工作目录健康检测

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:07 PM UTC
• Version: 1.0.0

Overview

The skill has a legitimate workspace-repair purpose, but its repair instructions rely on unbundled PowerShell scripts and ambiguous relative execution paths for actions that can delete directories and change configuration.

Review this skill before installing or using it. Only run the referenced PowerShell scripts if you can verify their exact source and contents, prefer the documented dry-run first, back up affected configuration and directories, and do not run the DryRun:false repair unless the exact paths to be deleted or changed are shown and confirmed.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Warning

• Location: SKILL.md:40
• Finding: Relative Execution of Absent and Unverified PowerShell Scripts<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 40-58 **Vulnerability Type**: Untrusted executable resolution through relative paths **Risk Level**: Medium ### Complete Code Snippet ```powershell # Detect nested directories .\detect-nested-workspace.ps1 # Validate the workspace .\validate-workspace.ps1 # Repair in dry-run mode .\fix-nested-workspace.ps1 -DryRun:$true # Perform the repair .\fix-nested-workspace.ps1 -DryRun:$false ``` The document subsequently identifies external script locations: ```text - E:\.openclaw\workspace\scripts\detect-nested-workspace.ps1 - E:\.openclaw\workspace\scripts\validate-workspace.ps1 - E:\.openclaw\workspace\scripts\fix-nested-workspace.ps1 ``` ### Technical Analysis The documented commands execute PowerShell scripts by relative path. PowerShell resolves a path beginning with `.\` against the process's current working directory, rather than against the absolute locations documented later in the file. None of the referenced PowerShell scripts are included in the audited project, which contains only `SKILL.md` and `_meta.json`. Consequently, the package cannot establish the identity, integrity, or behavior of the scripts that a user executes by following these instructions. If the user runs the commands from an attacker-controlled or otherwise untrusted directory containing scripts with the documented names, PowerShell will execute those local files. The risk is especially significant for `fix-nested-workspace.ps1 -DryRun:$false`, because the skill describes that script as deleting nested directories and changing workspace configuration. This finding does not establish that the external scripts themselves are malicious; their contents were unavailable for review. The issue is the insecure and ambiguous executable-resolution mechanism in the supplied instructions. ### Attack Path 1. An attacker gains the ability to place files in a directory from which the victim is likely to run the documen ...[truncated 1303 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Include the reviewed PowerShell scripts in the skill package so their contents are available for security review and version control. 2. Resolve scripts from a trusted directory derived from the skill's own installation location rather than from the current working directory. 3. If the scripts must remain external, invoke their canonical absolute paths and verify that each resolved path is inside the expected scripts directory. 4. Publish trusted SHA-256 hashes or Authenticode signatures and verify them before execution. 5. Refuse execution if a script is missing, unsigned, has an unexpected hash, or resolves through a symbolic link or junction to an untrusted location. 6. Preserve dry-run mode as the default and require explicit user confirmation before deletion or configuration changes. 7. Back up configuration and affected directories before applying repairs, and report the exact paths that will be modified or deleted. 8. Run the scripts with the minimum necessary privileges and avoid recommending elevated PowerShell unless a specific operation requires it. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger list includes very broad phrases such as '工作目录异常', 'workspace问题', and command-like terms that may appear in ordinary user troubleshooting conversations. This can cause the skill to activate outside narrowly intended scenarios, increasing the chance that it handles unrelated contexts or performs workspace-affecting actions when not explicitly requested.

Vague Triggers

Low

• Confidence: 88% confidence
• Finding: The skill activates on relatively broad workspace-related keywords without clear scope constraints, which can cause it to trigger in contexts where the user is only discussing the problem rather than requesting filesystem inspection or repair. Because the skill includes destructive remediation actions such as deleting nested directories, overbroad activation increases the chance of unintended operational impact if the agent proceeds too quickly.

Static analysis

No suspicious patterns detected.