Security audit

进出口许可文档智能预审系统

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent document-audit purpose, but it can automatically modify the host, send sensitive document text to an external LLM, and persist weakly protected API credentials.

Review this skill carefully before installing. Use it only in a controlled environment, avoid confidential documents unless you accept external LLM processing, do not let it auto-install dependencies on a primary machine, and rotate any LLM API key that may have been cached by this version.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: src/utils/check-deps.js:14
Finding: Automatic Download and Execution of Mutable Remote Installation Scripts
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/utils/llm-client.js:510
Finding: Confidential Document Contents Are Sent to a Configurable External LLM Endpoint
Content: View full analysis
maxTextLength ? text.substring(0, maxTextLength) + '\n...（已截断）' : text; const userPrompt = `请分析以下文档，识别类型并提取字段：文件名：${filename} 文档内容： --- ${textToProcess} --- 只返回 JSON，不要任何其他文字！`; const fields = callLLM(EXTRACT_PROMPT, userPrompt, { maxTextLength }); return fields || null; } ``` ```js const payload = { model: config.model, messages: [ { role: 'system', content: systemPrompt }, { role: 'user', content: textToProcess } ], temperature: config.temperature, max_tokens: config.maxTokens }; const result = spawnSync('curl', [ '-s', '-X', 'POST', `${config.apiBase}/chat/completions`, '-H', 'Content-Type: application/json', '-H', `Authorization: Bearer ${config.apiKey}`, '-d', JSON.stringify(payload) ], { encoding: 'utf8' }); ``` ### Technical Analysis OCR output and the original filename are embedded in an LLM request. Import/export contracts and certificates may contain company identities, counterparties, prices, quantities, customs information, contract numbers, and certificate identifiers. The destination is controlled by environment variables, cached configuration, or OpenClaw provider configuration. The implementation does not enforce HTTPS, validate the endpoint against an approved host list, redact sensitive fields, obtain per-run consent, or display the destination before transmission. Use of an LLM is related to the declared field-extraction functionality, but transmitting full OCR content to an unrestricted endpoint exceeds least-privilege data access. ### Attack Path 1. An attacker or misconfiguration controls `LLM_API_BASE`, `OPENCLAW_BASE_URL` ...[truncated 781 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/utils/llm-client.js:26
Finding: LLM API Credentials Are Cached Using a Public Hardcoded Encryption Key
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/utils/extract-archive.js:38
Finding: Untrusted Archives Are Extracted Without Path or Resource Validation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/utils/pdf-ocr.js:18
Finding: Attacker-Controlled PDF Paths Are Interpolated into Executable Python Source
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/index.js:278
Finding: Untrusted Document Instructions Can Manipulate LLM Field Extraction
Content: View full analysis
= 0 && endIdx > startIdx) { jsonStr = jsonStr.substring(startIdx, endIdx + 1); } jsonStr = jsonStr .replace(/,\s*}/g, '}') .replace(/:\s*,/g, ': null,') .replace(/,\s*]/g, ']'); return JSON.parse(jsonStr); ``` ### Technical Analysis OCR text is attacker-controlled data, but it is inserted directly into a natural-language instruction sent to the model. Markdown-style delimiters do not create an enforceable trust boundary. A malicious document can include instructions telling the model to disregard extraction requirements and return fabricated fields. The returned object is parsed but not validated against a strict schema, expected document type, permitted values, or supporting OCR evidence. These fields are then used by local audit rules to determine whether a document should pass. ### Attack Path 1. An attacker embeds prompt-injection text in a PDF or image. 2. OCR extracts the embedded instructions as ordinary document text. 3. The instructions are placed in the LLM user message. 4. The model follows the embedded instructions and returns syntactically valid but fabricated JSON. 5. The pa ...[truncated 535 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (77)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as a local document-audit workflow, but it also accesses local configuration and API secrets and sends data to an external chat-completions service. This is dangerous because extracted trade documents may contain sensitive business data, and users may not realize the content and associated credentials are being used in outbound model-service requests.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as a local document-audit workflow, but it also accesses local configuration and API secrets and sends data to an external chat-completions service. This is dangerous because extracted trade documents may contain sensitive business data, and users may not realize the content and associated credentials are being used in outbound model-service requests.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill is presented as a local document-audit workflow, but it also accesses local configuration and API secrets and sends data to an external chat-completions service. This is dangerous because extracted trade documents may contain sensitive business data, and users may not realize the content and associated credentials are being used in outbound model-service requests.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is presented as a local document-audit workflow, but it also accesses local configuration and API secrets and sends data to an external chat-completions service. This is dangerous because extracted trade documents may contain sensitive business data, and users may not realize the content and associated credentials are being used in outbound model-service requests.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Broad trigger words like '审核' or '许可证' are likely to match normal conversation, which can invoke the skill unexpectedly. In a skill that decompresses files, reads documents, uses shell/network capabilities, and writes reports, accidental activation materially increases the chance of unintended processing or data exposure.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly states it will automatically install runtimes and system packages without any confirmation. Unattended host modification is disproportionate to the stated task and can be abused to execute privileged installers, change the system state, or introduce unsafe dependencies under the guise of document processing.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation promises dependency installation with 'no confirmation' and does not adequately warn about the resulting system changes and security implications. This is particularly risky because users may interpret the skill as a passive document-review tool, not a component that can alter the host via package managers and downloaded installers.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is described as a local license pre-audit tool, but extractFieldsWithLLM sends extracted document text to an LLM service via callLLM. These documents contain commercial and regulatory fields such as contract numbers, counterparties, amounts, and certificate identifiers, so undisclosed transmission to an external model provider can leak sensitive business data and violate user expectations or compliance requirements.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · src/rules/index.js (reported line 25)May include surrounding context.
js
* @returns {Object} 审核摘要 */ function runAllRules(documents) { return ruleSummary.generateSummary(documents, { ruleStamp, ruleContractNo, ruleExporter,

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This file embeds package-manager bootstrap commands and remote installer execution that modify the host system, including fetching and executing scripts from the network. For a document pre-audit skill, that behavior is outside expected scope and materially increases risk because running the skill can lead to privileged system changes unrelated to analyzing documents.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The Homebrew bootstrap command uses curl to fetch a remote shell script and executes it via bash, without any verification or confirmation before modifying the machine. This is a classic high-risk pattern because compromise of the source, transport, or trust assumptions can lead to arbitrary code execution on the host.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The Chocolatey install flow downloads and executes a PowerShell bootstrap script from the network automatically. That exposes the host to arbitrary code execution and persistence risks, particularly because this occurs as part of dependency handling rather than a clearly separated installer stage.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Piping curl output directly into sudo bash is an archetypal dangerous chaining pattern because untrusted network data becomes root-executed code without intermediate inspection. In this skill context, that is especially unjustified because dependency setup is not the core document-audit function.
Content: Scanner excerpt · src/utils/check-deps.js (reported line 38)May include surrounding context.
js
checkCmd: 'node --version', install: { macos: 'brew install node', ubuntu: 'curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt-get install -y nodejs', linux: 'curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt-get install -y nodejs', windows: 'choco install nodejs-lts -y --no-progress' }

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Piping curl output directly into sudo bash is an archetypal dangerous chaining pattern because untrusted network data becomes root-executed code without intermediate inspection. In this skill context, that is especially unjustified because dependency setup is not the core document-audit function.
Content: Scanner excerpt · src/utils/check-deps.js (reported line 38)May include surrounding context.
js
checkCmd: 'node --version', install: { macos: 'brew install node', ubuntu: 'curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt-get install -y nodejs', linux: 'curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt-get install -y nodejs', windows: 'choco install nodejs-lts -y --no-progress' }

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: This is the same pipe-to-sudo execution pattern on the alternate Linux target and carries the same arbitrary root code execution risk. The mismatch between expected functionality and actual host modification makes it more dangerous in an agent skill setting.
Content: Scanner excerpt · src/utils/check-deps.js (reported line 39)May include surrounding context.
js
install: { macos: 'brew install node', ubuntu: 'curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt-get install -y nodejs', linux: 'curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt-get install -y nodejs', windows: 'choco install nodejs-lts -y --no-progress' } },

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: This is the same pipe-to-sudo execution pattern on the alternate Linux target and carries the same arbitrary root code execution risk. The mismatch between expected functionality and actual host modification makes it more dangerous in an agent skill setting.
Content: Scanner excerpt · src/utils/check-deps.js (reported line 39)May include surrounding context.
js
install: { macos: 'brew install node', ubuntu: 'curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt-get install -y nodejs', linux: 'curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt-get install -y nodejs', windows: 'choco install nodejs-lts -y --no-progress' } },

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The main entrypoint calls automatic installation immediately when dependencies are missing and explicitly states it will not ask for confirmation. That means invoking the skill can unexpectedly alter the host environment, violating least surprise and creating a dangerous side effect for a tool whose purpose is document analysis.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code path for missing dependencies proceeds directly into installation without a prior approval step, despite potentially invoking privileged package installation. Automatic remote and system-modifying actions without consent create a strong supply-chain and host-integrity risk, especially in an agent skill context where users may expect passive analysis only.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code claims encrypted cache storage, but encrypt() returns plaintext on failure and decrypt() returns the original input on failure, allowing silent fallback to unprotected secret storage or ambiguous handling. Combined with the hardcoded default key, cached API credentials may be recoverable even when 'encryption' appears enabled, which is especially dangerous for a document-processing skill handling sensitive commercial records.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares capabilities consistent with environment access, shell execution, and network activity but does not scope or disclose them through explicit tool permissions. That makes the operational boundary unclear and increases the chance that a document-processing skill can perform unexpected host or network actions without informed user approval.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: L013-L014 仅给出中文触发词“审核/审核许可证/许可证”，整体交互说明也默认中文，没有说明是否支持其他语言或允许用户自行选择语言。这种默认强制单一语言的设计可能构成语言/locale 策略问题，尤其在面向跨平台或多语言用户时。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The skill automatically extracts archives, processes uploaded files, and writes report artifacts, but the user-facing description does not foreground these side effects strongly enough. Insufficient disclosure undermines informed consent, especially when handling potentially sensitive commercial documents.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions explicitly require the assistant to read the generated Markdown report and paste its full contents into chat. Because the report contains extracted contract, importer, manufacturer, amount, and certificate data, this can disclose sensitive business information into a broader conversation channel than necessary.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documented behavior expands from auditing documents into initializing runtimes and external tooling across platforms. This broadens the trust boundary and operational risk, because the skill becomes a host-setup mechanism rather than a narrow data-processing utility.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script's comments and all user-facing echo output are in Chinese, including operational instructions shown after packaging. This imposes a specific language on users without opt-in or justification, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.