09 AI编程

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:11 AM UTC
• Version: 1.0.0

Overview

This is a Chinese-language tutorial for creating OpenClaw skills, with no executable payload, though users should be careful with its broad trigger examples and unpinned pip install advice.

Install only if you want a Chinese-language guide for writing OpenClaw skills. Treat its examples as templates, not policy: use specific trigger phrases, require confirmation before sensitive tool calls, avoid relying on vague remembered instructions, and install Python packages in a virtual environment with reviewed pinned versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: guides/OpenClaw如何学习文档说明.md:62

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: guides/OpenClaw如何学习文档说明.md, line 62
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Complete Code Snippet

bash

pip install requests pandas numpy

The same unsafe installation command is repeated at line 327.

Technical Analysis

The documentation instructs users to install third-party packages without pinned versions, cryptographic hashes, a lockfile, or explicit package-index validation. Consequently, package resolution depends on mutable releases and the user's currently configured Python package index.

A compromised package release, transitive dependency, or configured mirror could supply malicious installation or runtime code. Installation may execute package build hooks with the privileges of the user running pip. The absence of version constraints also makes the environment non-reproducible and allows future incompatible or vulnerable releases to be selected automatically.

No evidence indicates that the named packages are currently malicious; the finding concerns the unsafe dependency-installation practice.

Attack Path

1. A user follows the documented pip install command.
2. pip queries its configured package index and resolves the latest available releases and transitive dependencies.
3. An attacker compromises a resolved release, transitive dependency, or configured package mirror.
4. pip downloads and installs the attacker-controlled artifact.
5. Malicious build, installation, import-time, or runtime code executes locally.
6. The payload operates with the permissions of the account that invoked pip.

Impact Assessment

Successful exploitation could result in arbitrary code execution under the invoking user's account. Accessible scope may include that user's files, environment variables, credentials, project data, and network permissions. If the command is run from an elevated environment, the impact may expand accordingly. The practice ...[truncated 78 chars]

Remediation

View remediation

Remediation Suggestions

1. Define reviewed, exact dependency versions in a requirements or lock file.
2. Generate and verify cryptographic hashes for every direct and transitive dependency.
3. Install with hash enforcement, for example:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Use an explicitly configured and trusted package index rather than relying on ambient user configuration.
5. Install dependencies inside an isolated virtual environment using a non-privileged account.
6. Review dependency provenance and vulnerability advisories before updating locked versions.
7. Replace both occurrences of the unrestricted installation command with the hardened installation workflow.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

- ✅ 读取 `SKILL.md`

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest description, tags, headings, and instructional content are entirely in Chinese, and the file does not indicate that language selection is optional or region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

步骤1：创建技能目录

bash

mkdir -p ~/.openclaw/skills/my-skill/references

步骤2：编写SKILL.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

步骤1:创建技能目录

bash

mkdir -p ~/.openclaw/skills/my-skill/references

步骤2:编写SKILL.md

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The example usage says "当我说"XXX"时，请调用YYY工具" without requiring domain-specific trigger phrases, exclusions, or negative examples. This teaches a broad activation pattern that could overlap with ordinary conversation and cause unintended tool invocation in downstream skills.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The dialogue instructs OpenClaw to call a tool whenever the user says "执行XXX," but provides no boundaries for matching, no exclusions, and no examples of similar phrases that should not activate the tool. In a skill-authoring guide, this can propagate vague trigger design into created skills.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

解决：

bash

# 确认位置
ls ~/.openclaw/skills/your-skill/SKILL.md

# 验证格式
head -5 ~/.openclaw/skills/your-skill/SKILL.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

解决：

bash

# 确认位置
ls ~/.openclaw/skills/your-skill/SKILL.md

# 验证格式
head -5 ~/.openclaw/skills/your-skill/SKILL.md

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · guides/OpenClaw如何学习文档说明.md (reported line 10)May include surrounding context.

如果你把MD文档放在正确的位置：

text

~/.openclaw/skills/fpsp-advisor/SKILL.md

OpenClaw会：

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document defines invocation behavior using broad natural-language triggers like asking OpenClaw to call an API when the user says certain phrases, but it does not constrain matching rules, confirmation requirements, or parameter validation. In an agent/tool-calling context, ambiguous triggers can cause unintended tool execution, especially when similar phrases appear in unrelated conversations or when prompt injection attempts try to reuse those trigger patterns.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · guides/OpenClaw如何学习文档说明.md (reported line 123)May include surrounding context.

第1步：创建skill目录

bash

mkdir -p ~/.openclaw/skills/my-stock-api

第2步：创建SKILL.md（关键格式）

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The guide suggests that once taught, OpenClaw will 'remember rules' and automatically reuse prior instructions in later interactions, but it does not clearly define session boundaries, trust model, or revocation behavior. This can enable unsafe persistence of tool-use policies across prompts, making it easier for stale, manipulated, or attacker-influenced instructions to be replayed and trigger actions without renewed user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file instructs users to run pip install commands for third-party packages without any safety guidance such as verifying package sources, pinning versions, or using isolated environments. While common, this normalizes executing package-manager commands from documentation and increases supply-chain and environment-compromise risk if users follow the pattern with untrusted or typosquatted packages.

Content

No source excerpt is available for this finding.