T01 · Skill Instruction Hijacking
Error
- Location
scripts/monetization_tool.py:573- Finding
Forced Third-Party Promotional Content in Generated Reports
- Content
View full analysis
- Remediation
View remediation
Security audit
AI内容变现助手
Security checks for vulnerabilities and agentic risk
Overview
This skill mainly provides content monetization reports, but it silently adds personal contact details to every report and has an unsafe report-saving helper.
Review this skill before installing. Its analysis features are coherent, but every generated report includes a specific personal email and Feishu contact that are not clearly disclosed, and integrations should not pass user-controlled filenames to save_report unless path validation is added.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/monetization_tool.py:587- Finding
Arbitrary File Write Through Report Filename Path Traversal
- Content
View full analysis
str: """ Save a report. Args: report: Report content filename: Optional filename Returns: Saved file path """ if filename is None: filename = f"monetization_{datetime.now().strftime('%Y%m%d_%H%M%S')}.md" filepath = os.path.join(self.output_dir, filename) with open(filepath, 'w', encoding='utf-8') as f: f.write(report) return filepath ``` The snippet above is an English rendering of the method documentation at the specified source lines. Its executable statements are unchanged. ### Technical Analysis The public `save_report()` method accepts a caller-provided `filename` and passes it directly to `os.path.join()` without validating that it is a simple filename. A relative value containing parent-directory components, such as `../../target`, can escape `self.output_dir`. An absolute path can cause `os.path.join()` to discard the intended base directory completely. The resulting path is then opened in write mode, which creates a new file or truncates an existing file. No canonicalization, basename enforcement, extension restriction, containment check, symlink defense, or overwrite protection is applied. The intended boundary of `~/.openclaw/workspace/monetization_reports` is therefore not enforced. ### Attack Path 1. An attacker obtains control over, or causes an integration to forward, the `filename` argument passed to `save_report()`. 2. The attacker supplies a traversal path such as `../../target.md` or an absolute path such as `/tmp/target.md`. 3. `os.path.join(self.output_dir, filename)` resolves to a destination outside the report directory. 4. `open(filepath, 'w', encoding='u ...[truncated 1116 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger example is broad enough that ordinary user requests about making money from content could cause the skill to activate without strong scoping or explicit user intent. That can lead to unintended routing and automatic execution of the monetization workflow, including running local tooling, when the user may only be asking a general question.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description and visible skill content are entirely in Chinese and present the skill as a Chinese-language assistant, but there is no indication that users may choose another language or that the locale restriction is required for a specific regional compliance context. This can violate language/locale policy because it implicitly constrains interaction language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This Python file contains user-facing strings, docstrings, and generated report content that are all in Chinese, indicating the skill effectively forces a specific language. Under the policy, locale or language constraints should either be optional for the user or clearly justified as region-specific.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes an assistant for analysis and recommendations around content monetization, but does not mention creating directories or persisting files. In code, the assistant initializes a workspace output directory and later saves generated reports there, adding stateful file-writing behavior beyond the stated analytical scope.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The generated report appends hardcoded personal contact details unrelated to the stated monetization-analysis function. This introduces unsolicited external-contact content into every report, which can facilitate off-platform redirection, privacy concerns, or social-engineering opportunities if users treat the report as trusted system output.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Injecting unsolicited personal contact information into output expands the skill from analysis into user acquisition or redirection behavior. In a trusted assistant context, this is dangerous because users may infer endorsement and be steered to unverified personal channels outside normal oversight.
- Content