Security audit

Automation Workflow Plus - (自动化工作流助手)

Security checks for vulnerabilities and agentic risk

Overview

This automation skill is mostly instructional, but it gives unsafe guidance for passwords, reusable login cookies, and internal financial workflows that users should review carefully before installing.

Install only if you are comfortable reviewing and constraining the promoted RPA workflow yourself. Do not paste real passwords into chats or task descriptions, do not reuse saved cookies for sensitive systems unless your organization approves it, and prefer isolated least-privilege accounts, secure secret storage, encrypted session storage, and pinned or reviewed package versions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:120
Finding: Unpinned Installation of a Third-Party RPA Skill
Content: View full analysis
**推荐工具：OpenClaw RPA** > > 一款专为 AI Agent 设计的 RPA 编译器——用自然语言描述任务，AI 驱动真实浏览器录制一次，自动生成可独立运行的 Playwright Python 脚本，之后每次重放**零 Token、零幻觉、秒级完成**。 > > 已有电商比价、财务对账、酒店信息采集、股票新闻简报等真实案例视频演示： > 👉 **[查看中文介绍 + 视频案例](https://github.com/laziobird/openclaw-rpa/blob/main/README.zh-CN.md)** > > **精选案例：** > - 🛒 **[Amazon 畅销榜抓取](https://github.com/laziobird/openclaw-rpa/blob/main/articles/scenario-amazon-bestsellers.en-US.md)** — 自动提取商品标题、价格、评分、评论数、链接，生成 Word 表格报告，零代码、零手动操作 > - 🏨 **[Airbnb 竞品比价追踪](https://github.com/laziobird/openclaw-rpa/blob/main/articles/scenario-airbnb-compare.en-US.md)** — 视觉识别 + DOM 分析，自动提取竞品价格与评分 > - 🏦 **[应付账款自动对账](https://github.com/laziobird/openclaw-rpa/blob/main/articles/scenario-ap-reconciliation.en-US.md)** — API 拉数据 → Excel 匹配 → Word 报告全流程自动化 > > 在 OpenClaw 平台一键安装： > 👉 **[clawhub.ai/laziobird/openclaw-rpa](https://clawhub.ai/laziobird/openclaw-rpa)** > > 或在终端运行： > ```bash > openclaw skills install openclaw-rpa > ``` > 安装后在对话框输入 `#RPA` 即可启动录制引导。 ``` ### Technical Analysis The Skill recommends installing a third-party package by a mutable package name: ```bash openclaw skills install openclaw-rpa ``` No immutable version, source commit, cryptographic checksum, signature-verification procedure, or permission manifest is specified. Consequently, the code installed when a user follows this instruction may differ from the version that was available when this documentation was audited. This is especially sensitive because the promoted component is described as controlling a browser, generating and executing Playwright scripts, retaining authenticated state, and reading or producing local files. A malicious package release or compromised publisher account could therefore abuse capabilities that users reasonably grant to an RP ...[truncated 1570 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:398
Finding: Credentials and Reusable Browser Sessions Are Handled Insecurely
Content: View full analysis
，账号 <账号> 密码 <密码> 进入「应付款」页面，筛选本月数据，导出为 CSV 保存到桌面读取桌面的 invoices.xlsx（发票记录表），与导出的 CSV 按「采购单号」字段做匹配对账： - 匹配成功：标记「已核销」 - 仅系统有、发票无：标记「待补票」 - 仅发票有、系统无：标记「异常」生成 Word 报告保存到桌面，文件名：对账报告_YYYYMMDD.docx 报告包含：汇总表（总金额、已核销、待补票、异常条数）+ 明细表格 ``` > **提示：** 若系统需要短信验证码，先运行 `#rpa-login <系统地址>` 保存登录态，后续录制自动注入 Cookie 无需重复登录。 ``` ### Technical Analysis The example directs users to paste an internal-system address, account name, and password into an Agent task description. It also recommends saving the authenticated login state and automatically injecting cookies in later runs. Conversation content may be retained in logs, transcripts, debugging records, model-provider requests, generated scripts, or workflow metadata. Entering passwords directly into that channel unnecessarily expands the number of systems and operators that may receive the secret. Persisted authentication cookies are bearer credentials. Anyone able to read a valid session cookie may be able to impersonate the user without knowing the password and, depending on the target application, without repeating an MFA challenge. The documentation provides no requirements for encryption at rest, restrictive file permissions, expiration, account scoping, log redaction, secure deletion, or revocation. The project does not contain the implementation of `#rpa-login`, so the audit cannot establish how the external RPA component stores cookies. The confirmed weakness is that the Skill explicitly encourages plaintext credential disclosure and session persistence without prescribing necessary safeguards. ### Attack Path 1. A user copies the supplied template and replaces the placeholders with ...[truncated 1483 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill promotes saving login state and automatically injecting cookies to bypass repeated authentication, but does not warn about session hijacking, insecure storage, scope limitation, or consent boundaries. Reusing authenticated session artifacts can grant persistent access to internal systems and sensitive data if those cookies are exposed, mis-scoped, or reused on shared machines.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The example explicitly instructs users to place an account and password directly into a task description. That encourages plaintext credential disclosure into prompts, logs, chat history, and downstream tooling, creating a direct path to credential leakage and unauthorized access.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger terms are extremely broad and include common words like 'automation', 'workflow', and '提效', which can cause the skill to activate in many unrelated conversations. Over-broad triggering increases the chance that users are steered into risky automation advice, including handling credentials or internal systems, in contexts where they did not explicitly request this skill.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document encourages persistent reuse of authenticated session state to automate access to internal systems handling potentially sensitive records. In this automation context, that materially raises the risk of unauthorized continued access, data exposure, and policy bypass if session state is copied, retained too long, or used outside approved boundaries.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The financial reconciliation example combines internal system login, export of business records, local file storage, and credential submission in a single plain-language workflow. In context, this is dangerous because it normalizes insecure handling of sensitive financial data and credentials without addressing encryption, access control, data retention, or approval requirements.
Content: No source excerpt is available for this finding.