ClawHub
Back to skill

Security audit

Wework Financial Daily

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent reporting goal, but it embeds credentials, publishes reports through a hard-coded public MinIO setup, and recommends elevated scheduled execution.

Review before installing. Do not run this as administrator or with highest privileges. Treat the embedded WeChat and MinIO values as exposed secrets that should be revoked or rotated. Avoid using the public MinIO upload path unless you intend reports to be externally accessible, and prefer private storage with short-lived links. Treat the generated market data as simulated unless the code is changed to use a real market-data source.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
references/cron-setup.md:31
Finding

Recurring Scheduled Task Runs with Unnecessary Highest Privileges

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/generate_and_send.py:24
Finding

Hard-Coded API and Object-Storage Credentials

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/generate_and_send.py:47
Finding

Reports Are Uploaded over Plaintext and the Entire Bucket Is Made Public

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/generate_and_send.py:515
Finding

Unpinned Runtime Package Installation from a Third-Party Mirror

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (27)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The documented purpose materially differs from the detected behavior: the skill reportedly uploads reports to MinIO, makes them publicly accessible, changes bucket policy, uses hardcoded credentials instead of environment variables, and presents simulated data as if it were current market data. This combination is dangerous because it conceals sensitive data exposure, weakens credential hygiene, and misleads users about both where their data goes and the authenticity of the generated financial content.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README-定时任务配置.md (reported line 83)May include surrounding context.

schtasks /Query /TN "每日金融课件推送"

删除任务

schtasks /Delete /TN "每日金融课件推送" /F

text

## OpenClaw Cron 配置

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/cron-setup.md (reported line 41)May include surrounding context.

schtasks /Query /TN "每日金融课件推送"

删除任务

schtasks /Delete /TN "每日金融课件推送" /F

text

## OpenClaw Cron 配置

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code hardcodes an API token, recipient identifier, and MinIO access credentials directly in the script despite claiming environment-variable-based configuration. Embedded secrets are highly dangerous because anyone with file access can reuse them to send messages, access storage, or pivot into related infrastructure, and the discrepancy suggests deceptive or careless handling of credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script uploads the generated report to MinIO and sets the entire bucket policy to public read without explicit user warning. This creates direct confidentiality and data-governance risk because reports become externally accessible, and bucket-wide public exposure may unintentionally reveal other objects in the same bucket as well.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill claims to generate current financial data but actually fabricates pseudo-random prices and charts. In a financial-reporting context, this is dangerous because recipients may trust and act on false data, making the deception materially riskier than a harmless demo mismatch.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

Executing package installation during normal script runtime is outside the stated business purpose and introduces avoidable code execution and supply-chain exposure. A reporting tool should not silently alter the host environment or fetch executable content from external repositories during operation.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
91% confidence
Finding

The script executes a shell command at runtime to install packages with os.system, which is an unnecessary command-execution primitive for a reporting skill. Even though pkg is from a fixed list, this still causes uncontrolled system modification, depends on external package infrastructure at execution time, and expands the attack surface through shell invocation and supply-chain risk.

Content

Scanner excerpt · scripts/generate_and_send.py (reported line 522)May include surrounding context.

python
__import__(pkg)
        except ImportError:
            print(f"📌 正在安装 {pkg} 库...")
            os.system(f"pip install {pkg} -i https://pypi.tuna.tsinghua.edu.cn/simple")
    
    # 执行全流程
    try:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The guide tells users to store a corporate WeCom token in a system environment variable without noting that the token is a sensitive credential. System-wide variables may be visible to administrative users, inherited by child processes, and persist longer than necessary, increasing exposure if the host is shared or compromised.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to create and run a scheduled task with administrator rights and 'highest privileges' even though the described function is only generating reports and sending WeCom messages. This unnecessarily expands the blast radius: if the script, its dependencies, or the task configuration are modified, they would execute with elevated privileges and persistence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions tell users to run an administrator PowerShell setup script that creates a persistent scheduled task, but they do not explain the security implications of elevation and persistence. Users may grant broad privileges without understanding that any later tampering with the script path or dependencies could result in privileged recurring execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Suggesting users hardcode the WeCom token directly into the Python script weakens secret handling by moving credentials into source files that may be backed up, shared, version-controlled, or exposed to other local users. This increases the chance of credential leakage and undermines the stated environment-variable-based design.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Recommending direct hardcoding of configuration in the Python script without warning against embedding credentials encourages insecure secret storage practices. If the script is copied, logged, synced, or committed to a repository, the token could be exposed and abused to send unauthorized corporate messages.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill advertises behavior that writes files, uses the network, and invokes scripts, but it does not declare any explicit tool scope or permission boundaries. This is dangerous because users and the platform cannot easily evaluate or constrain what the skill is allowed to do, especially given that it performs scheduled execution, local file writes, and external messaging.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill description does not prominently warn users that it will automatically send content to Enterprise WeChat, save files to the local desktop, and support scheduled execution. This is dangerous because users may trigger persistent side effects or outbound communications without fully informed consent, especially in an automation context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs users to place the Enterprise WeChat token directly into source code, which creates a high risk of accidental credential leakage through version control, backups, screenshots, or local sharing. Because the token enables outbound messaging/API access, exposure could allow unauthorized use of the messaging integration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions recommend running the scheduled task with highest privileges and 'whether user is logged in or not' without explaining why elevation is needed. If the Python script, its dependencies, or the workspace path are modified, the task can become a privileged execution path and increase the blast radius of compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guide tells users to place WEWORK_X_TOKEN directly into YAML and a .bat file, which creates plaintext credential exposure risk through local files, backups, screenshots, source control, and task configuration sharing. In the context of an automation skill that sends data to Enterprise WeChat, this can allow unauthorized use of the bot token if the machine or workspace is accessed by another user or process.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The module docstring states that the script generates current data, but the implementation uses simulated values throughout. This mismatch is security-relevant because it conceals actual behavior and can mislead operators or reviewers about the trustworthiness of generated reports.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script's user-facing strings, generated HTML, and markdown output are entirely in Chinese, and the HTML explicitly sets lang="zh-CN". There is no indication that the skill is region-specific or that users can opt into another language, which conflicts with the policy against forcing a language or locale without opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script does more than its stated local-save and WeChat-push purpose by uploading reports to MinIO and creating a publicly accessible link. Hidden external publication materially increases exposure because generated content is transmitted off-host and made accessible to anyone with the URL, without matching the declared behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script persistently writes an HTML file to the user's Desktop without prior confirmation. While not inherently malicious, unannounced file writes can violate user expectations, create unwanted artifacts, and are more concerning here because the generated file contains financial content later shared externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script transmits report content to an external enterprise messaging API without an upfront warning or consent step. In this skill context, external messaging is expected at a high level, but the lack of explicit notice still matters because content and metadata leave the local environment automatically.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/generate_and_send.py (reported line 519)May include surrounding context.

python
required_pkgs = ["requests", "pandas", "matplotlib", "numpy", "minio"]
    for pkg in required_pkgs:
        try:
            __import__(pkg)
        except ImportError:
            print(f"📌 正在安装 {pkg} 库...")
            os.system(f"pip install {pkg} -i https://pypi.tuna.tsinghua.edu.cn/simple")

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The markdown provides schtasks /Delete ... /F, where /F suppresses confirmation and permanently deletes the task. For markdown guidance, destructive operations should carry a brief warning so users understand the action is irreversible unless they recreate the task.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.