ClawHub
Back to skill

Security audit

高价值目标任务猎头

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a Chinese task manager that saves tasks locally and does not show hidden data sharing or dangerous behavior.

Install only if you are comfortable using Chinese commands and storing personal goals, schedules, and progress notes in a local JSON file under your OpenClaw workspace. Avoid entering sensitive secrets into task descriptions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill clearly describes persistent local file storage at `~/.openclaw/workspace/memory/tasks/tasks.json`, which implies file read/write capability, yet it declares no explicit tool scope or permissions. This creates an authorization ambiguity: an agent may be granted broader filesystem or environment access than users expect, increasing the chance of unintended data access or modification.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
All trigger phrases, commands, and examples are specified only in Chinese, and the description does not indicate that other languages are supported or that Chinese is an optional locale. This can be a natural-language policy issue when a skill effectively forces a specific language without user opt-in or justification.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill persists personal task data to a local JSON file without warning users that potentially sensitive information about goals, schedules, career plans, and progress will be stored on disk. If the local environment is shared, backed up, synced, or otherwise accessible, this can expose private behavioral and professional information without informed user consent.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The module docstring and command-line usage/output strings are written exclusively in Chinese, indicating the skill is designed around a single language. There is no natural-language indication that users may choose another language or that the Chinese-only constraint is required for a region-specific purpose.

Tainted flow: 'TASK_FILE' from os.environ.get (line 15, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
"""确保数据目录存在"""
    TASK_DATA_DIR.mkdir(parents=True, exist_ok=True)
    if not TASK_FILE.exists():
        with open(TASK_FILE, 'w', encoding='utf-8') as f:
            json.dump({'tasks': [], 'next_id': 1}, f, ensure_ascii=False, indent=2)

def load_tasks():
Confidence
65% confidence
Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Tainted flow: 'TASK_FILE' from os.environ.get (line 15, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
"""确保数据目录存在"""
    TASK_DATA_DIR.mkdir(parents=True, exist_ok=True)
    if not TASK_FILE.exists():
        with open(TASK_FILE, 'w', encoding='utf-8') as f:
            json.dump({'tasks': [], 'next_id': 1}, f, ensure_ascii=False, indent=2)

def load_tasks():
Confidence
65% confidence
Finding
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Vague Triggers

Low
Confidence
86% confidence
Finding
The description enumerates trigger phrases including "查看任务", but elsewhere the documented usage requires a task ID such as "查看任务 1". Without clarifying whether the bare phrase should invoke the skill or what arguments are mandatory, the activation condition is underspecified and could lead to unintended invocation attempts.

Natural-Language Policy Violations

Low
Confidence
87% confidence
Finding
The package description is entirely in Chinese and does not indicate that other languages are supported or that the locale restriction is intentional for a region-specific audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Static analysis

No suspicious patterns detected.