消费维权指引

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:09 AM UTC
• Version: 1.0.0

Overview

This consumer-rights skill is coherent and not malicious, but it stores sensitive complaint evidence locally without enough consent, retention, or access-control guidance.

Install only if you are comfortable with the agent organizing sensitive complaint evidence on disk. Before using it, ask the agent where files will be saved, avoid sharing unnecessary ID/payment/medical details, redact drafts when possible, and delete the evidence package when the dispute is finished.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:43

Finding

Unprotected Plaintext Storage of Sensitive Consumer Evidence

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:43-50, SKILL.md:243-245, SKILL.md:285-287, and SKILL.md:341
Vulnerability Type: Plaintext storage of sensitive personal, financial, and consumer evidence
Risk Level: Medium

Complete Relevant Snippets

The following English translations preserve the meaning of the relevant Skill instructions:

markdown

1. Use browser screenshots:
   - `browser(action=screenshot)` or
     `browser(action=open)` + `browser(action=screenshot)`
   - Save to: `~/.qclaw/workspace/Evidence_Package_YYYY-MM-DD/`
   - Naming format: `01_Purchase_Page_Product_Name.png`,
     `02_NMPA_Query_Product_Name.png`

2. User-uploaded images:
   - Ask the user to send images directly in the conversation.
   - After receiving them, the AI saves them to:
     `~/.qclaw/workspace/Evidence_Package_YYYY-MM-DD/`

markdown

Party B agrees to refund the purchase price to Party A's account
([payment method/account]) before [date].

markdown

Plaintiff: [name], identity-card number: [enter value],
telephone number: [enter value]

markdown

Protect privacy: All evidence is used only for consumer-rights claims
and is not distributed externally.

Technical Analysis

The Skill directs the Agent to persist user-submitted receipts, payment records, product photographs, merchant communications, and other evidence in a predictable directory under ~/.qclaw/workspace/. Its generated legal templates may also contain identity-card numbers, telephone numbers, and payment-account information.

No corresponding controls are specified for:

• Restrictive file or directory permissions
• Encryption at rest
• Data minimization or field redaction
• Explicit consent before persistent storage
• Segregation between users or Agent sessions
• Retention limits and automatic deletion
• Secure disposal of generated evidence packages
• Protection from backu ...[truncated 2243 chars]

Remediation

View remediation

Remediation Suggestions

1. Request explicit consent before persistence

   • Explain which files will be stored, where they will be stored, why storage is necessary, and how long they will be retained.
   • Allow users to choose session-only processing when persistent storage is unnecessary.

2. Minimize collected data

   • Request only evidence required for the selected complaint channel.
   • Do not collect full identity-card or payment-account numbers until a filing process specifically requires them.
   • Use masked values in drafts, such as the last four digits only.

3. Apply restrictive access controls

   • Create evidence directories with owner-only permissions, equivalent to mode 0700.
   • Create evidence and generated-document files with owner-only permissions, equivalent to mode 0600.
   • Reject unsafe symbolic links and verify that the resolved path remains inside an approved private directory.

4. Protect sensitive content at rest

   • Encrypt evidence packages containing identity, financial, or medical-context information.
   • Keep encryption keys separate from the evidence directory.
   • Avoid placing sensitive evidence in automatically synchronized or broadly indexed directories.

5. Redact derivative documents

   • Generate working copies with identity numbers, telephone numbers, account details, transaction identifiers, and unrelated personal information redacted.
   • Preserve unredacted originals only when legally necessary.

6. Define retention and deletion controls

   • Establish a short default retention period.
   • Automatically delete temporary screenshots and generated drafts after export or case completion.
   • Provide a clear command that securely removes the entire evidence package.
   • Warn users that backups or synchronized copies may require separate deletion.

7. Separate user and case data

   • Use a unique, non-guessable directory for each u ...[truncated 380 chars]

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger phrases are very broad (e.g. '我要投诉', '怎么维权') and can match many ordinary user requests, which increases the chance this skill activates when the user did not intend to enter a workflow that gathers evidence and recommends formal complaints. In this context, unintended invocation can lead to over-collection of personal data and procedural/legal guidance being applied without sufficient scoping or confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill directs collection and local storage of sensitive evidence such as receipts, product photos, prescriptions, chat logs, and recordings in a specific filesystem path, but does not clearly warn the user before writes occur or obtain explicit consent for storing personal data locally. Because these artifacts can contain names, payment details, medical information, and merchant communications, silent or unexpected persistence materially increases privacy and data-exposure risk.

Content

No source excerpt is available for this finding.