Automation Workflow Plus - (自动化 工作流 助手)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:47 AM UTC
• Version: 1.0.1

Overview

This automation skill is mostly instructional, but it gives unsafe guidance for passwords, reusable login cookies, and internal financial workflows that users should review carefully before installing.

Install only if you are comfortable reviewing and constraining the promoted RPA workflow yourself. Do not paste real passwords into chats or task descriptions, do not reuse saved cookies for sensitive systems unless your organization approves it, and prefer isolated least-privilege accounts, secure secret storage, encrypted session storage, and pinned or reviewed package versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:120
• Finding: Unpinned Installation of a Third-Party RPA Skill<** > > **精选案例：** > - 🛒 **[Amazon 畅销榜抓取](https://github.com/laziobird/openclaw-rpa/blob/main/articles/scenario-amazon-bestsellers.en-US.md)** — 自动提取商品标题、价格、评分、评论数、链接，生成 Word 表格报告，零代码、零手动操作 > - 🏨 **[Airbnb 竞品比价追踪](https://github.com/laziobird/openclaw-rpa/blob/main/articles/scenario-airbnb-compare.en-US.md)** — 视觉识别 + DOM 分析，自动提取竞品价格与评分 > - 🏦 **[应付账款自动对账](https://github.com/laziobird/openclaw-rpa/blob/main/articles/scenario-ap-reconciliation.en-US.md)** — API 拉数据 → Excel 匹配 → Word 报告全流程自动化 > > 在 OpenClaw 平台一键安装： > 👉 **[clawhub.ai/laziobird/openclaw-rpa](https://clawhub.ai/laziobird/openclaw-rpa)** > > 或在终端运行： > ```bash > openclaw skills install openclaw-rpa > ``` > 安装后在对话框输入 `#RPA` 即可启动录制引导。 ``` ### Technical Analysis The Skill recommends installing a third-party package by a mutable package name: ```bash openclaw skills install openclaw-rpa ``` No immutable version, source commit, cryptographic checksum, signature-verification procedure, or permission manifest is specified. Consequently, the code installed when a user follows this instruction may differ from the version that was available when this documentation was audited. This is especially sensitive because the promoted component is described as controlling a browser, generating and executing Playwright scripts, retaining authenticated state, and reading or producing local files. A malicious package release or compromised publisher account could therefore abuse capabilities that users reasonably grant to an RP ...[truncated 1570 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the dependency to an immutable, audited version or source commit rather than installing only by package name. 2. Publish and verify a cryptographic checksum or trusted signature for the approved package artifact. 3. Identify the expected publisher, canonical repository, release version, and review date. 4. Document the exact permissions required by the RPA Skill and deny all unnecessary browser, filesystem, network, and command-execution access. 5. Require users to inspect the package manifest and source before installation. 6. Use a trusted internal registry or approved artifact mirror where practical. 7. Add a controlled update process that requires security review before adopting new releases. 8. Run browser automation in a sandbox or isolated account with access only to the data and websites required for the specific workflow. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:398
• Finding: Credentials and Reusable Browser Sessions Are Handled Insecurely<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 398-423 **Vulnerability Type**: Plaintext credential entry and persistent authenticated session storage **Risk Level**: High ### Complete Code Snippet ```markdown #RPA ``` 第二步，Agent 询问任务名和能力码后，输入（两行）： ```text 财务对账报告 F ``` 第三步，粘贴任务描述： ```text 登录 https://<你的内部系统地址>，账号 <账号> 密码 <密码> 进入「应付款」页面，筛选本月数据，导出为 CSV 保存到桌面 读取桌面的 invoices.xlsx（发票记录表）， 与导出的 CSV 按「采购单号」字段做匹配对账： - 匹配成功：标记「已核销」 - 仅系统有、发票无：标记「待补票」 - 仅发票有、系统无：标记「异常」 生成 Word 报告保存到桌面，文件名：对账报告_YYYYMMDD.docx 报告包含：汇总表（总金额、已核销、待补票、异常条数）+ 明细表格 ``` > **提示：** 若系统需要短信验证码，先运行 `#rpa-login <系统地址>` 保存登录态，后续录制自动注入 Cookie 无需重复登录。 ``` ### Technical Analysis The example directs users to paste an internal-system address, account name, and password into an Agent task description. It also recommends saving the authenticated login state and automatically injecting cookies in later runs. Conversation content may be retained in logs, transcripts, debugging records, model-provider requests, generated scripts, or workflow metadata. Entering passwords directly into that channel unnecessarily expands the number of systems and operators that may receive the secret. Persisted authentication cookies are bearer credentials. Anyone able to read a valid session cookie may be able to impersonate the user without knowing the password and, depending on the target application, without repeating an MFA challenge. The documentation provides no requirements for encryption at rest, restrictive file permissions, expiration, account scoping, log redaction, secure deletion, or revocation. The project does not contain the implementation of `#rpa-login`, so the audit cannot establish how the external RPA component stores cookies. The confirmed weakness is that the Skill explicitly encourages plaintext credential disclosure and session persistence without prescribing necessary safeguards. ### Attack Path 1. A user copies the supplied template and replaces the placeholders with ...[truncated 1483 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all instructions that ask users to enter passwords, API keys, or other secrets into Agent conversations. 2. Use an interactive browser-login flow in which credentials are entered directly into the trusted target page and are never exposed to the Agent. 3. Where noninteractive authentication is required, retrieve secrets at runtime from an approved secret manager through opaque references. 4. Prevent secrets from being embedded in generated Playwright scripts, prompts, command histories, logs, screenshots, traces, and exported workflow definitions. 5. Encrypt persisted browser state with a key stored separately from the session file. 6. Apply owner-only filesystem permissions to session-state files and store them outside shared temporary or desktop directories. 7. Use dedicated least-privilege automation accounts rather than personal or administrator accounts. 8. Configure short session lifetimes, automatic expiration, and explicit revocation procedures. 9. Provide a command to securely delete stored cookies and document how users can revoke all active sessions from the target application. 10. Redact cookies, authorization headers, passwords, and account identifiers from diagnostic output. 11. Isolate each workflow's browser profile so one automation cannot read another workflow's authenticated state. 12. Require renewed authentication for high-risk financial or administrative actions rather than relying solely on persisted cookies. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill promotes saving login state and automatically injecting cookies to bypass repeated authentication, but does not warn about session hijacking, insecure storage, scope limitation, or consent boundaries. Reusing authenticated session artifacts can grant persistent access to internal systems and sensitive data if those cookies are exposed, mis-scoped, or reused on shared machines.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The example explicitly instructs users to place an account and password directly into a task description. That encourages plaintext credential disclosure into prompts, logs, chat history, and downstream tooling, creating a direct path to credential leakage and unauthorized access.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The trigger terms are extremely broad and include common words like 'automation', 'workflow', and '提效', which can cause the skill to activate in many unrelated conversations. Over-broad triggering increases the chance that users are steered into risky automation advice, including handling credentials or internal systems, in contexts where they did not explicitly request this skill.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The document encourages persistent reuse of authenticated session state to automate access to internal systems handling potentially sensitive records. In this automation context, that materially raises the risk of unauthorized continued access, data exposure, and policy bypass if session state is copied, retained too long, or used outside approved boundaries.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The financial reconciliation example combines internal system login, export of business records, local file storage, and credential submission in a single plain-language workflow. In context, this is dangerous because it normalizes insecure handling of sensitive financial data and credentials without addressing encryption, access control, data retention, or approval requirements.

Static analysis

No suspicious patterns detected.