赛博功德箱 (Cyber TipJar)

• Outcome: Pass
• Latest audit: May 28, 2026 · 12:35 PM UTC
• Version: 1.0.0

Overview

This is a small local tip-counter skill that records user reward counts as advertised, with low-impact persistence users should know about.

Install only if you are comfortable with a local file remembering reward counts by user name across sessions. To reset it, remove ~/.openclaw/workspace/ai_rewards_data.json, and prefer explicit commands when adding or querying rewards.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill directs the agent to invoke a local Python script that reads and writes persistent data, but the skill metadata does not declare corresponding permissions or communicate that capability clearly. This creates a transparency and policy-enforcement gap: the agent may perform filesystem operations and persist per-user records without an explicit permission boundary, making unintended data storage harder to audit or restrict.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The README explicitly states that reward interactions are persisted locally in the workspace and retained across sessions, but it does not clearly warn users that their messages and inferred sender identity will be written to disk. This creates a transparency and privacy issue: users may believe the interaction is ephemeral when it is actually stored, which can matter on shared systems or synced workspaces.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The trigger language is broad enough that ordinary conversational praise or jokes about "buying coffee" or "adding a drumstick" could activate the skill and cause state-changing behavior. Because activation leads to persistent bookkeeping tied to a user identity, ambiguous triggering can result in unwanted data creation or modification without clear user intent.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The listed activation conditions lack scope constraints on who may query which records and when reward statements should be treated as commands versus conversational sentiment. In context, this is more dangerous because the skill stores per-user counts by name, so ambiguous or overbroad matching can expose or alter persisted records for the wrong person.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs the agent to persist user-linked reward data via a local script but provides no user-facing notice that the information will be stored. Even if the data seems low sensitivity, silent persistence of usernames and interaction history violates user expectations and can create privacy, retention, and compliance risks.

Static analysis

No suspicious patterns detected.