Fund Operation Workflow

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:39 AM UTC
• Version: 2.0.0

Overview

The core skill is mostly workflow guidance, but it needs review because it recommends an unverified remote installer and includes a separate WeChat/Feishu marketing funnel that tracks user identity and activity beyond the stated fund-workflow purpose.

Review before installing. Prefer using the Markdown prompt templates directly or a verified OpenClaw installer instead of piping a remote script into bash. Treat registration, WeChat, Feishu, GitHub Issue posting, screenshots, referrals, and community signup as optional, and do not submit client data, regulated financial information, credentials, internal business details, or personal contact information unless the operator provides a clear privacy notice and deletion process.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: GITHUB_README.md:49

Finding

Unverified Remote Installer Is Downloaded and Executed Directly

Content

View full analysis

Vulnerability Details

File Locations:

• GITHUB_README.md:49-57
• WECHAT_FUNNEL_SOP.md:179-188

Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Critical

Vulnerable Code:

From GITHUB_README.md:49-57:

bash

# 1. Install OpenClaw
curl -fsSL https://openclaw.ai/install.sh | bash

# 2. Install the Skill
clawhub install fund-operation-workflow

# 3. Use the Skill
@ant use the fund-operation-workflow skill to create an annual operations plan

The same installation sequence appears in WECHAT_FUNNEL_SOP.md:179-188:

bash

Installation tutorial

Method 1: OpenClaw and ClawHub (recommended)

Step 1: Install OpenClaw
curl -fsSL https://openclaw.ai/install.sh | bash

Step 2: Install the Skill
clawhub install fund-operation-workflow

Technical Analysis

The command pipes content retrieved from a mutable external URL directly into Bash. The downloaded script is not pinned to a version or immutable artifact, and the instructions do not require checksum validation, signature verification, local inspection, or confirmation before execution.

Consequently, the code actually executed can change after this Skill has been reviewed. HTTPS protects the connection under normal conditions but does not establish that the current server-side script is safe or unchanged. Compromise of the website, hosting account, release process, DNS infrastructure, or signing credentials could turn the documented command into an arbitrary-code execution channel.

This behavior exceeds the minimum privileges required for the declared Skill functionality. The project consists of Markdown workflow guidance and prompt templates and explicitly supports direct use of those templates without installing OpenClaw. Remote shell execution is therefore not necessary to access the core functionality.

The repository does not contain the remote install.sh, so this static audit cannot determine its current actions or establish that it is malicious ...[truncated 1559 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all curl ... | bash installation instructions.
2. Prefer direct use of the included Markdown templates, which does not require executing an installer.
3. If software installation is necessary:
   • Publish versioned, immutable release artifacts.
   • Pin documentation to a specific release version.
   • Publish a SHA-256 or stronger digest through an independently protected channel.
   • Sign releases and document signature verification.
   • Require users to download the artifact to disk, verify it, and inspect it before execution.
4. Use a trusted package manager with signed metadata and version pinning where available.
5. Document exactly which files, directories, network endpoints, and permissions the installer uses.
6. Ensure installation works without administrator privileges and explicitly warn users not to use sudo unless a narrowly defined operation requires it.
7. Apply the corrected instructions consistently in both GITHUB_README.md and WECHAT_FUNNEL_SOP.md.
8. Add automated documentation checks that reject shell-piped remote execution commands.

other

Warning

• Location: WECHAT_FUNNEL_SOP.md:333

Finding

Ancillary Funnel Collects Excessive Identity and Activity Data

Content

View full analysis

Vulnerability Details

File Locations:

• WECHAT_FUNNEL_SOP.md:333-350
• WECHAT_FUNNEL_SOP.md:353-365

Vulnerability Type: other: Excessive Personal Data Collection
Risk Level: Medium

Vulnerable Configuration:

User registration fields in WECHAT_FUNNEL_SOP.md:333-350:

markdown

| Field | Type | Required | Purpose |
|--------|------|----------|---------|
| Registration time | Date | Automatic | Recorded automatically |
| WeChat ID | Text | Yes | Used for contact |
| Nickname | Text | Yes | Display name |
| Company type | Single choice | No | Public fund/private fund/third party/other |
| Position | Single choice | No | Operations/product/technical/other |
| Usage scenario | Multiple choice | Yes | Annual planning/competitor analysis/copywriting, etc. |
| Usage frequency | Single choice | Yes | Daily/weekly/monthly |
| Time saved | Number | No | Hours/week |
| Effectiveness score | Number | Yes | 1-5 stars |
| Improvement suggestions | Text | No | Free-form response |
| Join community | Single choice | No | Yes/no |
| Contact details | Text | No | Phone/email |
| Benefit package sent | Single choice | Automatic | Sent/not sent |
| One-to-one guidance | Single choice | No | Scheduled/completed/not needed |
| Source channel | Single choice | Yes | Official account/Moments/group chat/other |

Activity-tracking fields in WECHAT_FUNNEL_SOP.md:353-365:

markdown

| Field | Type | Description |
|-------|------|-------------|
| User ID | Relation | Linked to the user registration table |
| Added WeChat | Date | Completion time |
| Downloaded Skill | Date | Completion time and screenshot |
| GitHub Star | Date | Completion time and screenshot |
| Usage registration | Date | Completion time |
| Usage feedback | Text | Feedback content |
| Case sharing | Text | Case content |
| Moments sharing | Date | Screenshot |
| Referred colleague | Text | Referred person |
| Accumulated points | Number | Used to redeem gifts |
| Gift delivery | Single 
...[truncated 2878 chars]

Remediation

View remediation

Remediation Suggestions

1. Separate the Skill’s core download and use from marketing registration and ensure all tracking remains optional.
2. Remove WeChat ID, nickname, screenshots, social-sharing evidence, and referred-colleague details unless each field has a documented and necessary purpose.
3. Do not collect information about referred people without their direct notice and consent.
4. Collect aggregate or pseudonymous feedback instead of linked identity and activity histories.
5. Avoid making usage frequency, effectiveness ratings, acquisition source, or similar analytics mandatory.
6. Publish a privacy notice before collection that specifies:
   • Data controller and contact details.
   • Exact purposes and legal basis.
   • Required and optional fields.
   • Recipients and third-party processors.
   • Retention periods.
   • Deletion, correction, and withdrawal procedures.
   • Cross-platform or cross-border processing, where applicable.
7. Restrict table access by role, enable audit logging and multifactor authentication, and prohibit public-link sharing.
8. Encrypt sensitive exports and backups and establish a documented deletion schedule.
9. Do not condition access to materials already present in the repository on disclosure of personal information.
10. Review the implemented collection flow with privacy and compliance personnel before deployment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (27)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The README instructs users to fetch and immediately execute a remote shell script via curl piped to bash. If the remote host, script, CDN, DNS, or transport path is compromised, users could execute arbitrary code on their systems without reviewing it first. In skill distribution context, this is especially risky because users may treat setup steps as trusted boilerplate and run them verbatim.

Content

Scanner excerpt · GITHUB_README.md (reported line 53)May include surrounding context.

bash

# 1. 安装 OpenClaw
curl -fsSL https://openclaw.ai/install.sh | bash

# 2. 安装技能
clawhub install fund-operation-workflow

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The explicit use of '| bash' removes any opportunity for user review before execution and turns a documentation step into direct code execution from a network source. This pattern is commonly abused for supply-chain compromise and makes any compromise of the upstream script immediately result in local command execution. Because this appears in a skill README, users following setup instructions are primed to trust and run it, increasing practical exploitability.

Content

Scanner excerpt · GITHUB_README.md (reported line 53)May include surrounding context.

bash

# 1. 安装 OpenClaw
curl -fsSL https://openclaw.ai/install.sh | bash

# 2. 安装技能
clawhub install fund-operation-workflow

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The GitHub Issue registration method encourages users to post usage details and optionally contact information in a public repository, but it does not explicitly warn that GitHub issues are public and searchable. This can expose sensitive business context, employer information, and personal contact data to anyone on the internet, making the risk materially higher than a private feedback form.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file's actual behavior is a detailed lead-generation, user acquisition, and retention SOP for WeChat, which materially diverges from the declared purpose of a fund-operation workflow skill. This mismatch is dangerous because it can covertly repurpose the skill into a growth-tracking funnel, increasing the likelihood of deceptive deployment, unauthorized data collection, and misuse beyond user expectations.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The document instructs users to execute a remotely fetched shell script directly from the network. This is dangerous because any compromise of the remote host, DNS, TLS termination, or upstream content can result in arbitrary code execution on the user's machine with the privileges of the shell.

Content

Scanner excerpt · WECHAT_FUNNEL_SOP.md (reported line 184)May include surrounding context.

md

【方式 1：OpenClaw + ClawHub（推荐）】

步骤 1：安装 OpenClaw
curl -fsSL https://openclaw.ai/install.sh | bash

步骤 2：安装技能
clawhub install fund-operation-workflow

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Piping remote content directly into bash removes the user's opportunity to inspect what will run and enables trivial command chaining into arbitrary execution. In a skill distribution context, this meaningfully elevates supply-chain and social-engineering risk because users are being coached to run opaque code as part of onboarding.

Content

Scanner excerpt · WECHAT_FUNNEL_SOP.md (reported line 184)May include surrounding context.

md

【方式 1：OpenClaw + ClawHub（推荐）】

步骤 1：安装 OpenClaw
curl -fsSL https://openclaw.ai/install.sh | bash

步骤 2：安装技能
clawhub install fund-operation-workflow

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file uses a single forced language throughout and does not provide any user opt-in, alternative locale, or statement that the skill is intentionally restricted to Chinese-speaking users. Under the natural-language policy rule, forcing a specific language without user choice is a policy concern unless clearly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

整份快速启动指南完全以中文编写，且未说明是否支持其他语言、是否可按用户偏好切换，调用示例也默认中文输入。若该技能面向更广泛用户群，这种未声明的单一语言约束可能构成语言选择上的自然语言策略问题。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to overlap with ordinary user requests, which can cause the skill to activate when the user did not explicitly intend to invoke it. In a workflow skill tied to fund operations, mis-triggering can route users into specialized prompts, role-mapping, or process guidance that is irrelevant or potentially risky in regulated contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README solicits usage registration through WeChat, Feishu, GitHub Issues, and a usage-tracking document, but it does not clearly warn users not to submit sensitive organizational, customer, or regulated financial information. In a fund-operations context, users may reasonably share business workflow details, compliance artifacts, or contact data, creating unnecessary privacy, confidentiality, and potential regulatory exposure.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description blends usage scenarios and invocation conditions without clearly stating when the skill must not trigger. Ambiguous boundaries increase the chance of accidental activation, especially because the skill spans business workflow design, MBTI-based assignment, and compliance prompting, which may not always be appropriate or desired.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

L255 明确要求“用中文”，属于固定语言要求，但文档未说明该技能仅面向中文用户，也未给出用户可选择其他语言的选项。按照语言/locale 政策，这种未获用户选择的强制语言约束应视为自然语言政策问题。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The registration flow asks for company, role, usage scenario, and feedback while directing users to WeChat, Feishu, and GitHub, but it does not present a clear upfront privacy notice covering what data is collected, who can access it, how long it is retained, or how it will be used. This creates a social-engineering and privacy risk because users may disclose personal or employer-linked information through third-party platforms without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The workflow asks users to add WeChat, submit screenshots, complete registration, and perform tracked tasks in exchange for rewards, but it does not present any privacy notice, consent language, or explanation of how personal data will be used. This is dangerous because users may disclose identifiers and activity evidence without understanding storage, sharing, retention, or follow-up contact implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The auto-reply flow directs users into registration and community enrollment paths while normalizing ongoing contact and group invitation without an upfront disclosure of these consequences. This can manipulate users into a marketing and social funnel they did not fully consent to, especially when framed as necessary to unlock benefits.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The included tables operationalize user profiling, behavioral tracking, reward progression, and retention management that are not necessary for constructing a fund-operation workflow. This creates an unjustified collection-and-tracking surface, enabling overcollection of personal and engagement data that could be repurposed for surveillance, targeted outreach, or pressure-based growth tactics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown skill file consistently instructs and exemplifies usage only in Chinese, with no indication that users may select another language. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The entire prompt template, examples, and instructions are written exclusively in Chinese, and the skill repeatedly instructs the model in that language without any opt-in or alternative locale guidance. Under the policy, language constraints should either be optional for the user or clearly justified as region-specific; this file does not explicitly state such a justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire prompt template and its role instructions are written exclusively in Chinese, with no indication that users may choose another language or that Chinese is required for a specific regulated regional use case. Under the policy rule for natural-language violations, this constitutes a language/locale restriction without explicit user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file’s title and embedded prompt content are entirely framed in Chinese and instruct the model role in that locale, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The entire skill prompt, role definitions, inputs, and outputs are written as Chinese-only instructions, and nowhere does it state that the user may choose another language. Under the policy criteria, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This markdown file is entirely written in Chinese and does not indicate that language selection is optional or configurable. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale/language policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The README is entirely in Chinese and presents commands, workflow guidance, and support/registration instructions only in that language. Under the stated policy, forcing a specific language without explicit opt-in or justification can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description blends usage scenarios and invocation conditions without clearly stating when the skill must not trigger. Ambiguous boundaries increase the chance of accidental activation, especially because the skill spans business workflow design, MBTI-based assignment, and compliance prompting, which may not always be appropriate or desired.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

A file-wide natural-language policy issue exists because the skill documentation forces a single language presentation with no opt-in or alternative locale guidance. Under the stated policy, language constraints should either offer user choice or be explicitly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.