T05 · Unauthorized Access and Privilege Escalation
Note
- Location
SKILL.md:6- Finding
Unnecessary Declaration of Memory and External Search Capabilities
- Content
View full analysis
- Remediation
View remediation
Security audit
SPIN 销售法 Spin Sales Skill
Security checks for vulnerabilities and agentic risk
Overview
This is mostly a coherent Chinese-language SPIN sales coaching skill, but it requests memory and external search capabilities beyond what its current local scripts need, so users should review it before installing.
Install only if you want Chinese-language SPIN sales materials. Before enabling it, check whether your OpenClaw host grants memory_search or tavily_search automatically; if it does, deny or remove those permissions unless you specifically need retained-context lookup or external market research. Revise any outreach script that downplays sales intent so prospects clearly understand the commercial context.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (28)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
声明描述的是一个覆盖销售全流程的 SPIN 专家系统，而代码只包含 scripts/opening.py，一个参数化的“开场白生成器”。它通过硬编码行业映射获取痛点与市场规模，生成并打印开场话术，功能范围明显窄于声明。代码没有展示需求挖掘、问题扩展、影响/收益提问、成交推进、异议处理、会话状态管理或复杂 B2B 咨询支持等核心能力。因此，描述与实际行为存在实质性不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
There is a clear mismatch between the declared description and the provided code chunk. The description claims substantial business functionality related to SPIN sales guidance, but the actual code is just an empty tests/init.py file with a comment. This code does not demonstrate the declared primary purpose, capabilities, or any relevant operational behavior.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - [basic_usage.js](examples/basic_usage.js) - SPIN 四阶段流程完整演示
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - [objection_handling.js](examples/objection_handling.js) - 客户异议处理实战技巧
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - [performance-tips.md](examples/performance-tips.md) - 性能优化与最佳实践指南
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill README presents the title and all primary usage instructions in Chinese, with no indication that other languages are supported or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest description is written as a Chinese-only experience description and does not indicate that users may choose another language. Under the policy rule for natural-language constraints, forcing a specific language without opt-in is a violation unless the locale limitation is explicitly justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The primary user-facing title, goals, and usage boundaries are all written in Chinese, and the document does not offer an alternative language path. This creates a language policy issue because the skill appears to require a specific language by default rather than letting the user choose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This JavaScript example contains user-facing text entirely in Chinese, including the header comment and all console output, which effectively forces a specific language without user opt-in. The file does not indicate that the skill is region-specific or provide any mechanism for selecting another language, matching the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language comments and demonstrated interaction content are entirely framed in Chinese, presenting the skill as Chinese-only without any user opt-in or stated region-specific requirement. Under the policy, forcing a specific language without offering choice or justification is a locale-policy concern.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The manifest describes a SPIN sales expert system that provides dialogue-script frameworks for complex B2B sales conversations. Line L458 states that
TAVILY_API_KEYmust be configured for 'I 阶段数据支持', which implies web/API-backed data retrieval capability not justified by the declared purpose of a script-framework skill, and this capability appears in documentation despite this file being a performance guide.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file is written as a skill/question library in Chinese and does not indicate that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a sales expert system that provides dialogue script frameworks for the full SPIN sales cycle. In this file, the content starts as Need-Payoff questioning guidance but then shifts into detailed action-plan development, project milestones, resource allocation, budget approval paths, implementation delivery, and project checklists, which are operational project-planning artifacts rather than sales conversation scripts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This markdown skill content appears to require Chinese comprehension throughout, including all examples and instructions. Under the policy rule for language/locale, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skeptical-customer script says there is 'no sales intent' while the document is plainly a sales framework, encouraging deceptive representation of motive to lower resistance. This is dangerous because it trains users to mislead prospects about the nature of the interaction, which can facilitate social engineering, undermine informed consent, and create legal/compliance exposure for deceptive practices.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The appendix explicitly advises collecting detailed customer background, market events, pain-point signals, and public statements without any guidance on lawful basis, data minimization, or privacy-safe handling. In a sales playbook, this can normalize excessive profiling and create downstream misuse of personal or company-linked information, especially if users gather and repurpose public data without transparency or consent checks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file contains user-facing instructional content exclusively in Chinese, including the title and all guidance, but does not indicate that the skill is intended only for Chinese-speaking users or provide any opt-in for language preference. Under the policy, forcing a specific language without user choice can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file presents all operational guidance exclusively in Chinese and does not indicate that the user may choose another language or locale. Under the policy, a skill should not impose a language constraint without opt-in or documented justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code contains natural-language comments, enum labels, and generated interview prompts entirely in Chinese, indicating the skill is designed to operate in a fixed language. The file does not provide any user opt-in, language selection mechanism, or justification that the skill is intended only for a Chinese-language context.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file’s title, comments, docstring, and generated question text are all written in Chinese, and the function is designed to produce Chinese-language sales questions by default. There is no indication that users can choose another language or that the Chinese-only behavior is a justified region-specific constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown file applies a single-language constraint across the whole skill artifact, including headings, instructions, and evaluation criteria. Under the language/locale policy, forcing one language without user opt-in or a clearly justified regional scope is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown training material is written entirely in Chinese and presents the skill content, instructions, and templates in a single forced locale. Under the policy, language constraints should either offer user opt-in/choice or be clearly documented as region-specific and justified; this file does neither.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file is written entirely in Chinese and does not indicate that other languages are supported or that the language choice is optional. Under the policy rule, a skill that imposes a specific language without user opt-in can be considered a natural-language policy violation unless the locale restriction is clearly documented and justified.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The heading and introductory text present '行动计划制定' as the 'perfect closing' of the SPIN N stage, implying it remains within Need-Payoff questioning scope. However, the subsequent material is not primarily question design; it becomes concrete project-plan, budgeting, approval, deployment, and delivery documentation, which contradicts the stated framing of this section as an N-stage questioning resource.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The skill content appears to require Chinese for all instructions and templates, with no indication that users may choose another language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly documented and justified.
- Content