese, which effectively forces a specific language for interaction. The policy allows locale constraints only when users are given a choice or when the constraint is explicitly documented and justified, neither of which appears here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code path allows a user to clear all cached data or all cached data for a source, which is a destructive operation affecting persisted user/system data in the SQLite cache. Although the script prints the result afterward, it provides no pre-action confirmation or explicit warning before deletion, and the surrounding docstrings/comments do not warn about the irreversible effect of the clear command.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The code silently falls back to reading credentials from ~/.openclaw/workspace/memory/vc-api-keys.md, a separate local memory file outside the immediate runtime configuration. That expands the trust boundary and can cause the skill to access sensitive credentials without explicit user awareness, increasing the risk of unintended secret use or cross-skill secret leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill can obtain an API key from a local credential file without notifying the user at runtime that it is doing so. This is dangerous because it hides secret access behavior, weakens informed consent, and may cause users to unknowingly authorize external requests under credentials pulled from unrelated local state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The GET helper transmits user-supplied query terms, such as company names or sentiment keywords, to an external API with no visible disclosure or consent mechanism in the code. In an investment-analysis skill, those queries can be commercially sensitive and may reveal research targets, making silent third-party transmission a meaningful privacy and confidentiality risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The POST helper sends arbitrary request bodies to an external service without any built-in notice, approval step, or data classification check. Even though current callers may not use POST heavily, the helper enables future transmission of potentially sensitive investment or company analysis data to a third party without transparency.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The natural-language strings and usage instructions in this skill are entirely Chinese, including help output and inline documentation. This imposes a specific language on users without opt-in or an explicit justification that the skill is intended only for a Chinese-speaking or region-specific context.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code retrieves the Tianyancha API key not only from the declared environment variable but also from a hard-coded workspace memory file under the user's home directory. This creates an undocumented secret source and can cause the skill to consume credentials the user did not explicitly provide for this execution context, increasing the risk of unintended secret access and cross-skill credential leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill silently reads a sensitive credential file and uses its contents for authentication without any runtime disclosure or confirmation. In an agent environment, this weakens user awareness and consent around secret access, making it easier for the skill to pull credentials from shared memory files unexpectedly.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.