migu-ai-guide

• Outcome: Pass
• Latest audit: Sep 30, 2026 · 8:24 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Migu AI guide client that sends user questions or selected images to Migu's service using a user-provided JWT, with no evidence of hidden execution, exfiltration, or destructive behavior.

Install only if you are comfortable giving this skill a Migu JWT and sending guide questions or selected images to gulangyu.migudm.cn. Treat the JWT like a password, avoid sharing it in chat logs or screenshots, restrict access to the saved token file, delete or rotate it when finished, and do not upload private images unless you intend to transmit them to the remote service.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

OpenClaw 里不要使用交互终端。每次用户请求都执行一次 `scripts/migu_ai_guide_client.mjs`。

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill documents network access, environment-variable token loading, local file access, and credential handling, but it declares no explicit tool scope or permissions boundary. This increases the chance that the runtime grants broader-than-expected capabilities and makes it harder for reviewers and users to understand that the skill can read secrets and send data off-host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs users to upload local images and send JWT-authenticated requests to a remote service, but it does not provide a clear privacy warning about what data leaves the machine or that uploaded images may contain sensitive metadata/content. In this context, users could unknowingly transmit personal photos, location data, or proprietary information to a third-party endpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill tells users to extract JWTs from browser traffic and save them locally, but it does not clearly emphasize that these tokens are sensitive bearer credentials that can grant account access if exposed. Storing or piping such tokens without strong warnings, secure storage guidance, and least-retention handling materially increases the risk of credential theft or accidental leakage.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

The --no-bearer option disables the Authorization header while the client still places the JWT in the WebSocket URL query string via buildUrl(). Query-string tokens are more likely to be exposed through logs, proxies, error messages, browser/debug tooling, and intermediary telemetry, so this option creates a less safe authentication mode and can encourage credential leakage without a strong need.

Content

Scanner excerpt · scripts/migu_ai_guide_client.mjs (reported line 196)May include surrounding context.

js

args.saveTokenFile = next();
        break;
      case "--no-bearer":
        args.bearerAuth = false;
        break;
      case "--bearer":
        args.bearerAuth = true;

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script places the token in the WebSocket URL query string and then opens a remote WebSocket connection that transmits user questions and prompts. There is no user-facing disclosure in normal execution warning that authentication data and user-provided content are being sent to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code reads a local image file and posts its contents to a remote HTTPS endpoint using the provided bearer token. While the behavior is functionally necessary, the script provides no user-facing notice at upload time unless verbose mode is enabled, and there is no inline comment or docstring warning that local file data will be transmitted externally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description states that the skill generates Chinese narration from uploaded images, which imposes a specific language behavior. Because no user language choice or opt-in is offered, this appears to violate the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The example question text is written in Chinese ("介绍成都"), which suggests the skill or request format may assume a fixed language context. Because the file does not indicate that language selection is optional or user-configurable, this can conflict with policies against forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Using "latest" for the ws dependency makes builds non-reproducible and allows future upstream releases to change behavior or introduce a vulnerable or malicious version without any code change in this repository. In a skill that handles WebSocket connections and token-related logic, silently pulling a new dependency version increases supply-chain risk and can affect runtime security or stability.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json

"check": "node --check scripts/migu_ai_guide_client.mjs"
  },
  "dependencies": {
    "ws": "latest"
  }
}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The usage examples and default prompt strings are written in Chinese, including defaults like "讲解图片中的内容" and example queries such as "介绍成都", with no indication that users may choose another language. This can be a locale policy issue because the skill implicitly steers interaction into a specific language without explicit opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.