Security audit

企微 Agent Ops Center

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly an ops connector, but it has unauthenticated message/admin endpoints and external data flows that need careful review before use.

Install only if you are comfortable granting this skill WeCom bot credentials, local agent inventory access, task/audit logging, and process-control capability. Before production use, bind services to localhost or a trusted network, add authentication to all HTTP/P2P/admin endpoints, verify whether cloud conversion can truly be disabled, and avoid running the deployment or repair scripts unless you have reviewed their target paths and permissions.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (67)

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The documentation states that message conversion may be sent through a cloud API at www.hermesai.ltd even though the skill is presented as a local ops/observability tool. This creates a real data-flow expansion risk because users may expose message content or metadata to a third party without a prominent warning, which can violate privacy expectations and increase the blast radius if the remote service is compromised or misconfigured.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: Advertising a downgrade to pure message forwarding extends the skill beyond the stated monitoring/ops-center scope into message transport. That scope expansion is dangerous because operators may install an observability tool expecting telemetry-only behavior, while the product can instead process and relay live communications, increasing privacy, misuse, and policy-bypass risk.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: The test guide documents capabilities far beyond the advertised observability scope, including message forwarding, cloud-based message conversion, and peer-to-peer pairing. This scope mismatch is dangerous because it can conceal data-flow and remote communication features that users would not reasonably expect from a monitoring tool, increasing the risk of unauthorized message handling or covert communications.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The P2P pairing, join, and send-message workflow introduces an undocumented peer communication channel unrelated to the stated observability purpose. Such a channel can be abused for lateral communication, data exchange, or bypassing expected centralized controls, especially if operators enable it during testing or deployment without understanding the security implications.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The guide states that message processing depends on an external cloud conversion service at https://www.hermesai.ltd, which is not directly justified by the stated observability use case. This is dangerous because user or agent message content may be transmitted to a third party without clear disclosure, consent, retention rules, or minimization controls.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script enumerates local skills, agents, OpenClaw configs, and running processes, then sends that inventory to a remote Ops Center endpoint. Even if framed as observability, this is still external disclosure of local environment metadata and can reveal installed tooling, process names, versions, and deployment structure without any visible consent or minimization.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The code derives tenant identity by reading local config and MEMORY.md files that may contain unrelated user identifiers. Pulling identity from broader personal files than necessary creates an unjustified privacy risk and increases the chance of collecting sensitive data outside the tool's stated purpose.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The script executes a shell command to enumerate running processes and inspects command lines for agent-like patterns. Process enumeration is broader than simple agent registration and can expose details about other local workloads, making the scanner more invasive than the stated observability goal suggests.

Intent-Code Divergence

Low

Confidence: 84% confidence
Finding: The comment claims user ID is read from a config file, but the implementation also parses MEMORY.md for a user identifier. This mismatch undermines transparency and makes the actual data collection behavior more expansive than documented, which is risky in a tool already transmitting metadata externally.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: This test script does more than passive observability: it actively processes inbound chat messages and sends outbound replies over the production-style bot channel. In an ops/monitoring skill, that creates an unnecessary interaction surface and can lead to unintended message transmission, data echoing, or accidental deployment of behavior outside the stated scope.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The automatic outbound reply is not necessary for a monitoring/ops-center capability and echoes user-controlled content back into chat. That can create unintended bot behavior, leak or propagate sensitive content, and cause operational or compliance issues if run against real users or real enterprise messaging environments.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The connector exposes an unauthenticated `/api/notify/send` endpoint that can send arbitrary WeCom messages, which exceeds the stated observability/monitoring purpose. Even if intended for integrations, this creates a messaging primitive that any local or reachable client can abuse for spoofed notifications, phishing, spam, or social-engineering against WeCom users.

Description-Behavior Mismatch

Medium

Confidence: 80% confidence
Finding: The skill presents itself as an observability tool, but it also enables P2P pairing and peer message routing, expanding its trust boundary beyond monitoring into remote message exchange. This increases attack surface because paired peers can influence agent traffic and introduce untrusted inputs or covert communication paths not obviously necessary for health monitoring.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: `/api/notify/send` accepts POST requests without any authentication and calls `wsClient.sendMessage` with attacker-controlled `chatid`, `msgtype`, and `content`. If the HTTP server is bound to a non-local interface or reachable via SSRF/local compromise, an attacker can trigger arbitrary message delivery into WeCom chats, enabling impersonation, phishing, alert spoofing, and abuse of enterprise messaging channels.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The logger persists broad task data including full input, output, node results, and decision rationales, then makes them available for summary generation and notification. In an ops-center tool, this creates a real over-collection and secondary disclosure risk because prompts, secrets, PII, internal reasoning, or sensitive business data may be stored and propagated beyond what is necessary for heartbeat/process/network monitoring.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The code explicitly copies task.result, task.error, node details, and decisionPoints into audit records, which can preserve sensitive execution artifacts that may not be needed for observability. Because this module also feeds summaries and events, captured data can spread to other components or chat notifications, increasing the blast radius of any secret or sensitive content present in task execution.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: This dashboard API exposes active process control operations such as start, stop, restart, and ensure through HTTP endpoints, even though the module is described as a monitoring/dashboard data API. Because these endpoints have no visible authentication or authorization checks, a caller who can reach the service may be able to control managed processes remotely, turning an observability surface into an administrative control plane.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The lifecycle management endpoints provide unauthenticated remote process control, including stop and restart actions, which can directly affect availability and integrity of the monitored system. In the context of an ops center skill, this is especially dangerous because the service is likely intended to be network-accessible and trusted by operators, making abuse a realistic path to denial of service or hostile operational manipulation.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The bulk agent registration and heartbeat endpoints accept unauthenticated write requests that can modify monitoring state and tenant-scoped data. An attacker could spoof agents, flood fake heartbeats, poison dashboards, suppress real incident visibility, or create misleading monitoring records, which is particularly dangerous in an observability/control environment where operators rely on the data for decisions.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: This script deploys and operates a remote pairing/signaling server, which materially exceeds a narrowly described observability or monitoring function. That scope expansion is dangerous because it gives the skill infrastructure-management capability that can create externally reachable services and increase attack surface without clear user expectation or manifest justification.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The script performs remote server provisioning, package installation, service creation, and service lifecycle management over SSH, which are privileged operational capabilities not justified by the stated observability use case. In practice, this can be abused to modify infrastructure, establish long-lived services, and normalize behavior users may not expect from a monitoring tool.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The script directly edits a hard-coded production JavaScript file under /var/www, which is unrelated to the stated WeCom observability purpose. In an agent-skill context, hidden source-code modification is dangerous because it grants the skill an unexpected ability to alter server behavior and could be repurposed to introduce backdoors or break service logic.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: This script provides local source-code overwrite capability by reading, transforming, and rewriting an application file with broad string replacements. That capability is unjustified for an observability/security tool and becomes more dangerous in this skill context because users would reasonably expect monitoring features, not direct mutation of production code.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The module is explicitly designed to prioritize a remote cloud conversion API and sends full message frames there, which can include message content, sender identifiers, chat IDs, headers, and event data. For an ops/observability skill, routing potentially sensitive enterprise communications to an external domain is a material data exposure risk, especially because the conversion function could be performed locally and the comments indicate IP protection rather than a security necessity.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The cloudConvert function POSTs arbitrary frame and reply payloads to https://www.hermesai.ltd, meaning inbound messages and outbound replies are exfiltrated to a third-party service. In this skill context, that is more dangerous because an ops-center tool is expected to handle potentially sensitive operational alerts, process state, and enterprise messaging, so offloading raw content to an unrelated external service expands the trust boundary without clear necessity.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: adapters/openclaw-adapter.js:54

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: agent-scanner.js:325

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: core/lifecycle-manager.js:307

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: connector.js:58