Security audit

龙虾教研日报助手

Security checks for vulnerabilities and agentic risk

Overview

The skill’s Tencent Docs reporting purpose is real, but it has review-worthy risks around shared-report data exposure, unpinned runtime code execution, and credential/input handling.

Review before installing. Use this only in an environment where all users are allowed to see the shared Tencent Docs report sheet, pin and vet mcporter before running it, avoid entering tokens directly on the command line, and treat the workspace memory and mcporter configuration as sensitive.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/daily-report.sh:153
Finding: Monthly report queries fail to enforce user-level record isolation
Content: View full analysis
/dev/null || echo "0") local last_day=$(date -d "${year}-${month}-01 +1month -1day" +%Y-%m-%d 2>/dev/null || echo "${year}-${month}-28") end_ts=$(date -d "$last_day 23:59:59" +%s000 2>/dev/null || echo "0") npx -y mcporter call "tencent-docs" "smartsheet.list_records" \ --args "{ \"file_id\": \"$FILE_ID\", \"sheet_id\": \"$SHEET_ID\", \"limit\": 500 }" 2>/dev/null | python3 -c " import sys, json, datetime try: data = json.load(sys.stdin) records = data.get('records', []) results = [] for rec in records: fields = rec.get('field_values', []) rec_info = {} for f in fields: fname = f.get('field', '') if '日期' in fname: try: ts = int(f.get('string_value', 0)) rec_info['date'] = datetime.datetime.fromtimestamp(ts/1000).strftime('%Y-%m-%d') except: rec_info['date'] = '' elif '工时' in fname: rec_info['hours'] = f.get('number_value', 0) elif '工作内容' in fname: texts = f.get('text_value', {}).get('items', []) rec_info['content'] = ''.join(t.get('text', '') for t in texts) elif '类型' in fname: rec_info['type'] = f.get('option_value', {}).get('items', [{}])[0].get('text', '') if rec_info: rec_info['id'] = rec.get('record_id', '') results.append(rec_info) # Filter by month ...[truncated 2290 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: package.json:10
Finding: Unpinned npm package is automatically downloaded and executed at runtime
Content: View full analysis
/dev/null 2>&1; then echo "ERROR:mcporter_not_configured" return 1 fi ``` ```bash result=$(npx -y mcporter call "tencent-docs" "smartsheet.add_records" \ --args "{ \"file_id\": \"$FILE_ID\", \"records\": [{ \"fields\": { \"日期\": \"$date_ts\", \"姓名\": {\"items\": [\"$RECORD_ID\"]}, \"项目名称\": {\"items\": [\"$project_id\"]}, \"工时\": $hours, \"工作内容\": \"$content\", \"类型\": \"$work_type\" } }], \"sheet_id\": \"$SHEET_ID\" }" 2>&1) ``` ### Technical Analysis The dependency is declared as `latest`, and scripts repeatedly invoke it through `npx -y mcporter`. This permits npm to resolve, download, and execute a version that was not present during the Skill audit. There is no lockfile or exact version constraint in the audited project. Therefore, the effective executable can change independently of the reviewed Skill package. If the npm account, registry entry, package distribution, or a future release is compromised, the replacement package can execute with the privileges of the Agent user. Because the tool handles Tencent Docs authorization and runs inside the Agent workspace, a compromised package could access local files, environment variables, stored tool co ...[truncated 1278 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/daily-report.sh:57
Finding: User-controlled report fields are inserted into JSON without serialization or validation
Content: View full analysis
&1) if echo "$result" | grep -q '"error":""'; then echo "WRITE_OK" return 0 else echo "WRITE_FAILED:$result" return 1 fi } ``` The leave and overtime paths use the same unsafe construction: ```bash \"工时\": $hours, \"工作内容\": \"请假：$note\", \"类型\": \"非研发\" ``` ```bash \"工时\": $hours, \"工作内容\": \"加班：$note\", \"类型\": \"非研发\" ``` ### Technical Analysis Shell variables are directly interpolated into a JSON string. Inputs such as `content`, `note`, `work_type`, `project_id`, `RECORD_ID`, and `hours` are not encoded with a JSON serializer. A quotation mark, backslash, newline, or JSON delimiter in a string field can terminate or alter the intended JSON value. The `hours` field is inserted as raw JSON rather than being parsed and validated as a bounded number. An attacker can therefore attempt to introduce additional JSON properties or records. This is JSON-structure ...[truncated 1766 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/setup.sh:59
Finding: Tencent Docs authorization token is exposed through process arguments and shell history
Content: View full analysis
&1 echo "TOKEN_SET" } ``` The documented and implemented interface requires the token on the command line: ```bash bash setup.sh auth ``` ```bash auth) local token="${1:-}" if [[ -z "$token" ]]; then error "Please provide a token: bash setup.sh auth " exit 1 fi set_token "$token" ;; ``` ### Technical Analysis The authorization token is supplied as a positional shell argument and then forwarded in the argument vector of an `npx` child process as `Authorization=$token`. Command-line secrets may be retained in interactive shell history. While the process is running, command arguments may also be visible through process inspection interfaces or diagnostic and monitoring tools, depending on operating-system permissions and configuration. The script delegates persistent storage to mcporter using home scope, but it does not verify or enforce restrictive permissions on the resulting credential file. The primary confirmed issue in this code is command-line disclosure. ### Attack Path 1. The user runs: ```bash bash scripts/setup.sh auth ``` 2. The shell may save the complete command, including the token, in its history file. 3. The script starts `npx` with `Authorization=` in its process arguments. 4. A local user, monitoring agent, support bundle, process logger, or diagnostic utility with sufficient access observes the arguments or history. 5. The observer extracts the token. 6. The observer reuses the token against Tencent Docs within the authorization scope granted to it. ### Impact ...[truncated 516 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a reporting assistant whose main functions are collecting daily work reports, auto-writing them to Tencent Docs, and generating monthly summaries. The supplied code chunk does not implement any of those core behaviors. Instead, it is a project-matching helper: it uses hardcoded keyword rules to map a work description to a project ID/name/type, can list cached projects, and can refresh that cache by calling Tencent Docs smartsheet.list_records. While Tencent Docs is involved, the interaction is read-oriented for project metadata, not report creation or summary generation. This is a materially different primary purpose, so the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The supplied code chunk is not the reporting skill itself; it is an initialization/setup utility. Its primary purpose is to configure Tencent Docs access and associate the user with a personnel record. It checks for Node/npx and mcporter, sets and verifies an authorization token, queries Tencent Docs sheets for personnel names, and stores user configuration locally. While this is related to the declared ecosystem (Tencent Docs, Node/npm, token requirement), it does not actually perform the main declared functions of logging daily work through conversation, auto-writing reports, or generating monthly summaries. Therefore the description does not accurately represent this code chunk's actual behavior.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
md
| `SKILL.md` | 技能说明（本文件） |

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The title and core usage description instruct the user in Chinese only, including the claim that users can complete reporting 'just by conversation,' but there is no indication that other languages are supported or that Chinese is optional. This is a natural-language locale constraint presented as the default interaction mode without user choice or documented justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The package description is written entirely in Chinese and presents the skill as a Chinese-language assistant, with no indication that users may choose another language or locale. This can violate language/locale policy when the skill implicitly constrains interaction language without explicit opt-in or documented justification.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The skill executes an MCP-related tool via npx -y mcporter --version without pinning an exact package version, which means a different package version may be fetched at runtime. This creates a supply-chain risk: a compromised or newly malicious release could execute attacker-controlled code during install or invocation, especially because npx retrieves and runs code automatically.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: 文件标题和全文均以中文撰写，且未说明这是面向特定中文用户群或提供其他语言选项。根据规则，若技能在自然语言层面强制特定语言而没有用户选择或明确、合理的区域性说明，应视为潜在策略违规。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: All user-facing strings, help text, and invocation guidance in the script are written in Chinese, including the setup instruction and command descriptions. There is no indication that users may opt into another language or that the locale restriction is explicitly justified, which can violate language/locale policy requirements.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The script invokes npx -y mcporter without pinning an exact package version, so execution depends on whatever version npm resolves at runtime. In this skill's context, that package is used to send authenticated requests containing work-report data to Tencent Docs, so a malicious or compromised upstream release could execute arbitrary code locally or exfiltrate tokens and report contents.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script sends user-identifying and work-content data, including name linkage, project linkage, hours, and report text, to the Tencent Docs API via mcporter. Although comments describe that the module writes to Tencent Docs, the executable paths for write, leave, and overtime do not present any runtime warning, confirmation, or explicit user disclosure before transmitting this data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This is the same unsafe runtime dependency pattern: npx -y mcporter fetches and runs code without version pinning. Because this path writes leave data tied to a user identity record, compromise of the package could tamper with records or steal credentials and personal HR-related information.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The overtime-record write path also executes mcporter via unpinned npx, exposing the host to supply-chain compromise every time the command runs. Since the script may run in /root/.openclaw/workspace, a malicious package could gain broad local access in addition to modifying or leaking business data.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Monthly record reads depend on the same unpinned npx -y mcporter execution, so even read-only operations can trigger arbitrary third-party code download and execution. In context, this is especially risky because read operations may be perceived as harmless, increasing the chance users run the script without scrutiny while exposing report history and access tokens.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The refresh_project_cache function retrieves records from a remote Tencent Docs endpoint via mcporter and saves the processed results to PROJECT_CACHE. Although it prints "Cache refreshed" afterward, there is no prior warning in comments, help text, or prompts that remote data will be fetched and persisted locally under the workspace memory directory.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The script executes npx -y mcporter without pinning an exact package version or verifying integrity, so every refresh can fetch and run whatever code is currently published under that package name. In a skill that handles Tencent Docs access and writes local cache files, a compromised package, dependency, or registry response could lead to arbitrary code execution and theft of tokens or workspace data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Comments, help output, and runtime error messages are presented only in Chinese, which imposes a specific language on users. The file does not offer an alternative language, locale selection, or document that the skill is intentionally limited to a Chinese-only audience.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The script invokes npx -y mcporter without pinning an exact package version, so execution may pull whatever version is current at runtime. In a setup script that handles authorization tokens and writes configuration, this creates a supply-chain risk where a compromised or unexpectedly changed package could execute arbitrary code or capture secrets.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This call also executes mcporter via unpinned npx, allowing silent package drift or malicious package substitution at runtime. Because this path checks auth against Tencent Docs, a hostile package could intercept API arguments, environment variables, or returned data during a sensitive authorization flow.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Here the unpinned npx invocation is used while configuring the Tencent Docs connector with an Authorization header token. If the resolved package is malicious or tampered with, it could exfiltrate the token immediately, leading to unauthorized access to the user's Tencent Docs resources.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The token verification path again relies on an unpinned runtime package fetch and execution. This is dangerous because the script's trust boundary includes secret-bearing setup operations, so supply-chain compromise could result in arbitrary code execution and credential theft.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Listing records through an unpinned npx package is still a real security issue because it grants a remotely resolved package code execution in the user's environment and access to document metadata. Even though this call may not directly pass the token on the command line, the package can access configured credentials and retrieved personal data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The function creates a directory and writes a persistent markdown file containing the user's name, record_id, authorization state, and configuration details. Although there is an informational message after saving, the script does not warn the user beforehand that personal data will be stored on disk in a workspace path.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: Using "mcporter": "latest" as an optional dependency makes builds non-reproducible and exposes consumers to unexpected code changes whenever the upstream package updates. If the package is compromised or a bad release is published, environments installing optional dependencies may pull and execute unreviewed code.
Content: Scanner excerpt · package.json (reported line 11)May include surrounding context.
json
}, "dependencies": {}, "optionalDependencies": { "mcporter": "latest" }, "tools": { "mcporter": {

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The script reads personal configuration values such as 姓名 and record_id from user-config.md, which are then used to identify the user in remote record operations. While this is part of the skill's function, there is no explicit user-facing notice in the command handlers that personal identifiers from local config will be used for remote writes and reads.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Natural-language strings throughout the file, including the title, usage text, and error/help messages, require Chinese and do not provide an opt-in or alternative locale. Under the policy, forcing a specific language without user choice can be a locale-policy violation unless the regional constraint is explicitly justified.
Content: No source excerpt is available for this finding.