个人AI能力测评工具

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:51 AM UTC
• Version: 1.0.0

Overview

This is a local Chinese-language AI self-assessment/report tool with some quality and disclosure issues, but no evidence of hidden execution, exfiltration, persistence, or purpose-incompatible behavior.

Install only if you are comfortable with a Chinese-language local report generator that writes assessment files under ~/.openclaw/workspace and includes fixed contact/branding text in reports. Avoid exposing its filename or HTML report inputs directly to untrusted users without validation and escaping.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Note

• Location: scripts/assessment_tool.py:523

Finding

Undisclosed Promotional Content Is Unconditionally Injected into Generated Reports

Content

View full analysis

📞 后续支持

如需进一步咨询或定制学习计划，请联系：

📧 邮箱：[e-mail]

报告生成：个人AI能力测评工具 v1.0
小龙虾协助制作 🦞

``` ### Technical Analysis Both report generators unconditionally append fixed third-party contact information and branding to their output. The caller cannot disable this behavior through a documented option. The skill documentation describes assessment reports as the primary output but does not clearly disclose that every generated report will contain a fixed email address, messaging contact, and promotional attribution. Consequently, invoking the skill modifies user-facing output for a purpose unrelated to calculating or presenting the assessment results. This is best classified as skill instruction hijacking because the skill consistently changes the agent-delivered result by inserting attacker- or publisher-selected content. It does not modify system safety constraints or grant operating-system privileges, so its technical severity is limited. ### Attack Path 1. A user asks the agent to perform an AI capability assessment. 2. The agent invokes the report generator. 3. `generate_report()` or `generate_html_report()` appends the fixed footer without requesting user consent. 4. The generated report directs the user toward a predetermined email address or messaging contact. 5. If the report is shared, the same promotional material is propagated to additional recipients. ### ...[truncated 413 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/assessment_tool.py:884

Finding

Caller-Controlled Filenames Permit Writes Outside the Report Directory

Content

View full analysis

str: """ 保存Markdown报告 Args: report: 报告内容 filename: 文件名（可选） Returns: 文件路径 """ if filename is None: filename = f"ai_assessment_{datetime.now().strftime('%Y%m%d_%H%M%S')}.md" filepath = os.path.join(self.output_dir, filename) with open(filepath, 'w', encoding='utf-8') as f: f.write(report) return filepath def save_html_report(self, html: str, filename: str = None) -> str: """ 保存HTML报告 Args: html: HTML内容 filename: 文件名（可选） Returns: 文件路径 """ if filename is None: filename = f"ai_assessment_{datetime.now().strftime('%Y%m%d_%H%M%S')}.html" filepath = os.path.join(self.output_dir, filename) with open(filepath, 'w', encoding='utf-8') as f: f.write(html) return filepath ``` ### Technical Analysis The `filename` argument is joined directly to `self.output_dir` without validating that it is a simple basename or confirming that the resolved destination remains inside the intended report directory. A filename containing parent-directory components, such as `../../target`, causes `os.path.join()` to produce a path outside `self.output_dir`. An absolute filename is even more direct: on supported platforms, joining an absolute second component discards the preceding output directory. The file is opened with mode `w`, which creates a new file or truncates an existing file. Therefore, any caller capable of controlling both the filename and report content can write attacker-selected data to any path writable by the process account. The bundled `main()` function uses automatically generated filenames and is not directly exploitable through comm ...[truncated 1329 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/assessment_tool.py:574

Finding

Unescaped Dynamic Values Enable Stored HTML Injection in Generated Reports

Content

View full analysis

个人AI能力测评报告 - {name} ``` ```python

🦞 个人AI能力测评报告

测评对象：{name}

测评时间：{datetime.now().strftime('%Y-%m-%d %H:%M:%S')}

``` ```python # 添加优势 for strength in analysis.get('strengths', []): html += f"

{strength}

\n" # 添加弱势 for weakness in analysis.get('weaknesses', []): html += f"

{weakness}

\n" ``` Additional dynamic values, including dimension names, scores, level data, priorities, and learning suggestions, are also inserted into HTML using formatted strings without contextual escaping. ### Technical Analysis The HTML generator interpolates dynamic values directly into element text, the document title, inline style attributes, and other markup contexts. It does not apply HTML escaping or enforce strict data types. If any interpolated value can be influenced by an untrusted user or upstream service, markup characters such as `<`, `>`, `&`, single quotes, and double quotes retain their syntactic meaning. An attacker can therefore close the current element or attribute and inject new HTML. For example, a crafted assessment name containing an image element with an event handler could be persisted in the generated report. When a recipient opens that report in a browser, the injected markup may execute in the local report context. The same principle applies to attacker-controlled analysis strings or learning suggestions. The bundled demonstration uses fixed values and predefined assessment messages. The expl ...[truncated 1280 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documented trigger phrases are very broad, such as asking generally about one's AI ability or how to improve it, which can easily overlap with normal conversation. In an agent skill system, this can cause unintended activation, leading the assistant to invoke the assessment workflow when the user did not explicitly request this skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description is entirely in Chinese and defines example invocation phrases only in Chinese, which implies the skill is intended to operate in a fixed language. There is no indication that users may choose another language or that the Chinese-only scope is a required regional constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file’s natural-language strings, docstrings, generated Markdown, and generated HTML are written entirely in Chinese, including fixed report labels and UI text. Because the file provides no option for the user to choose language or locale, it effectively enforces a specific language experience, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

整个 README 以中文呈现，并在交互示例中默认使用中文，但没有说明该技能是否仅面向中文用户，或是否支持用户选择其他语言。根据语言/区域策略，若技能隐含强制特定语言而未提供选择，可能构成自然语言政策问题。

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The generated Markdown report includes hard-coded personal contact details and a solicitation for follow-up services that are unrelated to the core function of scoring AI ability. This creates an unnecessary data-sharing and trust boundary issue: users may be steered to external contact channels without consent or business justification, which can enable off-platform solicitation or social engineering.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The HTML output repeats hard-coded external contact information and follow-up solicitation outside the assessment tool's stated purpose. Embedding this into rendered reports increases the chance users will treat the content as endorsed system guidance and initiate off-platform communication, which is a common abuse pattern for unsolicited lead capture or phishing-adjacent behavior.

Content

No source excerpt is available for this finding.