Security audit

evens-结算

Security checks for vulnerabilities and agentic risk

Overview

This skill appears local-only and not malicious, but it has a real payout-accuracy issue users should review before relying on it for settlements.

Review weighted distribution results manually before using them for real payouts. The skill processes local files and does not appear to exfiltrate data, but its broad triggers, under-declared file access, and scoped rm -rf uninstall command deserve caution.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill embeds executable Python that reads input files and writes settlement results, yet the manifest declares no required permissions. This creates a capability/permission mismatch that can mislead operators and policy systems about what the skill can do, reducing transparency and weakening security review.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The uninstall section instructs users to run `rm -rf ~/.openclaw/skills/ai-settlement-pro`, which is a destructive recursive deletion command, but provides no warning about irreversible removal or guidance to verify the target path first. In an installation guide, this can lead to accidental data loss if the path is mistyped, expanded unexpectedly, or if users adapt the command incorrectly.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger phrases include broad everyday language such as '帮我结算', '请结算', and '结算活动', which can be activated in normal conversation without clear user intent to invoke this specific skill. Overbroad activation increases the chance the agent starts parsing rules, requesting files, or initiating file-processing behavior unexpectedly.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The example says sending '一组结算' can directly enter the settlement flow, which is ambiguous and lacks contextual constraints. A short generic phrase can cause accidental invocation in unrelated chats, leading to unintended workflow transitions and potential processing of attached files or sensitive business data.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The manifest advertises generic trigger phrases such as “帮我结算”, “请结算”, and “结算活动”, which are common natural-language requests and can be invoked accidentally in unrelated conversations. In an agent ecosystem, broad triggers increase the chance of unintended skill activation, causing the skill to ingest user data or steer the conversation into settlement processing without clear user intent.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: INSTALL.md:158