T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:214- Finding
Mandatory Promotional Suffix Hijacks Every Agent Response
- Content
View full analysis
- Remediation
View remediation
Security audit
Odaily Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches a crypto market/news assistant, but it needs review because its instructions can run local code from a loosely discovered directory and reinstall unpinned packages during use.
Review this skill before installing. Use it only in an isolated environment, avoid the loose find-based invocation, pin and install dependencies in a controlled setup, and expect outbound calls to crypto/news APIs plus optional Supabase writes if Supabase credentials are configured.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T07 · Tool Hijacking and Spoofing
Error
- Location
SKILL.md:15- Finding
Loose Skill-Directory Discovery Can Execute a Spoofed Local Tool
- Content
View full analysis
/dev/null | head -1 | xargs dirname 2>/dev/null) && cd "$SKILL_DIR" && pip install -r requirements.txt -q 2>/dev/null && python3 run.py <工具名> '' ``` ### Technical Analysis The command searches two broad user-controlled directory trees for any `run.py` whose path loosely matches `*/odai*`. It then selects the first result with `head -1`, changes into that directory, installs its dependencies, and executes its `run.py`. The selected directory is not validated against: - The canonical installation path. - The Skill package identifier. - A trusted manifest or signature. - Expected file hashes. - Repository ownership or provenance. Consequently, another local package or a planted directory with a matching name can be selected instead of the intended Skill. The use of `head -1` makes selection dependent on filesystem traversal order rather than trust. The command also executes both the discovered `requirements.txt` installation process and the discovered `run.py`, increasing the number of executable surfaces available to a spoofed directory. ### Attack Path 1. An attacker with the ability to create files in the user's home directory creates a directory under `~/.openclaw` or `~/.claude` whose path contains a component beginning with `odai`. 2. The attacker places a malicious `run.py` and, optionally, a malicious `requirements.txt` in that directory. 3. The planted `run.py` is arranged to appear first in the `find` traversal results. 4. The user invokes the Odaily Skill. 5. The discovery command assigns the attacker's directory to `SKILL_DIR`. 6. `pip install -r requirements.txt` processes attacker-controlled dependencies. 7. `python3 run.py ...` executes attacker-controlled Python code with th ...[truncated 672 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Every Invocation Installs Open-Ended Third-Party Dependency Versions
- Content
View full analysis
/dev/null | head -1 | xargs dirname 2>/dev/null) && cd "$SKILL_DIR" && pip install -r requirements.txt -q 2>/dev/null && python3 run.py <工具名> '' ``` `requirements.txt:1-2`: ```text requests>=2.31.0 beautifulsoup4>=4.12.0 ``` ### Technical Analysis The Skill runs `pip install -r requirements.txt` during every tool invocation. The dependency declarations use minimum-version constraints rather than exact versions and provide no artifact hashes. As a result, the code reviewed during the audit does not fully determine which dependency artifacts will be installed in the future. A later release satisfying the version range can be installed without a corresponding Skill update or security review. Running package installation as part of normal execution unnecessarily expands the runtime attack surface. It also suppresses installation errors through redirected standard error, making unexpected dependency changes and installation failures less visible. This is a supply-chain hardening failure. The reviewed dependency names are legitimate, and the audit found no evidence that the current packages are malicious; the risk arises from open-ended future resolution and repeated runtime installation. ### Attack Path 1. A dependency release satisfying `requests>=2.31.0` or `beautifulsoup4>=4.12.0` is compromised, malicious, or otherwise unsafe. 2. Alternatively, the configured Python package index or network path is compromised. 3. The user invokes any Skill tool. 4. The Skill automatically runs `pip install -r requirements.txt`. 5. Pip resolves and installs the affected artifact. 6. Malicious package behavior may execute during installation or later ...[truncated 646 chars]- Remediation
View remediation
--hash=sha256: beautifulsoup4== --hash=sha256: ``` 4. Install dependencies once during a controlled installation phase rather than on every invocation. 5. Use a dedicated virtual environment with restricted permissions. 6. Configure pip to use an approved package index and require TLS certificate validation. 7. Do not suppress installation diagnostics; log dependency resolution and verification failures. 8. Introduce scheduled dependency review and vulnerability scanning before updating locked versions. ]]>
T01 · Skill Instruction Hijacking
Note
- Location
tools/tomorrow_watch.py:83- Finding
Tomorrow-Watch Output Always Appends a Fixed Traffic-Diversion Link
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (43)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Using a single generic word like
日报as a full-activation trigger is especially risky because it is common in ordinary conversation and can easily fire the entire multi-module workflow. Since the workflow chains several data-fetching operations and model usage, accidental activation can amplify cost, data exposure, and unintended behavior.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 89% confidence
- Finding
The declared description presents a higher-level intelligent assistant that synthesizes crypto information into structured, decision-oriented market outputs across multiple analytical modules. In contrast, the supplied code only accesses Odaily's newsflash and post APIs, extracts lists, formats timestamps, strips HTML, and returns normalized dictionaries. The only somewhat related feature is
get_polymarket_news, which filters flash items containing a keyword, but this is far short of true prediction-market anomaly detection or whale tracking. Therefore, the actual behavior is materially narrower and more basic than the declared purpose.- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a broad crypto market intelligence assistant that analyzes crypto information across three major signal sources and provides five substantial modules. The supplied code, however, is a focused utility client for Polymarket only: it performs HTTP GET requests, retrieves whale trades, filters large/high-price trades, and fetches currently hot prediction-market events. While the code partially overlaps with the declared '预测市场异动+聪明巨鲸尾盘追踪' module, it does not implement the broader assistant behavior, news structuring, market analysis, tomorrow-event analysis, or decision-oriented output described. Therefore the description materially overstates and misrepresents what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
There is a material description-to-behavior mismatch. The code chunk is narrowly scoped to the 'API模块化调用' portion: it calls two Odaily Web API endpoints, parses article/newsflash data, strips HTML, formats timestamps, and renders a textual summary. It does not analyze price signals, capital flows, events, tomorrow's key events, prediction markets, or whale activity, despite those being prominent parts of the declared description. While one declared module does match the implementation, the declared primary purpose is much broader than the actual behavior shown in this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description presents a multi-module crypto market intelligence assistant with analytical and decision-support capabilities across several signal sources. The supplied code chunk only supports one narrow subfunction: collecting and formatting Odaily hot articles and flash news into a '今日必关注' digest. It does not analyze price, funds, or events in a structured way, nor does it implement the other listed modules. While the implemented function is related to one named module in the description, the overall declared purpose materially overstates what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a comprehensive crypto market intelligence assistant centered on three signal sources—price, funds, and events—and five higher-level modules related to news digestion, market analysis, event tracking, and whale/prediction-market monitoring. The supplied code, however, is a focused technical-analysis function for a token's price trend across multiple timeframes. It retrieves price and kline data, runs trend analysis, and formats technical indicators. While this partially overlaps with the broad notion of 'market analysis' via price signals, it does not implement the majority of the declared functionality and has a materially narrower primary purpose. Therefore, the description does not accurately represent this code chunk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The architecture explicitly states that natural language input can trigger the skill without requiring precise commands, which increases the chance of accidental or overly broad invocation. In an agent environment, loose trigger conditions can cause the wrong module to run, fetch external data unexpectedly, or expose users to unintended analysis paths based on ambiguous prompts.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The feature description states that Polymarket events are '自动翻译中文', which imposes a specific language/locale behavior by default. The README does not indicate that users can choose another language or opt into Chinese translation.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 91% confidence
- Finding
The README instructs users to run an unpinned
npx skillscommand, which fetches and executes code from the npm ecosystem without version locking. This creates a supply-chain risk: a malicious or compromised upstream package/version could execute arbitrary code during installation.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger keywords are broad enough to match common user language, increasing the chance of accidental tool invocation when the user is speaking generally rather than explicitly requesting this skill. In an agent environment, this can cause unintended external data fetches, token consumption, and confusing or privacy-impacting behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The tool trigger lists include many generic finance and news terms without clear boundaries, making routing collisions and false activations likely. In a conversational agent, overlapping broad triggers can cause the wrong tool to run or trigger external calls when the user only wants discussion or analysis.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill invokes local shell and Python with dependency installation and network access, but declares no explicit tool scope or permission boundaries. This increases the chance that an agent runtime will grant broader-than-necessary capabilities, enabling unintended filesystem discovery, package installation, and outbound requests.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to run Bash that auto-discovers installation paths, installs Python dependencies, and executes a local script, yet provides no explicit risk notice or consent boundary. This is dangerous because package installation and script execution can change the local environment, pull unreviewed code from the network, and expose users to supply-chain or local-execution risks beyond simple data retrieval.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The route triggers include very broad everyday phrases like '今天', '关注', or '最新情况', which can cause accidental invocation of modules and unintended execution of local shell/Python commands. In this skill, misrouting is more dangerous because execution may install dependencies and perform networked data retrieval, expanding the effect of a casual or ambiguous user utterance.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python ODAILY_API_POST: str = "https://web-api.odaily.news/post/page" # Market Data COINGECKO_API_URL: str = "https://api.coingecko.com/api/v3" COINGECKO_API_KEY: str = field( default_factory=lambda: os.environ.get("COINGECKO_API_KEY", "") )
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python ) # Fear & Greed FEAR_GREED_API: str = "https://api.alternative.me/fng/" # 通用 REQUEST_TIMEOUT: int = 30
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file-level docstring is entirely in Chinese, and the module later returns Chinese labels for sentiment values. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in or a clearly justified region-specific purpose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The returned sentiment labels such as "极度恐惧" and "贪婪" are user-facing natural-language outputs and are fixed to Chinese. Because the file does not offer localization or explain a justified locale restriction, this is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The module description and generated URLs are explicitly tied to Chinese content, including zh-CN newsflash links and Chinese-language filtering terms. This creates a locale-specific behavior in the skill without any visible user choice or justification that the skill is intended only for a China-specific audience.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code performs remote database operations against Supabase, including reading transaction hashes and inserting trade records, but provides no confirmation prompt, logging, or user-facing notice around the network/data transmission. Although the module docstring mentions optional persistence, it does not clearly warn users that trade data may be sent to an external service.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code file contains natural-language documentation entirely in Chinese and later returns Chinese labels/messages for outputs, but there is no indication that the skill is region-specific or that users can choose their preferred language. That creates a locale-policy concern because the skill imposes a specific language by default rather than offering an opt-in or documented justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trend labels and emoji mappings use hard-coded Chinese strings that are later surfaced in the returned result. Because the file provides no locale selection or user opt-in, these outputs enforce a specific language policy on all users.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The insufficient-data error message is returned in Chinese, and other output fields in this function also use Chinese signal terms, with no mechanism for localization. This is a natural-language policy issue because the skill forces a single language in user-facing responses without opt-in.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python sys.exit(1) module_path, func_name = TOOLS[tool_name] module = __import__(module_path, fromlist=[func_name]) func = getattr(module, func_name) try:
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This code includes natural-language strings that define the tool and its returned content entirely in Chinese, such as the module description and later user-facing output. The file does not offer a language choice or explain that the skill is intentionally region-specific, which creates a locale-policy issue under the rule for forced language without opt-in.
- Content
Static analysis
No suspicious patterns detected.