Legionclaw Create Ai Meeting

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:59 AM UTC
• Version: 1.0.0

Overview

This skill is mostly coherent for creating LegionClaw meetings, but it under-scopes identity handling for a backend action that creates account-linked resources.

Review before installing in production. This skill should ideally derive the meeting userId only from trusted LegionClaw runtime metadata, avoid exposing the full session identifier through model-visible text, strictly validate and URL-encode the identifier, and not accept arbitrary user-provided identifiers except through an authorized admin workflow.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:98

Finding

Unvalidated User-Controlled Identifier Permits Arbitrary Meeting Attribution and Query Manipulation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 98–160
Vulnerability Type: Improper validation and authorization of a user-controlled identifier
Risk Level: Medium

The Skill permits a user-provided agentid or userId to replace the identifier normally derived from trusted LegionClaw session metadata. It requires only that the supplied value be nonempty before inserting it directly into a URL query parameter.

Relevant request code:

bash

curl -sS -X POST "https://legion.tongfudun.com/im/meeting/saveMeeting/v1ForAi?userId=${USER_ID}"

The documented execution sequence also permits USER_ID to originate directly from a value voluntarily provided by the user, rather than requiring it to match the current trusted session identity.

Technical Analysis

The normal workflow extracts the second component of a runtime-provided LegionClaw session identifier and truncates it to 32 characters. However, lines 98, 123, and 148 explicitly create an exception under which a user-provided agentid or backend-compatible userId may be used directly after only a nonempty check.

This creates two related weaknesses:

1. Missing identity binding: The Skill does not verify that the supplied identifier belongs to the current user or matches the identifier derived from trusted runtime metadata.
2. Missing URL encoding and format validation: The value is interpolated directly into the query string. Shell quoting substantially limits shell-command injection, but it does not prevent URL query manipulation through characters such as &, #, or percent-encoded sequences.

The project does not document an authentication token or another proof that binds the request to the selected userId. Server-side authorization behavior cannot be verified from this repository, so successful cross-account attribution depends on the remote endpoint accepting the supplied identifier without an independent ownership check.

...[truncated 1345 chars]

Remediation

View remediation

Remediation Suggestions

1. Always derive userId from trusted LegionClaw runtime or host metadata; do not accept an arbitrary identifier from normal user input.
2. If identifier overrides are operationally necessary, restrict them to an authenticated administrative workflow and require explicit authorization for the target identity.
3. Compare any supplied override against the session-derived identifier and reject mismatches unless a trusted authorization mechanism approves them.
4. Enforce a strict allowlist for the expected identifier syntax and length, such as an application-specific pattern containing only approved alphanumeric characters.
5. Encode query parameters using a URL-aware mechanism instead of direct string interpolation. For example, use curl --get --data-urlencode where compatible with the endpoint, or construct the URL through a validated HTTP client.
6. Require the backend to derive the effective user identity from authenticated credentials rather than trusting a caller-selected userId.
7. Add negative tests covering empty values, identifiers belonging to other sessions, &, #, =, whitespace, control characters, and percent-encoded delimiters.
8. Avoid logging the complete session identifier or sensitive query parameter in user-visible errors or general-purpose logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

L013 将“创建会议、新建会议、帮我创建会议、开个会、马上开会”等常见日常说法列为触发方式，且注明“不限于此”，使触发边界非常宽泛。这些短语缺少 LegionClaw 场景限定或排除条件，容易在普通对话中与非本技能意图重叠。

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to retrieve the full current session identifier from runtime or host/model context, and even to ask the host model for the complete agent:... string. That creates an unnecessary secret-handling path through natural-language channels, increasing the chance that sensitive runtime-linked identifiers are exposed to the model, logs, prompts, tool traces, or user-visible output.

Content

No source excerpt is available for this finding.