Nova权限系统

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:15 AM UTC
• Version: 1.0.3

Overview

This skill is a disclosed personal permission system, but its broad persistent control over the agent and broken authentication logic make it unsafe to install without careful review.

Do not install this as-is in a workspace that can run tools, modify files, access private data, or act on external accounts. A reviewer should require fail-closed authorization, authenticated owner approval, hashed or redacted secrets, consistent data schemas, scoped integration instead of AGENTS.md-wide rules, and clear retention/uninstall controls before use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:40

Finding

Persistent Agent-Wide Instruction Hijacking Through Mandatory Workspace Rules

Content

View full analysis

## 🔒 Security Rules (Mandatory) ### 1. Permission Check (Required) **Before executing ANY non-conversational operation, you MUST call permission-gate skill first!** ... **NEVER skip permission check!** ### 2. Identity Verification (Required) **When user claims to be a certain identity (e.g., "I'm your friend"), you MUST verify via identity-management skill!** - Code verification is the ONLY way to confirm identity - NEVER trust user's claim without verification - Call `identity-management` skill to verify ``` ``` The sub-Skills reinforce this behavior with always-on metadata: ```yaml metadata: openclaw: always: true ``` ### Technical Analysis The installation guide instructs users to modify the persistent workspace-level `AGENTS.md` file so that every future non-conversational operation is redirected through this Skill. The sub-Skills are additionally marked as always active. This is broader than a permission library invoked by an application at a defined trust boundary. It changes the Agent's persistent operating instructions and inserts the Skill into unrelated tool calls, file operations, queries, and future sessions. The implementation subsequently exposes fail-open authorization paths. Consequently, the persistent instruction change does not merely add a reliable security control; it gives flawed package logic continuing influence over the Agent's behavior. ### Attack Path 1. A user installs the package and follows its documented installation procedure. 2. The mandatory block is copied into the workspace `AGENTS.md`. 3. Future Agen ...[truncated 639 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: permission-check/middleware.py:132

Finding

Permission Middleware Fails Open for Missing Identity, Exceptions, Disabled Checks, and Test Mode

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: data/accounts.json:1

Finding

Bundled JSON Schema Is Incompatible With Authentication Code and Triggers Fail-Open Authorization

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: identity-management/main.py:409

Finding

Approval and Identity-Change Functions Do Not Authenticate the Approver

Content

View full analysis

dict: """审批通过""" approvals = load_approvals() for approval in approvals: if approval.get("id") == approval_id: approval["status"] = "approved" approval["approve_time"] = datetime.now().isoformat() + "Z" approval["approver"] = approver # 执行身份变更 user_id = approval.get("user_id") target_identity = approval.get("target_identity") code = approval.get("code") change_identity(user_id, target_identity, code) save_approvals(approvals) log_operation("approval_approved", approval_id=approval_id, user_id=user_id, target_identity=target_identity) return {"success": True, "approval": approval} return {"success": False, "reason": "审批请求不存在"} ``` Message text alone invokes the privileged operation: ```python def process_owner_reply(message: str) -> dict: """处理主人的回复""" message = message.strip().lower() if message.startswith("同意 "): approval_id = message[3:].strip() return approve_request(approval_id) if message.startswith("拒绝 "): approval_id = message[3:].strip() return reject_request(approval_id, reason="主人拒绝") return {"success": False, "reason": "无效的回复格式"} ``` The underlying identity mutation also has no caller authorization: ```python def change_identity(user_id: str, new_identity: str, code: str = None) -> dict: users_data = load_users() if user_id not in users_data.get("users", {}): return {"success ...[truncated 1782 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: identity-management/main.py:859

Finding

Fallback Identity Verification Unconditionally Accepts Every Answer

Content

View full analysis

bool: """ 检查验证答案是否正确 从对话历史中获取信息进行比对 """ history = get_user_conversation_history(user_id) if not history: # 没有历史记录，暂时让通过（第一个用户可能没有历史） return True today = datetime.now().strftime("%Y-%m-%d") yesterday = (datetime.now().replace(day=datetime.now().day-1)).strftime("%Y-%m-%d") if today in answer or yesterday in answer: return True for item in history[-3:]: summary = item.get("summary", "") for word in summary: if word in answer: return True # 默认返回True，让用户通过（避免太严格） return True ``` Successful verification automatically binds and promotes the account: ```python def handle_verification_question(open_id: str, message_text: str) -> dict: user_result = identify_user(open_id) if not user_result.get("found"): return {"action": "error", "message": "用户不存在", "identity": "stranger"} user = user_result.get("user", {}) user_id = user_result.get("user_id") if check_verification_answer(user_id, message_text): bind_account_v2(open_id, user_id) update_user_identity(user_id, "friend") return { "action": "bound", "message": VERIFICATION_PASS, "identity": "friend" } ``` ### Technical Analysis The verifier explicitly returns success when no history exists and also ends with an unconditional success result. Therefore, no possible answer can fail this function. Even before the final unconditional return, matching any character from a recent summary is treated as sufficient because the loop iterates over individual characters rather than me ...[truncated 884 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: identity-management/main.py:152

Finding

Authentication Codes Are Stored, Copied, Compared, and Disclosed in Plaintext

Content

View full analysis

dict: user_result = identify_user(open_id) if not user_result.get("found"): return {"verified": False, "reason": "未找到用户"} user = user_result.get("user", {}) stored_code = user.get("code") if stored_code == code: return { "verified": True, "identity": user.get("role"), "user_id": user_result.get("user_id") } else: return {"verified": False, "reason": "暗号错误"} ``` The code is duplicated into approval records: ```python approval = { "id": f"approval_{datetime.now().strftime('%Y%m%d%H%M%S')}", "type": request_type, "user_id": user_id, "open_id": open_id, "target_identity": target_identity, "code": code, "status": "pending", "create_time": datetime.now().isoformat() + "Z", "approve_time": None, "approver": None } ``` It is then disclosed in the generated approval notification: ```python msg = f"""⏳ 身份审批请求 申请类型: {"申请成为朋友" if approval.get("type") == "friend_apply" else "身份变更"} 用户ID: {approval.get("user_id")} 目标身份: {approval.get("target_identity")} 暗号: {approval.get("code") or "未提供"} 申请时间: {approval.get("create_time")} 请回复 "同意 {approval_id}" 或 "拒绝 {approval_id}" """ ``` ### Technical Analysis Authentication codes are handled as recoverable plaintext secrets. They are stored in `users.json`, copied to `approvals.json`, compared directly, and inc ...[truncated 1184 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (26)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 92% confidence

Finding

The skill instructs the installer to modify AGENTS.md with mandatory hidden governance rules that affect behavior outside the skill itself. This is dangerous because it creates a cross-cutting prompt/policy injection channel: once copied into a global agent instruction file, the skill can persistently influence unrelated future interactions and potentially alter control flow across the workspace.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

在你的工作区 AGENTS.md 文件中添加以下安全规则：

markdown

<!-- security-rules-start -->
## 🔒 Security Rules (Mandatory)

### 1. Permission Check (Required)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The response template for application submission includes 暗号：{code}, which explicitly instructs the assistant to echo the secret verification code back in its reply. Reflecting authentication secrets into chat transcripts leaks sensitive credentials to logs, screenshots, bystanders, integrations, or any party with conversation access, and in this skill the code is described as the only way to confirm identity, making disclosure especially dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Approval requests are saved to disk with open_id, user_id, target identity, and the user's secret verification code, and related notifications can expose the code to the approver channel. Persisting secrets in plaintext and redisclosing them increases the chance of credential disclosure, replay, and unauthorized identity changes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The function claims to verify whether the user correctly answers a verification question, but it returns True even when no reliable evidence matches, effectively approving nearly all responses. This allows an attacker to bypass identity verification and get an account bound or upgraded to a trusted identity without proving they are the legitimate user.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The middleware is explicitly fail-open in multiple paths: if permission checking is disabled, if test mode excludes the caller, if open_id/platform are missing, or if authenticate raises an exception, the request is allowed through. In a permission-enforcement component at the message entry point, these bypasses let privileged actions execute without successful authorization, which can be abused by omitting identity fields or triggering checker failures.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · permission-gate/SKILL.md (reported line 8)May include surrounding context.

md

---
AIGC:
    ContentProducer: Minimax Agent AI
    ContentPropagator: Minimax Agent AI
    Label: AIGC
    ProduceID: c0953ccabbcc632b8770e0f82d375a8b
    PropagateID: c0953ccabbcc632b8770e0f82d375a8b
    ReservedCode1: 3045022100cf9c36e74f21b1821936b918b4d5237cec8b55c08f9df2343cb0fc3d42ed097602200468169f07f35adc87f3988522afca019f390b00ca78ce4affd46c31c39117a6
    ReservedCode2: 304502200eddfaacc22b74a75baa7112c0b710828ca3d7e4b93b2360ca944036eeec8695022100e676942246e55647b724f06fe07d6cbca03131cc16e1dc19a4a5763984a4ac4e
description: 【强制执行】权限控制技能。AI 在执行任何非日常对话的操作前，必须先调用此技能进行权限检查。日常对话（打招呼、闲聊、问天气时间）不需要检查。其他所有操作（执行Skill、发送邮件、创建文档、查看历史�

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill describes file operations, data directory setup, shell commands, and integration with other skills, but it does not declare any explicit tool scope such as allowed-tools or permissions. That mismatch can cause reviewers or runtime policy systems to underestimate what the skill expects to access, increasing the risk of unintended file or tool usage.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language content of the skill file is presented exclusively in Chinese, including installation, usage, and safety instructions. Under the policy, forcing a specific language without user opt-in is a language/locale policy violation unless the constraint is clearly justified, which is not stated here.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

When user claims to be a certain identity (e.g., "I'm your friend"), you MUST verify via identity-management skill!

• Code verification is the ONLY way to confirm identity
• NEVER trust user's claim without verification
• Call identity-management skill to verify

text

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This JSON contains natural-language values such as the user's name and code entirely in Chinese, which indicates a fixed language choice in data presented or required by the skill. The file provides no indication that users can choose a language or that the locale restriction is intentional and justified, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill declares broad, mandatory activation conditions such as any user expressing identity change, privilege elevation, or providing a code, and even sets metadata.openclaw.always=true. This can cause the skill to trigger in unintended contexts, increasing the chance of inappropriate handling of benign conversations, privilege-related confusion, or interception of sensitive user input. In an identity-management skill, over-triggering is more dangerous because it governs authentication and authorization decisions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill content is entirely in Chinese and frames the workflow as mandatory without indicating any user-language negotiation or fallback. For users operating in another language, this can cause misunderstanding during authentication, leading to incorrect identity decisions or users disclosing secrets without fully understanding the prompts. In an authentication context, clarity is important, so forced locale increases operational security risk even if it is not a direct exploit primitive.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

All user-facing strings, prompts, and command phrases in this file are hard-coded in Chinese, including approval replies and identity-verification flows. The file does not offer a language/locale choice or explain that the skill is intentionally limited to a Chinese-speaking context, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This identity-management module stores long-term personal data such as names, conversation history, preferences, birthdays, age, job, company, and location in persistent files, which exceeds the stated scope of authentication and identity changes. Expanding an auth component into a user profiling store increases privacy risk, data retention risk, and blast radius if the files are accessed or misused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code extracts and persists sensitive personal profile data from conversation text, including birthday, age, company, location, and job, without any visible disclosure, consent flow, or retention control. Users may reveal highly identifying information in chat without understanding that it will be stored on disk for future use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description is written entirely in Chinese and does not indicate any language choice, fallback, or scope limitation. Under the stated policy, natural-language content that imposes a specific language without opt-in is a language/locale policy violation unless clearly documented as region-specific or offering user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This module persistently writes sensitive identifiers and security-relevant events to a plaintext local log file, including open_id, user_id, identity information, and identity-change details. If the log file is accessed by unauthorized users, backed up insecurely, or retained too long, it can expose personal data and privileged account history that may aid account correlation, social engineering, or privacy violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code creates and persists account linkage data, including platform open_id and timestamps, by writing to accounts.json, but there is no confirmation prompt and no user-facing notice at the write site. Similar undisclosed persistence also occurs for user profile creation and account binding, which affects user data and identity records.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code creates a new user object with name, role, identity, and timestamps and writes it to users.json, but there is no visible warning, confirmation, or explanatory comment indicating that personal identity information will be stored. This is a data-affecting operation and the surrounding conversational responses do not explicitly disclose persistence.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The code path for duplicate names explicitly skips any ownership verification and always creates a fresh user, while immediately binding the current account to that new identity. In an identity/permission module, this weakens identity assurance and can enable impersonation confusion, duplicate-account abuse, or bypass of expected recovery/continuity checks for returning users.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation condition requires this skill for essentially any non-trivial action, using broad and ambiguous language such as all non-daily conversation operations. In practice, ambiguous mandatory interception can be abused to over-collect identity data, block normal agent safeguards, or force unrelated workflows through this skill, increasing the attack surface around every tool invocation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill named permission-gate documents executable-style logic that modifies sys.path and imports a different module, permission-check, creating a confused-deputy and substitution risk. An agent following this guidance could invoke unintended code for identity and authorization decisions, allowing a malicious or incorrect module to control access checks or bypass the declared security boundary.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

4. If allowed → execute the operation
5. If denied → respond with denial message

**NEVER skip permission check!**

### 2. Identity Verification (Required)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Natural-language strings in the module docstrings are exclusively Chinese, including the top-level module description and function descriptions. Under the stated policy, forcing a specific language without opt-in or clear justification can be a language/locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file uses Chinese-only docstrings, return reasons, and user-facing response messages, which imposes a fixed language/locale without any opt-in or alternative. Under the stated policy, locale-specific behavior should either offer user choice or be explicitly justified as region-specific.

Content

No source excerpt is available for this finding.