T09 · Insecure Skill Coding Practices
Error
- Location
config/settings.json:29- Finding
Plaintext Third-Party API Credentials Distributed with the Skill
- Content
View full analysis
- Remediation
View remediation
Security audit
Podcast Production Pipeline
Security checks for vulnerabilities and agentic risk
Overview
The skill is a plausible podcast workflow, but it ships real-looking secrets and can automatically send episode metadata to Discord without clear opt-in.
Review before installing. Do not use this package with confidential guest names, unreleased topics, or private transcripts unless the credentials are removed, the gateway token is deleted, Discord posting is made explicit and opt-in, and all API keys are supplied by your own secure configuration. Any exposed keys should be considered compromised and rotated.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/podcast-pre-production.cjs:187- Finding
Hardcoded OpenClaw Gateway Bearer Token Used as an Authentication Fallback
- Content
View full analysis
{ const token = process.env.OPENCLAW_GATEWAY_TOKEN || 'b8cb95b2fb220c2896a44dc6514f47ef4efed792bcd07c3f'; const postData = JSON.stringify({ channel: 'discord', action: 'send', channelId: config.discord_channel, message: message, silent: true }); const options = { hostname: '127.0.0.1', port: 18789, path: '/api/v1/tools/message', method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${token}`, 'Content-Length': Buffer.byteLength(postData) } }; const req = http.request(options, (res) => { ``` ### Technical Analysis The script embeds a reusable bearer token and uses it whenever `OPENCLAW_GATEWAY_TOKEN` is absent. Anyone able to inspect the package can recover the fallback token without executing the script. The token authenticates requests to the local OpenClaw gateway endpoint `/api/v1/tools/message`. Although the demonstrated request sends a Discord message, the effective impact depends on the gateway permissions associated with the token and whether the same credential is accepted by other gateway endpoints. The request is transmitted using plaintext HTTP. Loopback transport reduces exposure to remote network interception, but it does not protect the credential from local traffic inspection, debugging proxies, compromised local processes, or a malicious service bound to the expected port. A hardcoded fallback also causes the software to continue silently with a shared credential rather than failing safely when runtime authentication is not configured. ### Attack Path 1. An attacker obtains the Skill source o ...[truncated 1383 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/podcast-pre-production.cjs:187- Finding
Automatic Disclosure of Episode and Guest Metadata to a Configured Discord Channel
- Content
View full analysis
{ const token = process.env.OPENCLAW_GATEWAY_TOKEN || 'b8cb95b2fb220c2896a44dc6514f47ef4efed792bcd07c3f'; const postData = JSON.stringify({ channel: 'discord', action: 'send', channelId: config.discord_channel, message: message, silent: true }); const options = { hostname: '127.0.0.1', port: 18789, path: '/api/v1/tools/message', method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${token}`, 'Content-Length': Buffer.byteLength(postData) } }; ``` ```js // 构建 Discord 消息 const discordMessage = `🎙️ **Episode ${episodeNumber} 前期制作完成！** 📝 **话题**: ${topic} ${guestName ? `👤 **嘉宾**: ${guestName}` : ''} ✅ 已生成节目大纲和采访问题 📁 **文件**: \`${path.basename(outlinePath)}\``; // 发送到 Discord 线程 await sendToDiscord(discordMessage); ``` ### Technical Analysis After pre-production succeeds, the script automatically sends a message containing the user-supplied episode number, topic, optional guest name, and generated filename to the Discord channel configured by `config.discord_channel`. The transmission is part of the default execution path. There is no command-line opt-in, confirmation prompt, privacy warning, per-run destination verification, or local-only default. While the documentation references Discord configuration and a changelog entry mentions Discord delivery, it does not clearly explain that every normal pre-production run automatically transmits these specific fields. Podcast planning information can be confidential before publication. A topic or guest name may reveal embargoed content, unrelea ...[truncated 1690 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README shows use of external APIs (
tavily,gemini) and workflows involving guest research and transcript processing, but it does not warn users that podcast topics, guest names, and transcript contents may be sent to third-party services. This creates a real privacy and data-handling risk because users may process unpublished content or personal data without informed consent or awareness of external transmission.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 82% confidence
- Finding
The skill advertises execution of Node scripts and references API keys/configuration, but it does not declare any explicit tool scope or permissions boundary. In a skill that performs research and transcript processing, undeclared environment or tool access increases the chance of over-broad execution, secret exposure, or unintended file/system access by the hosting agent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description and all user-facing instructions are written in Chinese, effectively forcing a single language for the skill experience. There is no opt-in language selection or explicit documentation that the skill is intentionally limited to a Chinese-speaking or China-specific audience.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill processes guest research data and episode transcripts, which may contain personal data, sensitive opinions, or unpublished content, yet the description provides no privacy or data-handling warning. Users may unknowingly submit third-party personal information or confidential recordings to external APIs, creating compliance, consent, and data leakage risks.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The
host_namevalue is set to繁哥, which indicates a specific language/locale presentation baked into the skill configuration. For a general-purpose skill config, this can create a language/locale policy issue because users are not offered a choice or opt-in to that locale-specific output.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language description is entirely in Chinese and emphasizes domestic-platform adaptation, which suggests a fixed language/locale orientation without any indication that users can choose another language. This may violate language/locale policy when the skill appears to assume a specific language by default rather than offering opt-in or documenting a justified regional restriction.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file header presents this as a usable 'Podcast Post-Production Pipeline', but the implementation of later generators depends on undeclared variables such as guestName and topic, causing runtime failure before outputs are produced. This is an active contradiction between the script's documented purpose/usage and what the code can actually do.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file uses Chinese-language usage text and later formats dates/times with the fixed 'zh-CN' locale and Asia/Shanghai timezone, indicating the skill is designed to operate in a single language/locale. The file does not offer opt-in or a configurable locale, which matches the policy concern for forcing a specific language or locale without user choice.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes an end-to-end podcast production pipeline with research, outline generation, show notes, and social promotion support, but this file's actual behavior is limited to creating local markdown templates. Although it reads a transcript file, the transcript is never used to derive notes, descriptions, highlights, or platform-adapted content, so the implemented behavior falls short of the claimed automation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The generated output uses toLocaleDateString('zh-CN') and similar fixed locale/timezone calls elsewhere, which forces Chinese localization regardless of user preference. Because no user-selectable locale or documented regional limitation is present, this is a natural-language locale policy issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This output template embeds a fixed Chinese locale and Shanghai timezone for generated timestamps. Hard-coding a locale in user-facing content without offering a choice or documenting a justified regional scope violates the stated natural-language locale policy.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This template forces Chinese localization and Shanghai timezone for output metadata. The skill does not provide any mechanism for users to select another language or locale, so it enforces a specific locale by default.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The generated social-media package includes metadata localized only for zh-CN and Asia/Shanghai. Without opt-in or a documented regional requirement, this is an avoidable language/locale policy issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This template again fixes output to Chinese locale and Shanghai timezone, making the skill's user-facing content locale-specific with no choice for users. That matches the natural-language policy concern around forced locale behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
User-provided topic and guest information are sent to Tavily for external research without explicit notice or consent. In a podcast workflow this may seem normal, but guest identities or unreleased episode topics can be sensitive, so silent transfer to a third-party service creates privacy and confidentiality risk.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script performs an outbound side effect by posting episode status/details to Discord, but that behavior is outside the core local pre-production flow and is not clearly disclosed by the stated scope. Undisclosed external messaging increases data exposure risk because topics, guest names, and workflow metadata are transmitted to another system without explicit user consent or a clearly bounded trust model.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code includes a hardcoded fallback bearer token for a local messaging gateway, which is a credential exposure issue and enables unauthorized use of that gateway if the script or repository is shared. Even though the endpoint is localhost, embedded secrets are dangerous because they can be reused by other local processes or attackers with code access, and they normalize hidden privileged capabilities unrelated to the main research function.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The script sends generated episode details, including topic and possibly guest name, to Discord without clear upfront disclosure. This creates an unnecessary external dissemination path for potentially embargoed production information, especially risky in media workflows where episode plans and guest participation may be confidential until publication.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
Most user-facing instructions and descriptions are provided only in Chinese, which effectively forces a specific language for users of the skill. The file does not offer an alternative language option or explain that the skill is intentionally limited to a Chinese-language audience.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The package description presents a very broad end-to-end automation capability covering multiple podcast-production tasks, but it does not define any specific trigger phrases, scope boundaries, or exclusion conditions. In a manifest context, this kind of broad natural-language description can contribute to unintended invocation because it overlaps with many common podcast-related requests.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The natural-language interface and usage text are presented in Chinese, and the script later formats time using the zh-CN locale, but there is no indication that this is optional or required for a region-specific purpose. This can violate language/locale policy when a skill forces a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The generated outline always uses the zh-CN locale and Asia/Shanghai timezone for its timestamp. This is a locale-specific behavior that is not presented as configurable or justified as region-specific, which may conflict with organizational language/locale policy.
- Content