Artificial Analysis Models

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:48 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but it ships a prefilled Feishu Bitable destination that could make an agent read or update a table the user did not explicitly choose.

Before installing, remove or replace the bundled bitable-config.json values and use only a Feishu Bitable you explicitly selected. Confirm the destination table before any list, delete, create, or update operation, and prefer an environment variable for the Artificial Analysis API key if you do not want a persistent credential file.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bitable-config.json:2

Finding

Hardcoded Feishu Bitable Destination Can Cause Cross-Installation Data Access

Content

View full analysis

Vulnerability Details

File Location: bitable-config.json:2-3
Vulnerability Type: Hardcoded external resource identifiers and unsafe shared runtime configuration
Risk Level: Medium

Vulnerable Code

json

{
  "app_token": "Tqnfb144ia0F5wsBQfCcd0lYnzh",
  "table_id": "tblViMOo7sfFds2h",
  "app_name": "AI Model Information Database (Artificial Analysis)",
  "table_name": "LLM Model Overview",
  "folder_token": ""
}

Technical Analysis

The distributed runtime configuration contains populated Feishu Bitable app_token and table_id values instead of placeholders. The workflow in SKILL.md instructs the Agent to use existing values from this file for subsequent record listing, creation, and update operations.

These identifiers are not necessarily sufficient for standalone Feishu authentication. However, they select a specific external resource and become actionable when combined with an Agent's already-authorized Feishu tools. This creates a confused-deputy condition: the installing user's Feishu authorization may be used to access or modify a table selected by the Skill package author rather than a table explicitly selected by the user.

Runtime resource identifiers should not be shared across installations. The Skill already includes bitable-config.example.json for placeholders, making inclusion of a populated runtime configuration unnecessary for its declared functionality.

Attack Path

1. A user installs or loads the Skill package.
2. The Agent reads the committed bitable-config.json.
3. Because app_token and table_id are populated, the documented update workflow treats the referenced Bitable as an existing destination.
4. The Agent invokes its authorized Feishu tools using these embedded identifiers.
5. If the Agent's Feishu identity has access to the referenced resource, it may list existing records or create and update records without first confirming that the table belongs to, or was selected by, the current us ...[truncated 1131 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the populated bitable-config.json from the distributed Skill package.
2. Retain only bitable-config.example.json with clearly invalid placeholder values.
3. Add bitable-config.json to version-control and package ignore rules.
4. Store runtime Bitable identifiers in user-specific configuration outside the Skill installation directory.
5. Require explicit user confirmation before using an existing app_token and table_id.
6. Verify that the selected Bitable belongs to, or is intentionally accessible by, the current user before listing or modifying records.
7. On first use, create a new Bitable under the current user's authorized Feishu context unless the user explicitly supplies an existing destination.
8. Display the destination table name and URL before the first write and require confirmation when it differs from previously approved state.
9. Consider the exposed identifiers compromised for distribution purposes and replace or revoke them where supported.
10. Enforce least-privilege Feishu permissions so the Agent can access only the tables required for the current task.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill performs network access and reads credentials from the environment/filesystem, but it does not declare an explicit tool scope such as allowed-tools or permissions. That creates an authorization gap: an agent may invoke this skill without clear least-privilege boundaries, increasing the chance of unintended network calls or secret access beyond what the user expects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill title and operational instructions are written as Chinese-only guidance for producing Feishu-facing deliverables, and later sections prescribe Chinese message content for end users. There is no indication that users may choose another language or that the Chinese locale is a documented requirement, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

This finding duplicates the same persistent-credential pattern at the same location: creating ~/.openclaw/credentials and writing the API key to a JSON file for reuse. In a multi-skill or multi-tenant agent environment, durable local secret storage can be read by unintended components and survives longer than necessary, making credential theft and unauthorized API use more likely.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

export ARTIFICIAL_ANALYSIS_API_KEY="你的key"

# 方式 B：凭证文件（推荐）
mkdir -p ~/.openclaw/credentials
cat > ~/.openclaw/credentials/artificial-analysis.json <<'EOF'
{"api_key": "你的key"}
EOF

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 91% confidence

Finding

This finding duplicates the same persistent-credential pattern at the same location: creating ~/.openclaw/credentials and writing the API key to a JSON file for reuse. In a multi-skill or multi-tenant agent environment, durable local secret storage can be read by unintended components and survives longer than necessary, making credential theft and unauthorized API use more likely.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

export ARTIFICIAL_ANALYSIS_API_KEY="你的key"

# 方式 B:凭证文件(推荐)
mkdir -p ~/.openclaw/credentials
cat > ~/.openclaw/credentials/artificial-analysis.json <<'EOF'
{"api_key": "你的key"}
EOF

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

cat > ~/.openclaw/credentials/artificial-analysis.json <<'EOF' {"api_key": "你的key"} EOF chmod 600 ~/.openclaw/credentials/artificial-analysis.json

text

免费 API 限额：**1000 次/天**；请缓存结果，不要每次对话都重复全量拉取。

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest says this skill fetches Artificial Analysis data and syncs it to a Feishu Bitable table, but this file only retrieves the API response, normalizes it, and writes JSON files under a local cache directory. There is no Feishu API interaction, Bitable write logic, or any remote sync behavior in the implemented code path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script presents mandatory user-facing guidance in Chinese for missing API key handling, and similar forced Chinese messaging appears elsewhere in runtime output. For a general-purpose fetch script, this imposes a specific language on users without opt-in or justification, which matches the locale-policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The placeholder and descriptive values in this manifest-like JSON are presented in Chinese, which imposes a specific language on users reading or editing the file. The file does not indicate that the skill is region-specific or provide any opt-in or alternative language support.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The config sets app and table names using Chinese text literals, which can reflect a fixed language choice. There is no nearby indication that users can select a preferred language or that the skill is intentionally limited to a Chinese-language or region-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code file contains natural-language comments and console output in Chinese, including the field definitions and the missing-file error message. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy violation when no alternative or choice is provided.

Content

No source excerpt is available for this finding.