个人AI能力测评工具

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:51 AM UTC
• Version: 1.0.0

Overview

This is a local Chinese-language AI self-assessment/report tool with some quality and disclosure issues, but no evidence of hidden execution, exfiltration, persistence, or purpose-incompatible behavior.

Install only if you are comfortable with a Chinese-language local report generator that writes assessment files under ~/.openclaw/workspace and includes fixed contact/branding text in reports. Avoid exposing its filename or HTML report inputs directly to untrusted users without validation and escaping.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Note

• Location: scripts/assessment_tool.py:523
• Finding: Undisclosed Promotional Content Is Unconditionally Injected into Generated Reports<![CDATA[ ## Vulnerability Details **File Location**: `scripts/assessment_tool.py`, lines 523-535 and 814-826 **Vulnerability Type**: Unconditional output manipulation **Risk Level**: Low ### Vulnerable Code ```python ## 📞 后续支持 如需进一步咨询或定制学习计划，请联系： - 邮箱：[e-mail] - 飞书：@胡大大 --- **报告生成**：个人AI能力测评工具 v1.0 **小龙虾协助制作** 🦞 ``` The HTML report generator contains the equivalent fixed promotional block: ```html <div class="footer"> <h3>📞 后续支持</h3> <p style="margin-top: 15px;">如需进一步咨询或定制学习计划，请联系：</p> <p style="margin-top: 10px;">📧 邮箱：[e-mail]</p> <p style="margin-top: 30px; opacity: 0.7;"> 报告生成：个人AI能力测评工具 v1.0<br> 小龙虾协助制作 🦞 </p> </div> ``` ### Technical Analysis Both report generators unconditionally append fixed third-party contact information and branding to their output. The caller cannot disable this behavior through a documented option. The skill documentation describes assessment reports as the primary output but does not clearly disclose that every generated report will contain a fixed email address, messaging contact, and promotional attribution. Consequently, invoking the skill modifies user-facing output for a purpose unrelated to calculating or presenting the assessment results. This is best classified as skill instruction hijacking because the skill consistently changes the agent-delivered result by inserting attacker- or publisher-selected content. It does not modify system safety constraints or grant operating-system privileges, so its technical severity is limited. ### Attack Path 1. A user asks the agent to perform an AI capability assessment. 2. The agent invokes the report generator. 3. `generate_report()` or `generate_html_report()` appends the fixed footer without requesting user consent. 4. The generated report directs the user toward a predetermined email address or messaging contact. 5. If the report is shared, the same promotional material is propagated to additional recipients. ### ...[truncated 413 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove fixed contact details and promotional branding from the default report templates. 2. If attribution is necessary, expose an explicit configuration option that defaults to disabled. 3. Clearly disclose optional attribution and contact content before report generation. 4. Keep assessment output limited to information requested by the user. 5. Add tests confirming that reports contain no external contact information unless the caller explicitly opts in. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/assessment_tool.py:884
• Finding: Caller-Controlled Filenames Permit Writes Outside the Report Directory<![CDATA[ ## Vulnerability Details **File Location**: `scripts/assessment_tool.py`, lines 884-924 **Vulnerability Type**: Path traversal and arbitrary file overwrite **Risk Level**: High ### Vulnerable Code ```python def save_report(self, report: str, filename: str = None) -> str: """ 保存Markdown报告 Args: report: 报告内容 filename: 文件名（可选） Returns: 文件路径 """ if filename is None: filename = f"ai_assessment_{datetime.now().strftime('%Y%m%d_%H%M%S')}.md" filepath = os.path.join(self.output_dir, filename) with open(filepath, 'w', encoding='utf-8') as f: f.write(report) return filepath def save_html_report(self, html: str, filename: str = None) -> str: """ 保存HTML报告 Args: html: HTML内容 filename: 文件名（可选） Returns: 文件路径 """ if filename is None: filename = f"ai_assessment_{datetime.now().strftime('%Y%m%d_%H%M%S')}.html" filepath = os.path.join(self.output_dir, filename) with open(filepath, 'w', encoding='utf-8') as f: f.write(html) return filepath ``` ### Technical Analysis The `filename` argument is joined directly to `self.output_dir` without validating that it is a simple basename or confirming that the resolved destination remains inside the intended report directory. A filename containing parent-directory components, such as `../../target`, causes `os.path.join()` to produce a path outside `self.output_dir`. An absolute filename is even more direct: on supported platforms, joining an absolute second component discards the preceding output directory. The file is opened with mode `w`, which creates a new file or truncates an existing file. Therefore, any caller capable of controlling both the filename and report content can write attacker-selected data to any path writable by the process account. The bundled `main()` function uses automatically generated filenames and is not directly exploitable through comm ...[truncated 1329 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Accept only a filename basename rather than an arbitrary path. 2. Reject absolute paths, parent-directory components, path separators, null bytes, and unexpected extensions. 3. Resolve and validate the final destination before writing: ```python from pathlib import Path base = Path(self.output_dir).resolve() name = Path(filename) if name.is_absolute() or name.name != filename: raise ValueError("Invalid report filename") destination = (base / name).resolve() if destination.parent != base: raise ValueError("Report path escapes the output directory") ``` 4. Allow-list the expected extension: `.md` for Markdown reports and `.html` for HTML reports. 5. Use exclusive creation mode (`x`) when overwriting existing reports is unnecessary. 6. Where overwriting is required, use an atomic temporary-file-and-rename pattern. 7. Add tests for `../`, nested traversal, absolute paths, symbolic-link edge cases, and platform-specific separators. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/assessment_tool.py:574
• Finding: Unescaped Dynamic Values Enable Stored HTML Injection in Generated Reports<![CDATA[ ## Vulnerability Details **File Location**: `scripts/assessment_tool.py`, lines 574-846 **Vulnerability Type**: Stored HTML injection **Risk Level**: Medium ### Vulnerable Code ```python html = f"""<!DOCTYPE html> <html lang="zh-CN"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>个人AI能力测评报告 - {name}</title> ``` ```python <div class="header"> <h1>🦞 个人AI能力测评报告</h1> <div class="subtitle"> <div>测评对象：{name}</div> <div>测评时间：{datetime.now().strftime('%Y-%m-%d %H:%M:%S')}</div> </div> </div> ``` ```python # 添加优势 for strength in analysis.get('strengths', []): html += f" <li>{strength}</li>\n" # 添加弱势 for weakness in analysis.get('weaknesses', []): html += f" <li class=\"weak\">{weakness}</li>\n" ``` Additional dynamic values, including dimension names, scores, level data, priorities, and learning suggestions, are also inserted into HTML using formatted strings without contextual escaping. ### Technical Analysis The HTML generator interpolates dynamic values directly into element text, the document title, inline style attributes, and other markup contexts. It does not apply HTML escaping or enforce strict data types. If any interpolated value can be influenced by an untrusted user or upstream service, markup characters such as `<`, `>`, `&`, single quotes, and double quotes retain their syntactic meaning. An attacker can therefore close the current element or attribute and inject new HTML. For example, a crafted assessment name containing an image element with an event handler could be persisted in the generated report. When a recipient opens that report in a browser, the injected markup may execute in the local report context. The same principle applies to attacker-controlled analysis strings or learning suggestions. The bundled demonstration uses fixed values and predefined assessment messages. The expl ...[truncated 1280 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Escape every untrusted value inserted into HTML: ```python from html import escape safe_name = escape(str(name), quote=True) safe_strength = escape(str(strength), quote=True) safe_weakness = escape(str(weakness), quote=True) ``` 2. Apply contextual escaping to all dynamic fields, not only the assessment name. 3. Validate scores as bounded integers before using them in text, SVG coordinates, or CSS width declarations. 4. Prefer a template engine with automatic HTML escaping enabled. 5. Avoid inserting untrusted data into inline style or script contexts. 6. Add a restrictive Content Security Policy when reports may be hosted over HTTP. 7. Add regression tests using payloads containing HTML elements, event handlers, quotes, ampersands, and closing tags. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The documented trigger phrases are very broad, such as asking generally about one's AI ability or how to improve it, which can easily overlap with normal conversation. In an agent skill system, this can cause unintended activation, leading the assistant to invoke the assessment workflow when the user did not explicitly request this skill.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The manifest description is entirely in Chinese and defines example invocation phrases only in Chinese, which implies the skill is intended to operate in a fixed language. There is no indication that users may choose another language or that the Chinese-only scope is a required regional constraint.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This Python file’s natural-language strings, docstrings, generated Markdown, and generated HTML are written entirely in Chinese, including fixed report labels and UI text. Because the file provides no option for the user to choose language or locale, it effectively enforces a specific language experience, which matches the language/locale policy violation criteria.

Natural-Language Policy Violations

Low

• Confidence: 81% confidence
• Finding: 整个 README 以中文呈现，并在交互示例中默认使用中文，但没有说明该技能是否仅面向中文用户，或是否支持用户选择其他语言。根据语言/区域策略，若技能隐含强制特定语言而未提供选择，可能构成自然语言政策问题。

Context-Inappropriate Capability

Low

• Confidence: 94% confidence
• Finding: The generated Markdown report includes hard-coded personal contact details and a solicitation for follow-up services that are unrelated to the core function of scoring AI ability. This creates an unnecessary data-sharing and trust boundary issue: users may be steered to external contact channels without consent or business justification, which can enable off-platform solicitation or social engineering.

Context-Inappropriate Capability

Low

• Confidence: 94% confidence
• Finding: The HTML output repeats hard-coded external contact information and follow-up solicitation outside the assessment tool's stated purpose. Embedding this into rendered reports increases the chance users will treat the content as endorsed system guidance and initiate off-platform communication, which is a common abuse pattern for unsolicited lead capture or phishing-adjacent behavior.

Static analysis

No suspicious patterns detected.