T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:13- Finding
Unrelated Agent Identity and Response-Style Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Tmp Feishu Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its Feishu/OpenClaw setup purpose, but it includes unrelated agent-identity instructions and under-scoped local file setup guidance that users should review before installing.
Review and remove the persona lines before use, validate Agent IDs with a strict lowercase letters/digits/hyphen pattern, avoid pasting App Secret into chats or committed files, store the secret in a secure configuration location, and restart the gateway only when a brief service interruption is acceptable.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:113- Finding
Path Traversal Through Unvalidated Agent Identifier
- Content
View full analysis
" $base = "C:\Users\26462\.openclaw\agents\$agentId" New-Item -ItemType Directory -Force -Path "$base\agent" | Out-Null New-Item -ItemType Directory -Force -Path "$base\.learnings" | Out-Null New-Item -ItemType Directory -Force -Path "$base\memory" | Out-Null New-Item -ItemType Directory -Force -Path "$base\skills" | Out-Null ``` The identifier is later reused in a file-write destination: ```powershell $agentId = "" $botName = "<机器人名称>" $memoryPath = "C:\Users\26462\.openclaw\agents\$agentId\memory\MEMORY.md" @" # MEMORY.md - $botName ## 基础信息 - 名称：$botName - Agent ID：$agentId - 创建时间：$(Get-Date -Format 'yyyy-MM-dd') ## 用户信息 （待填写） ## 偏好习惯 （待填写） ## 工作状态 - 状态：已配置，待首次对话 - 技能：无 "@ | Set-Content -Path $memoryPath -Encoding UTF8 ``` ### Technical Analysis The commands directly interpolate `$agentId` into directory and file paths without validating its syntax or verifying the canonical destination. Although the documentation recommends lowercase English identifiers and hyphens, that recommendation is not enforced by the PowerShell commands. PowerShell and Windows resolve `..` path components. Consequently, an identifier containing traversal sequences can cause `$base` or `$memoryPath` to resolve outside `C:\Users\26462\.openclaw\agents`. `New-Item -Force` can create directories at the escaped location, while `Set-Content` can replace the contents of an existing `MEMORY.md` if the resolved destination exists and is writable. The exact reachable target is constrained by the hardcoded suffixes such as `\agent` and `\memory\MEMORY.md`, but traversal can still redirect these operations to unintended directory trees. ### Attack Path 1. An attacker persuad ...[truncated 1173 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation hard-codes coercive identity and honorific preferences such as '主人' and '皇帝' into the skill context without user opt-in. While not a direct code-execution issue, this can normalize manipulative behavior, influence agent outputs inappropriately, and create unsafe or unprofessional interactions when the skill is reused in other contexts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README instructs users to obtain and configure a Feishu App Secret but provides no guidance on secure handling, storage, or redaction of that credential. In an agent/automation setup, this omission can lead users to place secrets directly into files, workspaces, chat logs, or skill artifacts, increasing the risk of credential leakage and downstream account compromise.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
SQP-3 applies to all file types and includes language or locale policy violations. The line states that users should uniformly be addressed as “主人,” imposing a specific form of address without indicating user preference, opt-in, or an option to change it.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly tells users to retrieve and save the Feishu App Secret but provides no guidance on treating it as a sensitive credential, avoiding plaintext storage, or limiting disclosure. In a setup guide for agent integration, this omission can lead to accidental exposure of a credential that would allow unauthorized use of the bot integration.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
For markdown files, SQP-2 covers omitted warnings about actions that can affect system integrity or availability. Restarting the gateway is an operationally impactful action, yet the document presents it as a routine step without disclosing possible interruption to active agent connectivity or message handling.
- Content
Static analysis
No suspicious patterns detected.