rural-cloud-platform

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:43 AM UTC
• Version: 1.0.2

Overview

This skill needs review before installation because it automates authenticated lookup of personal villager records while its purpose label and data-handling safeguards are unclear.

Install only after the publisher clarifies the true purpose, authorized-use limits, exact data lifecycle, cache/log/screenshot behavior, dependency pins, and cleanup guarantees. Use it only with explicit permission for the target platform and avoid running it on shared or unmanaged machines.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: skill.json:15

Finding

Non-Reproducible and Loosely Constrained Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: skill.json:15-21; related installation instruction at SKILL.md:20-23
Vulnerability Type: Insecure third-party dependency management
Risk Level: Medium

Evidence

skill.json:15-21:

json

"dependencies": [
  "openclaw>=2.0.0",
  "requests>=2.25.0",
  "beautifulsoup4>=4.9.0",
  "selenium>=4.0.0",
  "webdriver-manager>=3.8.0"
],

SKILL.md:20-23:

bash

pip install -r requirements.txt

Technical Analysis

The package declares dependencies using open-ended minimum-version constraints. Consequently, a fresh installation can resolve to versions that were unavailable and unaudited when the skill was published. No lockfile, hash manifest, or exact version constraints are included in the audited artifact.

The installation documentation also directs users to install from requirements.txt, but that file is absent from the supplied project. The artifact therefore does not provide a reproducible or reviewable dependency set. If a requirements file is later obtained from an external source, its contents would fall outside the audited package.

No evidence establishes that any currently named package is malicious. The vulnerability is the unsafe and non-reproducible supply-chain configuration, which increases exposure to compromised releases, unexpected breaking changes, and substituted installation manifests.

Attack Path

1. A user follows the documented installation procedure.
2. The absent requirements.txt is retrieved or reconstructed from an external source, or the metadata dependency list is used instead.
3. Package resolution selects the newest versions satisfying the open-ended minimum constraints.
4. A compromised, malicious, or otherwise unsafe future package release is downloaded.
5. Package-controlled code may execute during installation or when imported by the skill.
6. That code executes with the privile ...[truncated 641 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the referenced requirements.txt in the project.
2. Pin every direct dependency to an exact, reviewed version rather than using open-ended minimum constraints.
3. Generate and commit a lockfile containing resolved transitive dependency versions.
4. Require package hashes, such as with pip install --require-hashes, to prevent substitution of unexpected distributions.
5. Install only from explicitly configured trusted package indexes over TLS.
6. Review transitive dependencies and continuously scan them for known vulnerabilities and compromised releases.
7. Perform installation inside an isolated virtual environment or container under a non-privileged account.
8. Document a controlled dependency-update process requiring review and testing before lockfile changes are accepted.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:68

Finding

Sensitive Query Results May Be Exposed Through Caching, Logging, and Screenshots

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:68-75, SKILL.md:127-144, and skill.json:30-49
Vulnerability Type: Insufficient protection of sensitive personal data
Risk Level: Medium

Evidence

SKILL.md:68-75 enables result caching:

json

{
  "max_retry_times": 3,
  "retry_delay": 5,
  "data_cache_enabled": true,
  "cache_expiration": 3600
}

skill.json:30-49 declares phone-number querying, logging, screenshots, and caching:

json

"features": {
  "auto_login": true,
  "phone_query": true,
  "name_query": false,
  "id_query": false,
  "batch_query": false,
  "data_export": false,
  "auto_logout": true,
  "error_recovery": true,
  "logging": true,
  "screenshot": true
},
"configurable": {
  "platform_url": true,
  "login_timeout": true,
  "query_timeout": true,
  "browser_settings": true,
  "output_format": true,
  "logging_level": true
},

The documented output at SKILL.md:79-87 includes a villager-information object:

json

{
  "status": "success",
  "villager_info": {
  },
  "query_time": "2026-04-02 18:30:00",
  "execution_time": 15.5
}

Technical Analysis

The skill is documented as querying personal records by phone number and returning villager information. At the same time, result caching is enabled, and the metadata enables logging and screenshots. These channels can persist identifiers, returned personal records, authentication state, or displayed browser content.

The documentation asserts that sensitive information is not retained and that temporary data is cleaned up, but the artifact contains no implementation demonstrating redaction, encryption, restrictive file permissions, secure cleanup, retention enforcement, or exclusion of sensitive browser pages from screenshots. There is also no documented rule defining which fields may enter logs or caches.

The project contains only documentation and meta ...[truncated 1519 chars]

Remediation

View remediation

Remediation Suggestions

1. Disable query-result caching and screenshots by default for workflows that process personal records.
2. Apply an explicit allowlist of non-sensitive fields permitted in logs; redact phone numbers, identifiers, personal records, authentication material, and page content.
3. Store any operationally necessary temporary data in a private directory with owner-only permissions.
4. Encrypt cached data at rest using a key that is not stored beside the cache.
5. Define a short, enforced retention period and delete data on success, failure, cancellation, and timeout.
6. Avoid relying on ordinary file deletion for highly sensitive material; prefer memory-only processing or encrypted ephemeral storage.
7. Ensure exceptions and debug output cannot serialize complete query requests, responses, browser DOM content, or cookies.
8. Add automated tests proving that sensitive values do not appear in logs, screenshots, caches, temporary files, or error reports.
9. Document the exact data lifecycle, storage locations, authorized readers, retention period, and cleanup guarantees.
10. Conduct a privacy and access-control review before enabling batch processing or broader identifier-based searches.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill is explicitly intended to query and possibly export highly sensitive personal data such as phone numbers and identity-card-related records, but it does not prominently warn users about privacy, legal, or handling obligations. Without that warning, users may run queries, exports, or caching in inappropriate environments or for unauthorized purposes, increasing the likelihood of data leakage or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill advertises automatic browser launch, QR-code login, session management, and automatic logout, but does not clearly warn that it will perform account-bound actions and manipulate authenticated sessions. This can lead users to run the tool without understanding that it may alter session state, expose active sessions on-screen, or interfere with account integrity and auditability.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document claims sensitive personal information is not stored, yet elsewhere it explicitly describes caching query results and using temporary files for result storage. In a skill designed to query villager records by phone number, name, and national ID, that inconsistency can mislead operators into underestimating privacy exposure and result in unauthorized retention of regulated personal data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest presents the skill as a generic test while its declared features indicate real web automation, auto-login, phone-based querying, screenshots, and logging. This mismatch can mislead reviewers and users about the skill’s true purpose, reducing scrutiny and increasing the risk that a data-accessing automation skill is installed or invoked inappropriately.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description contradicts the rest of the manifest by labeling the package as a test skill despite production-like capabilities and operational details elsewhere in the file. Such inconsistency is dangerous because it can conceal sensitive functionality during review, inventory, approval, or automated policy enforcement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description and examples are too vague to establish the intended invocation boundaries for a skill that appears capable of authenticated automation and phone-data lookup. Poorly defined scope increases the chance of accidental or unauthorized use, especially in agent systems that rely on manifest text to determine when a skill should be selected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The README presents the skill title in Chinese ("测试技能") without any indication that language choice is optional or context-specific. This can violate language/locale policy expectations when a skill appears to require a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The primary title and core descriptive sections are presented in Chinese, which can impose a language choice on users without explicit opt-in. Under the policy rule, language constraints should either offer user choice or be clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

Natural-language policy checks apply to all file types. The primary displayed name and description are only in Chinese while English appears relegated to alternate fields, and there is no indication of user language selection or justified locale restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.