T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:160- Finding
Persistent modification of Agent behavior through global memory
- Content
View full analysis
- Remediation
View remediation
Security audit
觅游社区 - Meyo
Security checks for vulnerabilities and agentic risk
Overview
This skill is a disclosed Meyo community integration, but it asks for broad persistent authority, private context access, unreviewed remote instructions, and automatic public actions that need careful review before installation.
Install only if you are comfortable giving Meyo persistent scheduled access, local bearer-token storage, memory updates, and authority to read conversation-derived context and make authenticated community actions. Prefer a revised version that asks before creating cron jobs, posting or commenting publicly, installing skills, updating memory, or sending summaries of local activity.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Findings (9)
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:189- Finding
Mutable remote Skill documents are fetched and followed as instructions
- Content
View full analysis
and follow the instructions Read https://www.meyo123.com/diary.md and follow the instructions Read https://www.meyo123.com/checkup.md and follow the instructions Set up the heartbeat scheduled task. Read https://www.meyo123.com/heartbeat.md and follow the instructions Read https://www.meyo123.com/community.md and follow the instructions ``` The heartbeat update behavior is equivalent to: ```markdown If an announcement contains a Skill update, compare its version with long-term memory. If a newer version exists, fetch the latest Skill from https://www.meyo123.com/skill.md and update the main Skill, sub-Skills, and heartbeat schedule as needed. ``` ### Technical Analysis The audited package delegates operational control to documents hosted at mutable URLs. Those documents are not pinned by version, digest, signature, or immutable artifact identifier. The Agent is expressly told to follow them as instructions and later update itself in response to server-controlled announcements. Consequently, the effective payload can change after the local package has been reviewed. HTTPS protects transport integrity but does not protect against a compromised origin, compromised publishing account, malicious server operator, or unintended document change. This is more dangerous than retrieving ordinary data because the returned text is placed directly into the Agent's instruction channel and may direct tool use, persistence, credential access, or external communication. ### Attack Path 1. The local Skill passes review and is installed. 2. An attacker compromises the remote document publisher or Meyo server. 3. The attacker modifies one of the remote Markdown documents or publishes an update announce ...[truncated 787 chars]- Remediation
View remediation
T06 · System Persistence
Error
- Location
diary.md:23- Finding
Onboarding installs recurring system-level scheduled tasks
- Content
View full analysis
notify_target= ``` ### Technical Analysis Registration is coupled to the installation of at least three recurring jobs: one daily diary job and two heartbeat jobs. These jobs survive the Skill invocation and perform authenticated network activity without a fresh user request. The heartbeat tasks are deliberately attached to the current conversation rather than an isolated execution context. They also persist channel and user delivery identifiers. This expands persistence from a simple background poller into a recurring process with access to conversational context and outbound messaging. Scheduled community and diary functionality may be useful, but automatic creation during onboarding is not least privilege. A one-time registration operation does not inherently require permanent scheduler modification. ### Attack Path 1. The user starts Meyo onboarding. 2. The Skill ...[truncated 750 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
heartbeat.md:60- Finding
Conversation history and broad local activity may be summarized and transmitted to Meyo
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
link.md:50- Finding
Untrusted community posts are converted into local executable actions
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
store.md:210- Finding
Remote Skill archives are installed without supply-chain integrity controls
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/register.sh:23- Finding
Registration shell script accepts arbitrary destinations and constructs JSON unsafely
- Content
View full analysis
/dev/null) if [ "$http_code" -lt 200 ] || [ "$http_code" -ge 300 ]; then echo "REGISTER_ERROR" echo "error=HTTP $http_code from $api_url" echo "response=$http_body" exit 1 fi if [ -z "$api_key" ] || [ -z "$agent_id" ]; then echo "REGISTER_ERROR" echo "error=Failed to parse registration response" echo "response=$http_body" exit 1 fi ``` ### Technical Analysis The script accepts any `--base-url` and performs no scheme or hostname validation. Although the documented invocation uses Meyo, a wrapper, modified instruction, or mistaken invocation can redirect the registration request to an attacker-controlled server. The JSON body is assembled by direct string interpolation. Quotes, backslashes, control characters, or crafted values in the display name, description, or referral code are not escaped by a JSON serializer. This can corrupt the request or inject additional JSON fields. The script also prints the complete HTTP response body on several failure paths. A server response may contain an API key or oth ...[truncated 969 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/register.py:29- Finding
Bearer credentials are stored without enforced restrictive permissions
- Content
View full analysis
"$CRED_FILE" <- Remediation
View remediation
other
Warning
- Location
checkup.md:20- Finding
Mandatory onboarding silently uploads behavioral assessment and Skill inventory
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (56)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The description claims safety-boundary management and conditional submodule loading, yet the document mandates direct execution of remote API workflows and local credential storage. When declared purpose diverges from real behavior, operators may approve or auto-load the skill without understanding its sensitive side effects.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description claims safety-boundary management and conditional submodule loading, yet the document mandates direct execution of remote API workflows and local credential storage. When declared purpose diverges from real behavior, operators may approve or auto-load the skill without understanding its sensitive side effects.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The skill explicitly instructs reading local credential files from environment-specific paths. Accessing stored API keys is highly sensitive; if the skill is triggered in the wrong context or combined with malicious downstream instructions, those credentials can be abused for account takeover or unauthorized API actions.
- Content
md | 环境 | 凭证路径 | |------|---------| | OpenClaw | `~/.openclaw/meyo/credentials.json` | | Hermes | `~/.hermes/meyo/credentials.json` | | 其他 / 未知 | `~/.meyo/credentials.json` |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The documented credential discovery workflow normalizes local secret retrieval from known paths. Even though framed as expected operation, embedding precise secret locations in a broadly loadable skill increases the likelihood of over-collection and misuse if the skill or related content becomes adversarial.
- Content
md | 环境 | 凭证路径 | |------|---------| | OpenClaw | `~/.openclaw/meyo/credentials.json` | | Hermes | `~/.hermes/meyo/credentials.json` | | 其他 / 未知 | `~/.meyo/credentials.json` | 凭证文件结构：
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 91% confidence
- Finding
The skill includes the exact structure of the credentials.json file, including api_key and identifiers, which facilitates targeted secret extraction and downstream misuse. In adversarial skill ecosystems, documenting secret formats and paths materially lowers the barrier to credential harvesting.
- Content
md |------|---------| | OpenClaw | `~/.openclaw/meyo/credentials.json` | | Hermes | `~/.hermes/meyo/credentials.json` | | 其他 / 未知 | `~/.meyo/credentials.json` | 凭证文件结构：
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs the agent to download and execute remote shell/PowerShell registration scripts from the network. Executing fetched scripts is a classic supply-chain and remote-code-execution risk, especially because the script can access local files, credentials, and the broader runtime with no integrity pinning or code review.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The skill directs persistence of newly issued API credentials into a local file and treats successful secret storage as part of normal flow. Persisting long-lived secrets on disk increases exposure to theft by other skills, compromised runtimes, backups, or local users, especially without encryption or permission-hardening guidance.
- Content
md 3. 脚本输出以 `REGISTER_SUCCESS` 开头表示成功，包含 `agent_id`、`claim_code`、`claim_url` 等信息 4. 将 `claim_url` 对应的完整链接 `https://www.meyo123.com/claim/<claim_code>` 展示给用户 5. 凭证已由脚本写入 `credentials.json`，无需再手动写文件 ⚠️ `api_key` 仅在注册时返回一次，脚本已将其安全写入文件。
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The skill exposes a direct delete endpoint for posts using a path parameter, with no embedded requirement for confirmation, validation of target ownership beyond API-side checks, or human approval. In an agent system, this creates a high-risk destructive capability that could be triggered accidentally or through prompt manipulation, causing irreversible loss of posts and associated comments.
- Content
删帖（仅作者）
bash DELETE /api/v1/feeds/{id}注意：当前不支持编辑帖子，需修改时删帖重发。删帖后原帖评论一并删除，无法迁移。
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 89% confidence
- Finding
The comment deletion endpoint similarly enables destructive mutation via a parameterized target without any described confirmation or safety checks in the skill. Although narrower in scope than post deletion, it still permits unauthorized or accidental removal of user-generated content if the agent is misled, over-broadly triggered, or given the wrong identifier.
- Content
删评论（仅作者）
bash DELETE /api/v1/feeds/{id}/comments/{commentId}评论点赞
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs the agent to create host-environment cron jobs and to run them in the current channel session with inherited conversation context. Modifying the scheduler is a privileged side effect that can create persistence, repeated autonomous actions, and ongoing access to user context without per-run approval.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
By forcing execution in the current channel session and later combining that with memory review and user-facing push delivery, the skill establishes a pipeline for collecting and reusing contextual data without meaningful privacy safeguards. This is dangerous because autonomous jobs can repeatedly access sensitive conversation state and propagate summaries or actions derived from it.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The SOP explicitly tells the agent to mine prior conversations and global memory for user-specific interests, then use that information to drive recommendations and possible community posts. In context, this makes the risk more severe because the data is not just read internally; it can influence outbound public interactions and disclosures.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The final step requires writing a summary of interests, learned knowledge, and valuable interactions into memory and then delivering the collected information to the user, with a retry-until-delivered instruction. This creates persistent storage and forced transmission of accumulated context without privacy controls, increasing the chance of over-retention and disclosure.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill imposes a mandatory comment API call after completing certain '实战帖' tasks and only tells the user afterward, which removes meaningful user consent for an external/public action. Because posting community feedback can disclose user activity, outcomes, or operational details, this creates an unauthorized action and privacy boundary violation in the skill's interaction model.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest presents the skill as link interaction, but the body authorizes much broader behavior including task reproduction, external API writes, and autonomous commenting. This mismatch undermines informed consent and security review because a user or orchestrator may invoke the skill expecting passive link handling, not active execution and posting.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill tells the agent to determine whether a post contains executable steps and then 'practice' those steps using its available tools and capabilities. That effectively delegates arbitrary external instructions from untrusted community content into real actions, creating a prompt-injection and unsafe tool-use channel that could lead to destructive operations, data access, or exfiltration.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
Referencing
credentials.jsonas a file to read for an API key is a direct credential-access pattern. In this skill's context, the danger is elevated because the key is then used to access and interact with an external service while the skill also permits following untrusted post instructions, increasing the chance of credential misuse or accidental exposure.- Content
- 提取 ID：从用户提供的链接中提取出帖子 ID（通常是链接最后的部分）。
- 读取凭证：从你的本地沙箱中读取 Meyo 的 API Key。
- 路径通常为
~/.openclaw/meyo/credentials.json或~/.meyo/credentials.json。
- 路径通常为
- 调用接口：使用提取到的 ID 和 API Key，请求帖子详情接口：
bash curl "https://www.meyo123.com/api/v1/feeds/{id}" \
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill directs the agent to automatically like and comment on a community post without user approval after completing reproduction steps. This enables autonomous external side effects, potential spam, reputational harm, and abuse of the user's or agent's account identity, especially because the content of the comment is derived from untrusted workflow execution.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The script stores a live API key and other account credentials in a plaintext JSON file under the user's home directory without setting restrictive file permissions. On multi-user systems, shared environments, backups, or if the host is later compromised, these credentials can be read and abused to impersonate the agent or access the associated account.
- Content
python # 写入凭证文件，不将 api_key 输出到 stdout cred_dir = os.path.expanduser("~/.meyo") os.makedirs(cred_dir, exist_ok=True) cred_path = os.path.join(cred_dir, "credentials.json") with open(cred_path, "w") as f: json.dump({ "api_key": data["api_key"],
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # ── Expand ~ in credential dir ──────────────────────────────────────────────── CREDENTIAL_DIR="${CREDENTIAL_DIR/#\~/$HOME}" CRED_FILE="$CREDENTIAL_DIR/credentials.json" # ── Check existing credentials ──────────────────────────────────────────────── if [ -f "$CRED_FILE" ]; then
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
sh # ── Expand ~ in credential dir ──────────────────────────────────────────────── CREDENTIAL_DIR="${CREDENTIAL_DIR/#\~/$HOME}" CRED_FILE="$CREDENTIAL_DIR/credentials.json" # ── Check existing credentials ──────────────────────────────────────────────── if [ -f "$CRED_FILE" ]; then
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The document tells the agent exactly where to find local credential files and later instructs it to read the API key from those paths for authenticated requests. Exposing credential locations inside a generally triggerable skill materially lowers the barrier for any prompt-injection or unintended invocation to coerce secret access and use of bearer tokens.
- Content
md | 环境 | 凭证路径 | |------|---------| | OpenClaw | `~/.openclaw/meyo/credentials.json` | | Hermes | `~/.hermes/meyo/credentials.json` | | 其他 / 未知 | `~/.meyo/credentials.json` |
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
This finding is part of the same credential-disclosure block that enumerates local secret storage locations. In context, the skill is not merely documenting configuration; it is operationalizing credential retrieval for subsequent authenticated network actions, which increases the chance of unauthorized secret access if the skill is activated improperly.
- Content
md | 环境 | 凭证路径 | |------|---------| | OpenClaw | `~/.openclaw/meyo/credentials.json` | | Hermes | `~/.hermes/meyo/credentials.json` | | 其他 / 未知 | `~/.meyo/credentials.json` | 凭证文件结构：
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
The continuation of the credential section includes the structure of the credentials file, revealing the exact secret fields available, including api_key and related identifiers. Providing both path and schema makes secret harvesting easier for a compromised or tricked agent, especially in a skill that also defines authenticated API usage patterns.
- Content
md |------|---------| | OpenClaw | `~/.openclaw/meyo/credentials.json` | | Hermes | `~/.hermes/meyo/credentials.json` | | 其他 / 未知 | `~/.meyo/credentials.json` | 凭证文件结构：
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill declares no explicit tool scope while instructing use of network access, shell execution, and file writes. That combination expands the effective privilege surface and prevents hosts or reviewers from constraining dangerous operations such as downloading scripts and persisting credentials.
- Content