Keep 数据查询

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:09 AM UTC
• Version: 1.0.5

Overview

This Keep health-data skill appears purpose-aligned, but it automatically runs install-time code, stores health-account credentials locally, and uses an unpinned SDK dependency, so it needs careful review before installation.

Install only if you trust the @keepclaw package, the Keep MCP endpoint, and the SDK dependency it pulls at install time. Be aware it can save your Keep token in ~/.keepai/.env, modify OpenClaw/Hermes skill directories on global install, and send install telemetry; avoid shared machines and clear or revoke the token when done.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: package.json:13

Finding

Unpinned dependency executes security-sensitive SDK code during installation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/persist_auth.js:23

Finding

Authentication JWT is passed through process command-line arguments

Content

View full analysis

a.startsWith(`--${name}=`)); if (inline) return inline.slice(name.length + 3); const idx = process.argv.findIndex((a) => a === `--${name}`); if (idx >= 0) return process.argv[idx + 1] || ""; return ""; } function main() { if (hasFlag("clear")) { const { cleared } = clearCredentials(); emit("auth_cleared", { cleared }); return; } const token = String(readArg("token") || "").trim(); const username = String(readArg("username") || "").trim(); if (!token) { emit("error", { message: "缺少 --token 参数（或使用 --clear 清除凭证）" }); process.exitCode = 1; return; } const exp = decodeJwtExp(token); const { username: persistedUsername } = persistCredentials({ token, exp, username }); emit("auth_persisted", { exp, username: persistedUsername || username }); } ``` The skill instructions prescribe placing the JWT directly in the command: ```bash node {baseDir}/scripts/persist_auth.js --token='' --username='' ``` ### Technical Analysis Although the script delegates storage to `persistCredentials`, the JWT first enters `process.argv`. Command-line arguments may be observable through: - Operating-system process inspection facilities while the command is running. - Process accounting or monitoring products. - Runner execution traces and diagnostic records. - Agent tool-call transcripts. - Shell debugging and command logging. - Error reports that capture complete invoked commands. Quoting the JWT prevents ordinary shell word splitting but does not make it confidential. The authentication documentation correctly warns against displaying the token to the user and ag ...[truncated 2138 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a query tool, but the documented workflow includes installation/deployment actions, writing configuration under ~/.keepai/.env, clearing credentials on URL change, and telemetry/reporting. Bundling setup, local file writes, and telemetry with a health-data skill increases the attack surface and can surprise operators, especially in environments that trust the declared purpose for risk decisions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a query tool, but the documented workflow includes installation/deployment actions, writing configuration under ~/.keepai/.env, clearing credentials on URL change, and telemetry/reporting. Bundling setup, local file writes, and telemetry with a health-data skill increases the attack surface and can surprise operators, especially in environments that trust the declared purpose for risk decisions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a query tool, but the documented workflow includes installation/deployment actions, writing configuration under ~/.keepai/.env, clearing credentials on URL change, and telemetry/reporting. Bundling setup, local file writes, and telemetry with a health-data skill increases the attack surface and can surprise operators, especially in environments that trust the declared purpose for risk decisions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This script persists and clears authentication credentials on the local filesystem, which is a privileged state-changing capability beyond the advertised read-only health-data query scope. Even if intended for convenience, storing tokens locally expands the attack surface: other local processes, misconfigured permissions, logs, backups, or later code paths could expose reusable credentials to an attacker.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README states that installation-time logic writes MCP server configuration into ~/.keepai/.env, and elsewhere describes postinstall telemetry and copying the package into runner skill directories. For a health-data query skill, install-time side effects and telemetry exceed the narrowly stated purpose and create an unnecessary trust and privacy boundary expansion, especially because health-related auth and configuration are involved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README documents writing server configuration and later health auth material to ~/.keepai/.env without an explicit privacy/safety warning to users. Storing tokens and service endpoints in a local env file is common, but for health-related data it raises confidentiality concerns if the file is reused by other tools, backed up insecurely, or read by local malware or other users.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README says the package copies the full skill bundle into runner skill directories during installation. Self-deployment into agent execution paths broadens the package's persistence and execution surface beyond simple querying, which is risky if the package is tampered with or if users do not expect code to be staged into runner-managed locations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list is broad enough to match common phrases like '看看', '最近', '这个月', and generic measurement terms, which can cause accidental invocation outside the user's intended context. For a skill that accesses sensitive health data and may initiate authentication, over-broad routing can leak private information into the wrong tool flow or prompt unnecessary login actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The login flow requires the exact Chinese fallback phrase “已完成扫码” as the continuation trigger, with no alternative language or user-choice mechanism. This creates a locale-specific requirement that may block or disadvantage users who are not operating in Chinese.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The tag list includes very generic trigger phrases such as “查询”, “查一下”, “看一下”, “统计”, “最近”, “趋势”, and “历史”, which can overlap with ordinary conversation unrelated to Keep health data. This can cause the skill to be selected too broadly, unnecessarily routing user requests involving sensitive health contexts or unrelated queries to an external MCP-backed skill endpoint.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The documentation recommends running npx -p @keepclaw/keep-query keep-query-unlink without a pinned version, which causes npm to fetch whatever package version is current at execution time. If the package is compromised, typo-squatted, or a malicious version is published, users could execute untrusted code during uninstall-related cleanup.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The description is written entirely in Chinese, which may impose a language-specific experience without indicating user opt-in or explaining that the skill is intended only for a Chinese-speaking locale. This can violate language/locale policy when no choice or justification is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly instructs the agent to persist a Keep authentication token to ~/.keepai/.env, but it does not require a clear user-facing disclosure or consent before storing credentials on disk. For a health-data skill, silently retaining long-lived auth material increases privacy and account-compromise risk if the host is shared, backed up insecurely, or later accessed by other local processes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The provided user-facing QR login template tells the user to scan and complete login but omits that doing so will persist their token locally for future automatic access. This undermines informed consent, especially because the skill accesses sensitive health information and the user may reasonably assume the login is temporary for the current session only.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This skill is explicitly designed to retrieve highly sensitive health, body, and lifestyle data such as weight, sleep, diet, and menstrual records, yet the guidance contains no user-facing privacy notice, sensitivity acknowledgment, or caution about displaying such data. In a health-data context, silent retrieval and presentation of sensitive information increases the risk of privacy harm, shoulder-surfing exposure, and user surprise, especially when the agent is asked to surface recent personal metrics without any disclosure or confirmation step.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documented design explicitly recommends writing login tokens into ~/.keepai/.env for later reuse, but that capability is not justified by a simple health-data query skill. For a skill handling sensitive health data, unnecessary credential retention increases privacy and account-compromise risk if the host is shared, backed up insecurely, or inspected by other software.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The postinstall script performs network telemetry and filesystem deployment actions that are unrelated to the declared purpose of a health-data query skill. Running these behaviors automatically at install time expands the package's privilege surface, creates hidden side effects, and can expose users to tracking or unauthorized modification of local runner environments without explicit consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The install-time telemetry call sends package metadata to a remote service during installation, which is not necessary for a read/query health-data skill to function. Even if only version and source are sent, the behavior creates undisclosed outbound communication, enables user or environment tracking, and normalizes data collection from a package handling health-related workflows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script automatically copies the package into OpenClaw and Hermes skill directories on global install, forcibly overwriting managed directories and bundling dependencies to make execution self-contained. This is dangerous because it modifies other local execution environments without an explicit user action, creating persistence and a supply-chain foothold that exceeds the expectations for a simple health-data query capability.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README says the package copies the full skill bundle into runner skill directories during installation. Self-deployment into agent execution paths broadens the package's persistence and execution surface beyond simple querying, which is risky if the package is tampered with or if users do not expect code to be staged into runner-managed locations.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

This manifest describes the skill's purpose in broad natural language but does not specify how or when it should be invoked, nor any constraints or exclusions. For manifest files, that can create ambiguity around activation scope if the description is used for routing or discovery.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Using an unpinned dependency version ("*") creates a supply-chain risk: any newly published version of @keepclaw/skill-sdk could be installed automatically, including a compromised or malicious release. This is more dangerous in a health-data query skill because the dependency may gain access to sensitive user data flows, and the package also defines a postinstall script elsewhere in the manifest, increasing installation-time risk if the dependency tree is abused.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json

"registry": "https://registry.npmjs.org/"
  },
  "dependencies": {
    "@keepclaw/skill-sdk": "*"
  },
  "files": [
    "SKILL.md",

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file's human-readable comments are written in Chinese and do not offer any language choice or indicate that the locale is intentionally restricted. Under the policy for natural-language content, forcing a specific language without user opt-in is a locale/language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.