Security audit

daily-sales-digest

Security checks for vulnerabilities and agentic risk

Overview

This sales-reporting skill is partly coherent, but it has material review concerns around sensitive sales data delivery, unsafe command construction, and mock data being written like real records.

Review carefully before installing. Do not use the provided Discord ID; replace it with a destination you control, keep delivery disabled until tested, protect the config file containing API keys, and avoid running the test or --force collection against real sales data. The Discord delivery code should be fixed to avoid shell interpolation before scheduled use.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/digest.js:269
Finding: Shell Command Injection in Discord Delivery
Content: View full analysis
Remediation: View remediation

other

Error

Location: config.template.json:37
Finding: Fixed Personal Discord Destination Can Disclose Sensitive Sales Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: test.sh:27
Finding: Test Script Overwrites Production Sales Data with Random Mock Values
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: API_INTEGRATION.md:72
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: INSTALLATION.md:18
Finding: Credential Configuration File Is Created Without Restrictive Permissions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (44)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The archiving example compresses files and then immediately deletes the originals with rm, but provides no warning that removal is irreversible if the archive is incomplete, corrupted, or misplaced. Because this skill handles business sales data, accidental deletion can result in permanent loss of financial records needed for reporting, reconciliation, or compliance.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · INSTALLATION.md (reported line 213)May include surrounding context.
md
tar -czf ~/sales-data-backup.tar.gz ~/.openclaw/workspace/data/sales/ # 스킬 디렉토리 삭제 rm -rf /Users/mupeng/.openclaw/workspace/skills/daily-sales-digest # 설정 파일 삭제 (선택) rm ~/.openclaw/workspace/config/daily-sales-digest.json

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · INSTALLATION.md (reported line 213)May include surrounding context.
md
tar -czf ~/sales-data-backup.tar.gz ~/.openclaw/workspace/data/sales/ # 스킬 디렉토리 삭제 rm -rf /Users/mupeng/.openclaw/workspace/skills/daily-sales-digest # 설정 파일 삭제 (선택) rm ~/.openclaw/workspace/config/daily-sales-digest.json

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · INSTALLATION.md (reported line 216)May include surrounding context.
md
rm -rf /Users/mupeng/.openclaw/workspace/skills/daily-sales-digest # 설정 파일 삭제 (선택) rm ~/.openclaw/workspace/config/daily-sales-digest.json # 데이터 삭제 (선택) rm -rf ~/.openclaw/workspace/data/sales/

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · INSTALLATION.md (reported line 219)May include surrounding context.
rm ~/.openclaw/workspace/config/daily-sales-digest.json

데이터 삭제 (선택)

rm -rf ~/.openclaw/workspace/data/sales/

text
## 9. 백업 권장사항

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · INSTALLATION.md (reported line 219)May include surrounding context.
rm ~/.openclaw/workspace/config/daily-sales-digest.json

데이터 삭제 (선택)

rm -rf ~/.openclaw/workspace/data/sales/

text
## 9. 백업 권장사항

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 설명은 광범위한 매출 집계 및 다채널 리포팅 스킬을 주장하지만, 제공된 코드는 로컬에 이미 저장된 일별 JSON 데이터를 읽어 전일 대비 매출 변화율을 계산하고 임계값 초과 시 경보를 보내는 보조 스크립트입니다. 이는 단순한 지원 세부사항 수준을 넘어서, 주요 목적이 '요약 리포트 생성/배달'이 아니라 '이상 탐지 및 즉시 알림'으로 materially 다릅니다. 또한 실제 구현된 전달 채널은 Discord뿐이며, 선언된 네이버/쿠팡/배민/POS 연동이나 카카오톡/이메일 전송은 코드에 없습니다.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: 설명은 여러 외부 플랫폼과 POS를 실제 연동해 매출 데이터를 수집하고, 요약 리포트를 자동 생성한 뒤 Discord/카카오톡/이메일로 배달하는 완성형 스킬을 나타낸다. 그러나 코드 조각은 collect.js 하나뿐이며, 실제 네이버/쿠팡/배민/POS API 호출은 모두 TODO로 남아 있고 무작위 mock 데이터를 반환한다. 또한 결과는 로컬 JSON 파일로 저장될 뿐, 주간/월간 리포트 생성이나 어떤 전송 채널로의 발송도 수행하지 않는다. 따라서 선언된 핵심 기능과 실제 구현된 동작 사이에 중요한 불일치가 있다.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: 설명은 이 스킬이 여러 외부 판매채널 및 POS와 연동하여 매출 데이터를 수집하고, 생성된 리포트를 Discord/카톡/이메일로 배달한다고 주장한다. 그러나 제공된 코드 조각은 이미 저장된 로컬 JSON 파일을 읽어 요약 통계를 계산하는 리포트 생성기 역할만 수행한다. 외부 API 호출, 인증, 크롤링, 동기화 등 데이터 수집 로직은 없고, 카카오톡 전송도 전혀 없다. Discord 전송은 openclaw CLI 호출로 구현되어 있으나 이메일은 콘솔에 안내를 출력하는 수준이라 설명과 차이가 있다. 따라서 핵심 기능 중 '데이터 수집'과 일부 '전달 채널'이 실제 동작과 불일치하므로 설명이 코드 행동을 정확히 대표하지 않는다.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: 설명과 일부 관련성은 있다. 매출 데이터 수집 및 일일/주간 요약과 연관된 collect.js, digest.js를 호출하므로 전반적 도메인은 일치한다. 그러나 실제 제공된 코드 조각은 고객용 매출 요약/배달 기능 자체가 아니라 테스트 러너다. 또한 선언에 없는 이상 탐지(alert.js) 기능을 실행하고, 로컬 설정 파일 확인 및 데이터 디렉토리 생성 같은 파일시스템 조작을 수행한다. 반대로 선언의 핵심인 Discord/카톡/이메일 배달은 실제 실행되지 않고 cron 명령 예시로만 제시된다. 따라서 설명이 코드 조각의 실제 역할과 기능을 정확히 대표한다고 보기 어렵다.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This file claims to collect real sales data from multiple commerce sources, yet every collector fabricates random summaries and then saves them as if they were genuine collected results. Because the skill's stated purpose is automated daily sales reporting and delivery to channels like Discord/KakaoTalk/email, this behavior can propagate false business records to users and external systems, making the deception more dangerous in context.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · API_INTEGRATION.md (reported line 37)May include surrounding context.
md
// API 호출 (예시) const axios = require('axios'); const response = await axios.get('https://api.commerce.naver.com/external/v1/pay-order/seller-product-order/list', { headers: { 'X-Naver-Client-Id': clientId, 'X-Naver-Client-Secret': clientSecret

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.
md
// API 호출 (예시) const axios = require('axios'); const response = await axios.get('https://api.commerce.naver.com/external/v1/pay-order/seller-product-order/list', { headers: { 'X-Naver-Client-Id': clientId, 'X-Naver-Client-Secret': clientSecret

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · API_INTEGRATION.md (reported line 174)May include surrounding context.
md
const shopId = config.sources.baemin.shopId; // API 엔드포인트는 배민 제공 문서 참고 const response = await axios.get('https://api.baemin.com/v1/sales', { headers: { 'Authorization': `Bearer ${apiKey}` },

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The examples encourage automatic delivery of detailed sales summaries to Discord and email, which are third-party or broadly accessible channels, without any caution about exposing sensitive business metrics to unintended recipients. In the context of a sales-reporting skill, this increases the likelihood of accidental data disclosure through misconfigured channels, shared inboxes, or unauthorized workspace members.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented use of a force-overwrite option normalizes destructive behavior without warning that existing collected data may be replaced, potentially erasing corrected or historical records. In a financial reporting workflow, unintended overwrites can damage data integrity and lead to inaccurate reports or loss of auditability.
Content: No source excerpt is available for this finding.

File System Enumeration

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Content: Scanner excerpt · INSTALLATION.md (reported line 16)May include surrounding context.
스킬이 이미 설치되어 있습니다:

bash
ls -la /Users/mupeng/.openclaw/workspace/skills/daily-sales-digest/

2.2 설정 파일 생성

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · INSTALLATION.md (reported line 23)May include surrounding context.
bash
# 설정 디렉토리 생성 mkdir -p ~/.openclaw/workspace/config # 템플릿 복사 cp /Users/mupeng/.openclaw/workspace/skills/daily-sales-digest/config.template.json \

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The guide tells users to place API client IDs and secrets into a local JSON config file but provides no guidance on file permissions, secret storage, rotation, or avoiding commits/backups. This increases the chance of credential leakage through world-readable files, shell history, backups, or accidental source control inclusion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The installation steps automate sending sales summaries and anomaly alerts to Discord and email without warning that business-sensitive data will be transmitted to third-party channels. Users may unknowingly exfiltrate revenue and operational data to external services with broader retention and access than intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The removal section includes destructive deletion commands for the skill, config, and collected sales data without an explicit warning that the action is irreversible. This creates a realistic risk of accidental permanent data loss, especially because the same section presents cleanup as routine administration.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 10)May include surrounding context.
1. 설정 파일 생성

bash
mkdir -p ~/.openclaw/workspace/config cp config.template.json ~/.openclaw/workspace/config/daily-sales-digest.json

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The README instructs users to automate collection and delivery of sales summaries to external channels such as Discord, KakaoTalk, and email, but it does not warn about sensitive business data leaving the local environment or the need for recipient/channel validation. In a customer-facing sales reporting skill, silent external transmission increases the risk of accidental data disclosure to the wrong workspace, webhook, or email list.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill encourages sending sales summaries to Discord, email, and future KakaoTalk channels without clearly warning that business-sensitive revenue and order data will leave the local environment. In a customer-facing sales reporting skill, this materially increases the chance of unintended disclosure to third-party platforms, misconfigured recipients, or retained message histories.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

other

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

Missing User Warnings

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

데이터 삭제 (선택)

Tool Parameter Abuse

데이터 삭제 (선택)

Tp4

Tp4

Tp4

Tp4

Description-Behavior Mismatch

External Transmission

External Transmission

External Transmission

Missing User Warnings

Missing User Warnings

File System Enumeration

2.2 설정 파일 생성

Session Persistence

Missing User Warnings

Missing User Warnings

Missing User Warnings

Session Persistence

1. 설정 파일 생성

Missing User Warnings

Undeclared Tool Scope

Missing User Warnings