IOC 智能巡检报告

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:26 PM UTC
• Version: 1.0.0

Overview

The skill is a report generator, but it ships a real-looking remote PostgreSQL password and will try to use it automatically, so it should be reviewed before installation.

Do not install or run this skill as packaged unless the database credential has been removed and rotated. Replace config.yaml with your own database settings, use a dedicated read-only reporting account, restrict access to the exact tables needed, and review generated reports before sharing because they may contain sensitive facility or personnel-access information.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: config.yaml:2

Finding

Hardcoded Privileged PostgreSQL Credentials

Content

View full analysis

Vulnerability Details

File Location: config.yaml, lines 2–7
Vulnerability Type: Hardcoded plaintext database credentials
Risk Level: High

Vulnerable Code

yaml

database:
  host: hightop.xin
  port: 55432
  name: sunway
  user: postgres
  password: "Q9iT6>^bZsPIX}A&"
  options: "-c search_path=ioc"

The exposed configuration is directly consumed by scripts/generate_report.py when opening a PostgreSQL connection:

python

db_config = {
    "host": config["database"]["host"],
    "port": config["database"]["port"],
    "dbname": config["database"]["name"],
    "user": config["database"]["user"],
    "password": config["database"]["password"],
}
if "options" in config["database"]:
    db_config["options"] = config["database"]["options"]
return psycopg2.connect(**db_config)

Technical Analysis

The project distributes a complete credential set for a remotely hosted PostgreSQL database, including the host, externally relevant port, database name, username, and plaintext password. Anyone who can read or download the project can recover the credential without executing the Skill.

The username is postgres, which conventionally identifies a highly privileged PostgreSQL role. The audit did not dynamically validate the credential or determine its exact server-side permissions; therefore, validity and superuser status cannot be assumed. Nevertheless, distributing a credential for such an account violates secret-management and least-privilege principles.

The implementation automatically reads this configuration and attempts a network connection whenever the report generator runs. Although the observed SQL statements are read-only and consistent with report generation, database-side authorization—not the local queries—determines what a person possessing the credential could do.

Attack Path

1. An attacker obtains the Skill package or access to its source files ...[truncated 1343 chars]

Remediation

View remediation

Remediation Suggestions

1. Revoke and rotate the exposed password immediately. Review PostgreSQL authentication and audit logs for attempted or successful use of the credential.
2. Remove the secret from the current source tree, repository history, release archives, caches, and previously distributed Skill packages.
3. Replace the hardcoded value with runtime secret retrieval, such as an environment variable or an approved secret manager. Do not commit resolved secret values:

   yaml

   database:
     host: ${DB_HOST}
     port: ${DB_PORT}
     name: ${DB_NAME}
     user: ${DB_USER}
     password: ${DB_PASSWORD}
   

   Because yaml.safe_load() does not interpolate environment variables automatically, explicitly resolve these values in trusted application code.
4. Replace the postgres account with a dedicated reporting role. Grant only CONNECT, USAGE on the required schema, and SELECT on the exact tables or views needed by the report.
5. Restrict database network access through firewall rules, private networking, VPN controls, or source-address allowlisting. Avoid exposing PostgreSQL directly to the public Internet.
6. Enforce encrypted PostgreSQL transport with certificate validation, such as sslmode=verify-full, where supported.
7. Add secret-scanning checks to local development and CI pipelines to block committed credentials.
8. Ship only placeholder localhost configuration and document secure runtime provisioning.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The documented behavior materially differs from the reported implementation: database tables, alarm/device analysis, configurability, and HTML output are described more broadly than what the code actually does. This mismatch is security-relevant because operators may trust the generated report as complete or policy-compliant when critical data sources are omitted or hardcoded, leading to blind spots, incorrect decisions, or unauthorized data handling assumptions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The only OpenClaw usage example is a Chinese command phrase, and the README otherwise presents the skill as if Chinese is the required interaction language. Under SQP-3, forcing a specific language without offering user choice or documenting a justified locale constraint is a policy concern.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents behavior that requires environment-variable access and filesystem reads/writes, but it does not declare any explicit tool scope or permission boundaries. This is dangerous because an agent may be granted broader implicit capabilities than users expect, increasing the chance of unintended access to secrets or overwriting local report files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

All natural-language instructions and descriptions in the file are presented in Chinese, and the skill is described as generating professional inspection reports without indicating that another language can be selected. This may violate language/locale policy when no user opt-in or documented regional justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The package description is written to specify report generation in Chinese context and says the skill generates professional patrol daily/weekly reports, but it does not indicate that users may choose the output language or locale. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code file contains natural-language strings such as the module description and usage context entirely in Chinese, and later continues with Chinese-only CLI messages and report content. Under the language/locale policy, forcing a specific language without user opt-in is a policy violation unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script queries and counts personnel room access data even though the skill description only declares device status, alarm records, and energy data as report inputs. This creates a data-scope expansion issue: operators may deploy the skill expecting limited telemetry processing, while it also touches potentially sensitive access-control data with privacy and compliance implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file explains configuring database access, including a password placeholder, and generating IOC patrol reports from operational datasets, but it does not include any user warning about handling sensitive building, alarm, work-order, or energy data. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect privacy or system data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The markdown states that the skill connects to a PostgreSQL database to read real-time data and outputs Markdown/HTML reports, which can affect privacy and create files on disk. However, the description does not provide any user-facing warning about accessing operational data or writing generated reports to the filesystem.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description is written only in Chinese ("IOC 智能巡检报告生成器"), which indicates a language-specific presentation without any visible user choice or opt-in. Under the policy for natural-language violations, forcing a specific language can be a locale policy issue when no alternative or justification is provided.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pyyaml has 8 known advisory(ies) (CVE-2019-20477 (Deserialization of Untrusted Data in PyYAML); CVE-2020-1747 (Improper Input Validation in PyYAML); CVE-2020-14343 (Improper Input Validation in PyYAML) +5 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file is entirely presented in Chinese, including the title and all report labels, with no indication that the user can choose another language or that the report is intentionally restricted to a Chinese-speaking context. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The markdown report is entirely presented in Chinese, including the title and section labels, with no indication that the user can choose another language or locale. Under the policy criteria, a skill that forces a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The document is entirely presented in Chinese, including the title and all section labels, with no indication that the skill is region-specific or that users can choose another language. Under the policy criteria, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language content of the file is entirely in Chinese, and there is no indication that the skill or report is region-specific or that users can opt into this locale. Under the policy, forcing a specific language without user choice or documented justification is a language/locale policy concern.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

manifest 描述强调自动分析设备状态、报警记录、能耗数据来生成报告，而实现中还统计 t_patrol_task 的总量和状态，并生成工单进度数据。这属于实际行为比描述更宽的情况，尽管与巡检报告场景相关，但未在技能说明中体现。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

技能描述明确宣称支持 Markdown/HTML 报告输出，但本文件保存逻辑固定生成 .md 文件，且没有任何 HTML 渲染或写出分支。这构成了文档/声明与实现能力之间的直接不一致。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.