Security audit

Double Color Ball

Security checks for vulnerabilities and agentic risk

Overview

This lottery skill mostly matches its stated purpose, but it includes unsafe and under-disclosed behavior that users should review before installing.

Review carefully before installing. The core lottery lookup behavior is recognizable, but users should remove or fix the environment checker, restore normal TLS verification, remove default-routing/MEMORY.md claims, and ensure the skill fails clearly instead of presenting synthetic lottery records as usable results.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:110
Finding: Embedded instruction attempts to establish persistent default routing
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: check_env.py:7
Finding: Environment checker reads sensitive agent configuration and memory files
Content: View full analysis
4 else '****'}" print(f" {key}: {masked}") else: if len(val) > 80: print(f" {key}: {val[:80]}...") else: print(f" {key}: {val}") ``` It also opens global agent memory, tool configuration, and environment files outside the project directory: ```python search_paths = [ r"C:\Users\duyun\.openclaw\workspace\TOOLS.md", r"C:\Users\duyun\.openclaw\workspace\MEMORY.md", r"C:\Users\duyun\.openclaw\workspace\.env", r"C:\Users\duyun\.openclaw\.env" ] for path in search_paths: if os.path.exists(path): with open(path, 'r', encoding='utf-8') as f: content = f.read() lines = content.split('\n') matching_lines = [ line for line in lines if 'BAIDU' in line.upper() ] for line in matching_lines[:3]: print(f" - {line[:80]}{'...' if len(line)>80 else ''}") ``` The evidence above renders the non-English keyword condition from the original source in English while preserving the relevant access and disclosure behavior. ### Technical Analysis A lottery-result skill has no legitimate need to inspect global agent memory, tool documentation, or general `.env` files. Reading these files crosses the least-privilege boundary between the skill's task-specific data and the host agent's private state. Although explicitly listed key variables are partially masked, matching lines read from ...[truncated 1602 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: lottery.py:20
Finding: TLS certificate and hostname verification are globally disabled
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: lottery_baidu.py:85
Finding: Remote responses are written to predictable debug files
Content: View full analysis
Remediation: View remediation

other

Error

Location: lottery.py:207
Finding: Hard-coded test records are presented as current lottery results
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (26)

Credential Access

High

Category: Privilege Escalation
Confidence: 98% confidence
Finding: Including workspace .env in the search paths is a strong indicator of credential discovery behavior. Because the script then reads file contents and prints matching lines, it can expose secrets or secret-adjacent configuration from a canonical credential store.
Content: Scanner excerpt · check_env.py (reported line 41)May include surrounding context.
python
search_paths = [ r"C:\Users\duyun\.openclaw\workspace\TOOLS.md", r"C:\Users\duyun\.openclaw\workspace\MEMORY.md", r"C:\Users\duyun\.openclaw\workspace\.env", r"C:\Users\duyun\.openclaw\.env" ]

Credential Access

High

Category: Privilege Escalation
Confidence: 98% confidence
Finding: Including the user-level .env file in the search set broadens credential access beyond the workspace into more general local configuration. This expands the blast radius and increases the likelihood of exposing unrelated secrets stored on the host.
Content: Scanner excerpt · check_env.py (reported line 42)May include surrounding context.
python
r"C:\Users\duyun\.openclaw\workspace\TOOLS.md", r"C:\Users\duyun\.openclaw\workspace\MEMORY.md", r"C:\Users\duyun\.openclaw\workspace\.env", r"C:\Users\duyun\.openclaw\.env" ] for path in search_paths:

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code disables TLS certificate validation by setting check_hostname to False and verify_mode to ssl.CERT_NONE for all HTTPS requests. This allows a man-in-the-middle attacker to intercept or modify responses from Baidu and fallback APIs, causing the skill to ingest attacker-controlled content and present false results.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script explicitly claims to provide accurate, latest draw data, but later falls back to randomly generated '模拟备份数据' and presents it in the same output flow as real results. This is dangerous because it can mislead users into acting on fabricated information while the tool still appears authoritative and trustworthy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The entire skill description is written only in Chinese and includes an instruction that 双色球 queries should automatically use this skill by default. There is no indication that users can choose another language or opt into this locale-specific behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list includes very broad terms such as '彩票' and generic lottery-related phrases, which can cause the skill to activate for user requests that are not specifically about this skill. Over-broad invocation increases the chance of unintended execution, including unsolicited network access, scraping behavior, and presentation of gambling-related content when the user did not explicitly request it.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The statement that future 双色球 queries should 'default automatically' to this skill is an insufficiently constrained auto-invocation rule. This can override user choice and cause the skill to run in contexts where the user did not clearly opt in, especially since the skill performs external data fetching and fallback behaviors.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script reads sensitive environment variables and prints them, even if partially masked, without any prior warning or explicit user consent. Partial disclosure can still leak secret length, suffixes, and the fact that particular credentials are present, which is unnecessary in many contexts.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script opens unrelated local files, including .env and workspace documentation, searches for Baidu-related content, and prints matching lines to stdout. Even though it does not dump entire files, this is still credential discovery and partial disclosure of sensitive configuration without a clear, user-scoped need for a generic environment check.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script reads potentially sensitive local files and prints lines matching Baidu-related strings without warning. Documentation files and .env files often contain credentials, internal notes, or operational details, so this behavior creates a direct risk of unintended secret and data exposure.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The module docstring says the script queries lottery draw results and shows the 10 most recent periods before a date, which describes a retrieval/display tool. However, later code performs trend analysis and generates '下期预测推荐' prediction outputs, adding decision-support behavior not reflected in the documentation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code explicitly disables TLS hostname verification and certificate validation for all HTTPS requests. This allows a man-in-the-middle attacker on the network path to impersonate the lottery data source and supply arbitrary content, causing users to trust falsified results or manipulated predictions.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · lottery.py (reported line 25)May include surrounding context.
python
def fetch_lottery_data(): """从多个数据源获取开奖数据""" sources = [ "https://api.zhtong.cn/lottery/ssq/history.json", # API 数据源 "https://www.cwl.gov.cn/f开奖公告/双色球/index.html", # 福彩官网 ]

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · lottery_baidu.py (reported line 238)May include surrounding context.
python
def fetch_lottery_data(): """从多个数据源获取开奖数据""" sources = [ "https://api.zhtong.cn/lottery/ssq/history.json", # API 数据源 "https://www.cwl.gov.cn/f开奖公告/双色球/index.html", # 福彩官网 ]

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The top-level documentation says the skill uses a '百度API' to get latest real-time lottery data, which implies an API-backed data source. In reality, the implementation constructs Baidu web search URLs, fetches HTML pages directly, then falls back to other public APIs and even generated mock results, so the documentation materially misstates the behavior and trust model.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill writes downloaded remote HTML directly to a local debug file without user notice or consent. Because the content comes from the network, it may contain sensitive browsing-derived content, untrusted markup, or data that should not be persisted, creating privacy and local data exposure risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The cleaned HTML, still derived from remote untrusted content, is written to a local file without warning. Persisting network-sourced content increases the local attack surface and may expose sensitive or unexpected data to other local users, tools, or processes.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · lottery_baidu.py (reported line 237)May include surrounding context.
python
def fetch_api_data(): """尝试从API获取数据作为备份""" api_urls = [ "https://api.apiopen.top/api/ssq", "https://api.zhtong.cn/lottery/ssq/history.json", ]

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The module description and all user-facing behavior are fixed to Chinese, and the implementation further hard-codes a Chinese locale preference in outbound requests. The file does not offer any user opt-in or language selection, which matches the policy category for forced language/locale behavior.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 83% confidence
Finding: The skill transmits requests to third-party lottery-related endpoints, which is an external data exposure surface. In this file the requests do not appear to send sensitive user-provided secrets, so the risk is moderate rather than severe, but the context is made more dangerous because TLS certificate validation is globally disabled, allowing interception or tampering of these external responses.
Content: Scanner excerpt · lottery_v2.py (reported line 31)May include surrounding context.
python
def fetch_from_api_sources(): """从多个API数据源获取开奖数据""" api_sources = [ "https://api.zhtong.cn/lottery/ssq/history.json", "https://www.cwl.gov.cn/cwl_admin/front/cwlkj/search/kjxx/findDrawNotice?name=ssq&issueCount=10", "https://www.17500.cn/ssq/newinfo.php", "https://api.apiopen.top/api/ssq"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 83% confidence
Finding: The script sends outbound requests to another third-party API endpoint, creating the same external transmission and trust-boundary risk. Although the data sent is limited, the combination of untrusted remote content, disabled certificate verification, and downstream parsing into authoritative-looking output increases the chance of manipulated or spoofed results.
Content: Scanner excerpt · lottery_v2.py (reported line 34)May include surrounding context.
python
"https://api.zhtong.cn/lottery/ssq/history.json", "https://www.cwl.gov.cn/cwl_admin/front/cwlkj/search/kjxx/findDrawNotice?name=ssq&issueCount=10", "https://www.17500.cn/ssq/newinfo.php", "https://api.apiopen.top/api/ssq" ] for url in api_sources:

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The Baidu fallback parser invents missing fields such as period numbers, dates, and blue-ball values using random or inferred data when parsing is incomplete. That transforms untrusted, ambiguous search-result text into seemingly authoritative structured results, creating a data integrity problem and enabling silent fabrication of output.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: All user-facing output strings in this file are in Chinese, and the script does not offer any language choice or indicate that it is limited to a Chinese-language context. This creates a natural-language locale policy issue because the skill implicitly forces one language without user selection.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The script enumerates a specific local skill directory and prints its contents, which exposes local filesystem structure and installed-skill metadata unrelated to a minimal environment check. This can aid reconnaissance by revealing available tools, naming conventions, and deployment layout.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file’s natural-language description and generated output are entirely in Chinese, and the script hardcodes Chinese headings and messages. There is no opt-in, locale selection, or documentation indicating that the skill is intentionally limited to a Chinese-speaking or region-specific audience.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.