T03 · Remote Payload Retrieval and Execution
Error
- Location
install.sh:5- Finding
Remote Shell Script Is Executed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
稻哲纪烤羊排
Security checks for vulnerabilities and agentic risk
Overview
This restaurant customer-service skill is mostly informational, but its installers add unattended daily self-updates from GitHub and can overwrite local skill files, so it needs review before installation.
Install only if you are comfortable with a daily self-updater that pulls future changes from the publisher's GitHub repository. Prefer manual installation from a reviewed, version-pinned archive, remove or skip the cron/scheduled-task updater, and back up any existing daozheji-grill skill directory before installing.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)
T03 · Remote Payload Retrieval and Execution
Error
- Location
install.ps1:4- Finding
Remote PowerShell Script Is Executed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
T06 · System Persistence
Error
- Location
install.sh:47- Finding
Unix Installer Establishes Unattended Daily Update Persistence
- Content
View full analysis
/dev/null || git pull --ff-only origin master 2>/dev/null" if ! crontab -l 2>/dev/null | grep -q "daozheji-grill"; then (crontab -l 2>/dev/null; echo "7 3 * * * $UPDATE_CMD") | crontab - echo "Automatic updates configured (daily at 3:07)" fi ``` ### Technical Analysis The installer modifies the user's crontab and creates an unattended job that pulls content from mutable `main` or `master` branches every day. The update is not pinned to an approved version and performs no signature, checksum, or policy verification. This creates cross-session persistence and a continuing upstream control channel. Content that was safe when audited can be replaced after installation and automatically propagated to the local Skill directory. OS-level scheduling is unnecessary for a static restaurant information Skill and exceeds the minimum privileges needed for its declared functionality. The installer does not ask for informed consent before changing the user's crontab and does not provide an uninstall or update-disable command. ### Attack Path 1. A user installs the currently reviewed, apparently benign Skill. 2. The installer adds a daily cron job. 3. At a later time, an attacker compromises the upstream repository or maintainer account. 4. The attacker commits modified Skill instructions or executable content to `main` or `master`. 5. At 03:07, the cron job runs `git pull` and retrieves the modified content. 6. OpenClaw subsequently loads the attacker-controlled Skill content. ### Impact Assessment The mechanism allows persistent modification of the Skill across sessions. An attacker controlling upstream content could alt ...[truncated 262 chars]- Remediation
View remediation
T06 · System Persistence
Error
- Location
install.ps1:40- Finding
Windows Installer Establishes Unattended Daily Scheduled-Task Persistence
- Content
View full analysis
`$null; if (`$LASTEXITCODE -ne 0) { git pull --ff-only origin master 2>`$null }`"" -WorkingDirectory $SkillPath $Trigger = New-ScheduledTaskTrigger -Daily -At 03:07 Register-ScheduledTask -TaskName $TaskName -Action $Action -Trigger $Trigger -Description "Daozheji Grill Skill automatic update" | Out-Null Write-Host "Automatic updates configured (daily at 3:07)" -ForegroundColor Green } ``` ### Technical Analysis The installer registers a Windows scheduled task that runs PowerShell every day and pulls mutable repository branches. No approved-version policy, cryptographic signature, or integrity check is applied before new content is accepted. The task survives installation and ordinary Skill use, creating persistence beyond the declared customer-service functionality. A later repository compromise can therefore affect already-installed systems without further user interaction. ### Attack Path 1. A user runs the installer, which creates `DaozhejiGrillSkillUpdate`. 2. The scheduled task remains registered across sessions and reboots. 3. An attacker later compromises the repository or its maintainer. 4. Malicious or manipulated Skill content is pushed to `main` or `master`. 5. The scheduled PowerShell action automatically pulls that content. 6. The modified Skill is loaded during later Agent interactions. ### Impact Assessment The task provides a durable supply-chain delivery mechanism operating with the scheduled user's permi ...[truncated 214 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
install.sh:12- Finding
Environment-Controlled Unix Path Is Embedded Unsafely in a Persistent Shell Command
- Content
View full analysis
/dev/null || git pull --ff-only origin master 2>/dev/null" if ! crontab -l 2>/dev/null | grep -q "daozheji-grill"; then (crontab -l 2>/dev/null; echo "7 3 * * * $UPDATE_CMD") | crontab - fi ``` ### Technical Analysis `SKILLS_DIR` can be supplied through the process environment and becomes part of `SKILL_PATH`. That path is then inserted into a cron command without shell-safe quoting or validation. Because cron interprets the resulting line through a shell, shell metacharacters in the configured path can modify the command structure. Even benign paths containing spaces can break the `cd` command. Exploitation requires influence over the installation environment, so the issue is less severe than the unconditional persistence mechanism, but it creates a concrete command-injection surface. ### Attack Path 1. An attacker or untrusted wrapper controls the `SKILLS_DIR` environment variable used when the installer runs. 2. The value contains shell syntax that becomes part of `SKILL_PATH`. 3. The installer writes the unquoted value into the user's crontab. 4. At the scheduled time, cron passes the line to a shell. 5. The injected shell syntax executes with the scheduled user's permissions. ### Impact Assessment Successful exploitation permits arbitrary shell command execution as the user whose crontab was modified. This could expose or alter any files accessible to that user, including OpenClaw workspace data. The command may also fail accidentally when installation paths contain whitespace or special characters. ]]>- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
install.ps1:10- Finding
Environment-Controlled Windows Path Is Embedded in a PowerShell Command String
- Content
View full analysis
`$null; if (`$LASTEXITCODE -ne 0) { git pull --ff-only origin master 2>`$null }`"" -WorkingDirectory $SkillPath ``` ### Technical Analysis The installer accepts `SKILLS_DIR` from the environment and incorporates the derived path into a PowerShell `-c` command string. Wrapping the path in single quotes is insufficient if the value itself contains a single quote or other crafted PowerShell syntax. An attacker able to influence the installer environment could alter the command parsed by the scheduled PowerShell process. The issue also creates reliability problems for unusual but legitimate path values. ### Attack Path 1. An attacker or untrusted deployment wrapper supplies a crafted `SKILLS_DIR` environment value. 2. The installer derives `$SkillPath` from that value. 3. `$SkillPath` is embedded inside the scheduled task's PowerShell command text. 4. The scheduled task starts PowerShell with the constructed `-c` argument. 5. PowerShell parses and executes injected syntax with the task user's permissions. ### Impact Assessment Successful exploitation could provide arbitrary PowerShell execution as the scheduled user, allowing access to that user's files, OpenClaw workspace, and available credentials. Scope may be greater if installation or task registration occurs in an elevated context. ]]>- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (25)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a restaurant customer-service skill focused on answering informational queries. However, the supplied code does not implement any customer-service or question-answering behavior. Instead, it performs system-level installation and persistence tasks: creating directories, cloning a repository, overwriting an existing directory, and adding a cron-based auto-update job. These are materially different capabilities from the declared end-user purpose and include undeclared access to local files, remote code retrieval, and scheduled task configuration. While installation logic can support a skill, this code chunk by itself is not behaviorally aligned with the declared restaurant-info functionality.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script creates a Windows scheduled task that runs PowerShell and performs recurring git pulls, giving the skill a persistent mechanism to execute future repository changes. In the context of a simple customer-service skill, this capability is disproportionate and increases the risk of unauthorized code delivery if the repository is compromised or later modified.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Using 'curl ... | bash' chains remote content retrieval directly into shell execution, enabling immediate arbitrary command execution if the remote script or distribution path is tampered with. This is especially concerning because the same installer also creates persistence and auto-update behavior, increasing the consequences of compromise.
- Content
sh # 稻哲纪烤羊排 Skill · 一键安装脚本 # ============================================================ # 用法（客户只需运行这一行）： # curl -sSL https://raw.githubusercontent.com/Liubuq-sys/daozheji-grill-skill/main/install.sh | bash # ============================================================ set -e
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The installer unconditionally deletes an existing target directory if it is not a git checkout, without prompting or backing up contents. This can cause destructive loss of user data or overwrite unrelated files if the path already contains custom content.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list includes generic food terms such as “羊排” and “烧烤”, which are likely to appear in ordinary restaurant or cooking conversations unrelated to this brand. That can cause unintended invocation, misrouting user requests, and broadening the skill’s effective scope beyond the intended business domain.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description says the skill triggers when the user asks about '任何信息' related to the restaurant, which sets a very loose boundary and encourages over-activation. In an agent environment, broad routing conditions can capture ambiguous user requests, leading to incorrect context injection and reduced reliability or privacy handling if unrelated conversations are misrouted.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger table includes extremely broad keywords such as “送”, “价”, “在哪”, and “有什么”, which commonly appear in unrelated conversations. This can cause accidental activation, making the agent answer in the restaurant persona outside intended context and potentially override or interfere with more relevant skills or system behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
If the destination skill path already exists, the installer forcibly deletes it with Remove-Item -Recurse -Force and gives no upfront warning or backup behavior. This can cause unintended data loss, especially if the directory contains local modifications or if the path has been repointed unexpectedly.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The installer establishes persistence by creating a daily scheduled task that silently pulls and updates code after installation. For a restaurant information skill, this exceeds the stated function and creates an ongoing code-execution/update channel that could later deliver changed or malicious content without the user's informed consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The installer registers a daily scheduled task without any prior warning, prompt, or meaningful disclosure to the user. Silent persistence is dangerous because it alters system behavior and enables ongoing remote code updates in a way users may not notice or understand.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The installer silently establishes a persistent cron job that continues executing after installation, which exceeds the expected behavior of a restaurant information skill. Persistence plus unattended remote updates creates an ongoing trust channel to repository content, so any future repo compromise or unexpected change will run automatically on the user's system.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Modifying the user's crontab grants the skill persistence capabilities unrelated to its stated restaurant-customer-service purpose. In this context, the capability is disproportionate and increases risk because the skill can keep changing itself over time without user review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script modifies the user's crontab without prior consent, creating persistence and unattended execution. This is dangerous because it changes the host's scheduled tasks and continuously pulls remote code, a capability not expected for a restaurant information skill.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 97% confidence
- Finding
The cron check is part of establishing session persistence via the user's crontab. Persistence is risky here because the skill is unrelated to system maintenance, and the scheduled task repeatedly executes update logic tied to a remote repository.
- Content
sh # 配置自动更新（追加到 crontab，不重复添加） UPDATE_CMD="cd $SKILL_PATH && git pull --ff-only origin main 2>/dev/null || git pull --ff-only origin master 2>/dev/null" if ! crontab -l 2>/dev/null | grep -q "daozheji-grill"; then (crontab -l 2>/dev/null; echo "7 3 * * * $UPDATE_CMD") | crontab - echo "自动更新已配置（每天 3:07）" fi
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 98% confidence
- Finding
This line installs a recurring cron entry, creating persistent execution on the user's machine. In the context of a restaurant-info skill, that persistence is unjustified and expands the blast radius of any future repository compromise or unintended update.
- Content
sh # 配置自动更新（追加到 crontab，不重复添加） UPDATE_CMD="cd $SKILL_PATH && git pull --ff-only origin main 2>/dev/null || git pull --ff-only origin master 2>/dev/null" if ! crontab -l 2>/dev/null | grep -q "daozheji-grill"; then (crontab -l 2>/dev/null; echo "7 3 * * * $UPDATE_CMD") | crontab - echo "自动更新已配置（每天 3:07）" fi
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Line 56 tells the user to invoke the skill using only the Chinese phrase 「稻哲纪烤羊排」. This is a natural-language locale constraint with no opt-in or alternative language option, which can violate language-choice policy.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all user-facing content only in Chinese, and nowhere indicates that the skill is China/Chinese-specific or that users can opt into another language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The natural-language content from L05 through L13 is entirely Chinese, and the file does not indicate that the skill is region-specific or that users can choose another language. Under the policy rule for language or locale constraints, this can be considered a language-forcing behavior without explicit opt-in or justification.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README defines the skill entirely in Chinese and instructs the assistant to adopt a specific Chinese conversational style using terms like "咱家" and "哥/姐". There is no indication that the user can choose another language or opt into this locale/style, which may conflict with language or locale policy requirements.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The final instruction tells the user to trigger the skill by saying a specific Chinese phrase, implying a fixed language activation requirement. There is no indication that alternative languages are supported or that the Chinese-only trigger is a justified locale-specific design.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script is presented as a simple one-click installer, but it also configures persistent automatic updates. That mismatch undermines informed consent and can mislead users into executing actions they did not expect, which is especially concerning when combined with remote code retrieval and cron persistence.
- Content
External Script Fetching
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The documented install method fetches a script directly from the network and executes it, which removes the user's opportunity to inspect the code first. While common, this pattern is unsafe because any compromise of the source, transport endpoint, or referenced branch immediately affects installers.
- Content
sh # 稻哲纪烤羊排 Skill · 一键安装脚本 # ============================================================ # 用法（客户只需运行这一行）： # curl -sSL https://raw.githubusercontent.com/Liubuq-sys/daozheji-grill-skill/main/install.sh | bash # ============================================================ set -e
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The entire skill file presents business information exclusively in Chinese, with no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in can constitute a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown file presents all service information in Chinese and does not indicate that the user can select another language or that the content is intentionally limited to a Chinese-language audience. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale policy concern.
- Content
Static analysis
No suspicious patterns detected.