fp-skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:14 PM UTC
• Version: 0.0.1

Overview

This invoice-checking skill needs Review because it handles sensitive invoice data with unsafe browser and file behaviors that are not clearly controlled by the user.

Install only after reviewing the code and running it in a tightly isolated, non-root environment. Do not use it with real invoices unless the file path, destination domain, certificate validation, screenshot handling, and upload confirmation behavior are fixed. Avoid running patch_fp.py because it rewrites an installed skill file and adds unverified URL fetching.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: skill.py:43

Finding

Automatic Bypass of Browser TLS Certificate Warnings

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: skill.py:153

Finding

Chrome Browser Sandbox Disabled During Remote Content Processing

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: patch_fp.py:3

Finding

Patch Introduces Unverified Remote Image Retrieval and Rewrites an External Skill File

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:4

Finding

Contradictory, Duplicated, and Loosely Pinned Third-Party Dependencies

Content

View full analysis

=9.5.0 selenium~=4.36.0 webdriver_manager>=4.0.0 opencv-python-headless==4.8.1.78 ``` The OpenCV dependency is also duplicated in the complete file: ```text opencv-python-headless==4.8.1.78 ... opencv-python-headless==4.8.1.78 ``` The documented installation command is: ```bash pip install -r requirements.txt ``` ### Technical Analysis The two NumPy compatible-release constraints are mutually incompatible: `numpy~=2.0.2` requires a 2.0-compatible release, while `numpy~=1.26.4` requires a 1.26-compatible release. This can cause dependency resolution failure. `Pillow>=9.5.0` and `webdriver_manager>=4.0.0` have no upper bound, while compatible-release constraints still permit later patch or minor releases within their allowed ranges. As a result, future installations may retrieve code that was not part of the audited dependency set. Python package installation can execute package build and installation logic with the privileges of the invoking user. The duplicate OpenCV declaration creates maintenance ambiguity. Additionally, `webdriver_manager` is imported but the executed setup uses a hard-coded `Service` path instead of `ChromeDriverManager`, unnecessarily increasing dependency and supply-chain surface. No malicious dependency is proven in the audited file. The vulnerability is the absence of a reproducible, internally consistent, hash-verified dependency policy. ### Attack Path 1. A user follows the README and invokes `pip install -r requirements.txt`. 2. Pip contacts the configured package index and resolves packages allowed by the mutable version ranges. 3. Installation may fail because of contradictory NumPy requirements, encouraging ad hoc const ...[truncated 981 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Automatically bypassing the browser's security warning removes the user's opportunity to evaluate a potentially unsafe or spoofed destination and causes the automation to continue despite a failed trust check. In this skill, that is especially dangerous because the workflow then uploads a local file and interacts with the remote site, compounding the risk of data disclosure to an untrusted endpoint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README content is presented in Chinese and does not offer an alternative language or state that the language is region-specific by design. This can violate language or locale policy when users are not given a choice or informed of the constraint.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description invites activation from a very broad natural-language request such as asking to verify an invoice, without clearly constraining when the skill should run or what confirmations are required. Broad triggers can cause unintended invocation on ambiguous user input, leading the agent to collect and transmit invoice data to an external site without sufficient user awareness or scope control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description says the skill will access the national VAT invoice platform to verify invoices, but it does not warn users that invoice details will be sent to an external government-operated website. This omission can cause unintentional disclosure of sensitive financial or business data and prevents informed consent before transmission.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The patch description and surrounding comments frame the change as adding image input support, but the actual code also introduces outbound network access by fetching arbitrary URLs. This is security-relevant because it silently expands the trust boundary and can enable SSRF-style behavior, unexpected data exfiltration paths, or access to internal resources if the modified skill later processes attacker-controlled input.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Using requests.get(..., verify=False) disables TLS certificate validation, allowing man-in-the-middle interception and tampering of downloaded image data. Because this patch introduces remote fetching into a skill workflow, an attacker on the network path could substitute malicious or unexpected content, defeat HTTPS protections, and potentially influence downstream image processing.

Content

Scanner excerpt · patch_fp.py (reported line 20)May include surrounding context.

python

# 如果是 URL，下载图片
    if base64_str.startswith('http'):
        print(f"从 URL 下载验证码图片...")
        response = requests.get(base64_str, timeout=10, verify=False)
        byte_data = response.content
    else:
        # 是 base64 字符串

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script overwrites another skill file at /root/.openclaw/workspace/skills/fp-skill/skill.py using write mode, which is a potentially impactful file operation. There is no confirmation prompt or prior user-facing warning before the write occurs; the only message is a success print after the modification is complete.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill automatically uploads a hardcoded local PDF to a remote government website without any user-facing notice, consent, or validation of what file is being sent. In an agent or shared environment, this creates a data exfiltration risk because local workspace files may contain sensitive invoice or business information and are transmitted off-host automatically.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The function explicitly clicks through the browser's TLS/security interstitial by activating the 'details-button' and 'proceed-link', and even falls back to JavaScript to force the bypass. This defeats an important browser trust boundary and can expose uploaded documents and session data to man-in-the-middle attacks or malicious endpoints if the certificate warning is legitimate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code saves a full-page screenshot to a persistent local path during processing without disclosure or access controls. Screenshots can capture sensitive invoice details, verification results, and other page content, creating residual data exposure on disk even after the browser session ends.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The README explicitly describes Selenium-based browser automation that can open pages, fill forms, click buttons, and take screenshots, but it gives no warning about interacting with third-party sites, submitting data, or triggering unintended actions. In documentation for an automation skill, that omission can lead users to run actions against external websites without understanding the consequences, increasing the chance of accidental data disclosure or unauthorized interactions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

All user-facing text in this skill file is presented in Chinese, and the file does not state that the skill is China-specific or that language selection is optional. This can amount to a language or locale policy issue because the skill appears to force a specific language without explicit user opt-in or justification.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The requirement numpy~=2.0.2 is only partially pinned, so the exact installed release is not fixed and may vary within the allowed range. Because NumPy has historical advisories, the lack of an exact version prevents reliable verification that the resolved package is outside affected versions.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The file declares NumPy twice with incompatible version constraints: numpy~=2.0.2 and numpy~=1.26.4. This creates ambiguity or installation failure, and if resolution succeeds through manual modification or tool-specific behavior, security review becomes unreliable because the actual installed version is unclear despite multiple known NumPy advisories existing historically.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency specification Pillow>=9.5.0 is not strictly pinned, so builds may resolve to different versions over time, including versions later found vulnerable or incompatible. In a supply-chain context this weakens reproducibility and makes it harder to verify whether deployed environments are affected by known Pillow issues.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text

onnxruntime==1.15.1
numpy~=2.0.2
numpy~=1.26.4
Pillow>=9.5.0
selenium~=4.36.0
webdriver_manager>=4.0.0
opencv-python-headless==4.8.1.78

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Because Pillow>=9.5.0 is open-ended, the exact Pillow release cannot be verified against known advisories. Given Pillow processes image data and has had memory-safety and resource-consumption issues, leaving the version unconstrained increases uncertainty about whether vulnerable builds may be installed.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: selenium has 2 known advisory(ies) (CVE-2022-28108 (Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content ); CVE-2023-5590 (NULL Pointer Dereference in GitHub repository seleniumhq/selenium prior to 4.14.)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

selenium~=4.36.0 permits multiple patch-level releases, so the concrete installed version is not directly auditable from this manifest alone. Since Selenium interacts with browser automation infrastructure and has known historical advisories, exact versioning is preferable for reproducibility and assurance.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

webdriver_manager>=4.0.0 allows any newer release to be installed, which introduces supply-chain and reproducibility risk because future versions may change behavior or contain malicious or vulnerable code. This is especially relevant for browser automation tooling that downloads and manages external driver binaries.

Content

Scanner excerpt · requirements.txt (reported line 8)May include surrounding context.

text

numpy~=1.26.4
Pillow>=9.5.0
selenium~=4.36.0
webdriver_manager>=4.0.0
opencv-python-headless==4.8.1.78

Static analysis

No suspicious patterns detected.