Security audit

社区运营小助手

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed merchant-operations tool, but it grants broad community admin powers that deserve careful review before installation.

Install only if you administer a Koubei Circle merchant account and are comfortable giving the skill privileged API access. Treat the merchant key as sensitive, restrict who can invoke the skill, confirm every post/message/points/user-label action before execution, avoid uploading private local files, and review any SQL query before it runs.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The documentation exposes a generic SQL query capability over circle data, which materially expands the skill from operational posting into arbitrary data retrieval. Even though it documents some limits, direct query access can enable overbroad access to user/admin attributes and sensitive business data if the agent or operator constructs unsafe or privacy-invasive queries.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The documented functions include persona/account management, points modification, internal messaging, and user labeling, which are powerful administrative actions not clearly bounded by the stated skill scope. These capabilities can be abused for impersonation, manipulation of platform incentives, unsolicited messaging, or unauthorized profiling/segmentation of users.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The README introduces an OpenClaw data-query capability that appears unrelated to the declared 口碑圈 merchant-operations scope, creating hidden functionality for arbitrary remote data access. Scope mismatch is dangerous because it can mislead users and reviewers, and it increases the chance the skill is used to access external datasets or user records beyond expected business operations.

Intent-Code Divergence

Low

Confidence: 97% confidence
Finding: The documentation claims the API key is not exposed on the command line, yet the example passes the secret directly via `--key <your_key>`, which can leak through shell history, process listings, logs, or screenshots. This contradiction can cause users to handle credentials insecurely while believing the method is safe.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The CLI exposes a raw SQL execution primitive (`query(sql)`) and forwards arbitrary SQL directly to the remote OpenClaw API. In a merchant-operations skill, this creates a powerful data-access and mutation capability well beyond narrowly scoped posting/operations tasks, increasing risk of unauthorized reads, destructive writes, or abuse if the skill is invoked with attacker-controlled input or by an over-privileged user.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: This section enables bulk direct messaging, user labeling, points adjustment, and 'mark' account creation/editing, including explicit sockpuppet-management behavior. These are high-risk mass-action and user-manipulation capabilities that exceed the stated merchant-posting automation scope and could be abused for spam, covert influence, fraudulent incentives, or account misuse.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The skill uses broad natural-language triggers like configuration/help phrases that are common in ordinary conversation, which can cause the agent to invoke the skill unintentionally. In this skill, accidental invocation is more dangerous because the skill can collect merchant keys, persist credentials locally, query merchant data, and perform administrative write actions once engaged.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The usage table contains highly generic prompts like '帮我发个帖子', '看看有哪些用户', and '有哪些话题', which lack scope constraints and can match ordinary requests unrelated to this merchant system. Because this skill exposes operational data and write capabilities, ambiguous triggering increases the chance of unintended data access or actions in the wrong context.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The docs describe direct local file uploads to a remote service without warning the operator that local files will be transmitted off-host. In an agent setting, that omission increases the risk of accidental exfiltration of sensitive local images/videos, especially if users do not understand that a local path like ./image.jpg causes remote upload.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation explicitly enables automated posting, commenting, liking, and creation of 'sockpuppet' accounts ('社区马甲') without any guardrails, disclosure requirements, anti-abuse controls, or platform-policy warnings. In an agent skill, these features can facilitate deceptive engagement manipulation, spam, and fabricated social proof at scale, which increases trust and moderation risk even if the stated business purpose is growth automation.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The file documents user management actions (including mute/unmute and delete user), notification controls, multi-admin permissions, analytics, and CSV/Excel export, but provides no privacy, authorization, retention, or destructive-action safeguards. In a skill that operates with merchant keys and administrative backend access, this omission can lead to over-privileged use, unauthorized exports of user data, and unsafe account moderation actions that materially affect users.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README states that an API key will be stored in `scripts/config.json` but gives no warning about the sensitivity of the credential or how it is protected at rest. Even if `.gitignore` is used, local plaintext storage can still expose secrets through backups, local compromise, accidental sharing, or weak file permissions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README provides SQL examples querying user-related fields such as `user_id` and `nickname` without any privacy, authorization, or data-minimization guidance. In the context of a merchant-operations skill, normalizing ad hoc SQL access to user records increases the risk of unauthorized data access, over-collection, and privacy violations against remote datasets.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The API key is saved in plaintext to a local `config.json` file without warning, permission hardening, or use of a secure credential store. This raises the chance of accidental disclosure through local compromise, backups, source-control mistakes, or shared environments, which would expose privileged API access.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The bulk station-mail feature can message many users at once with no interactive confirmation, dry-run, recipient preview, or safety warning. In this skill context, that increases the likelihood of accidental spam, phishing-style misuse, or large-scale user harassment using the merchant's credentials.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The bulk points-increase command performs a financially or reputation-relevant mass action without a confirmation step or warning. In community/merchant operations, unauthorized or mistaken point grants can distort incentives, enable fraud, and be difficult to reverse cleanly.

Static analysis

No suspicious patterns detected.