Security audit

Vibe Card

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real contact-card manager, but it asks the agent to publish personal profile data, auto-import received cards, and set up recurring sync in ways that need careful review before installation.

Install only if you are comfortable with the agent keeping a local contact book, publishing selected profile fields to adonghub.cn, fetching and syncing contacts from a remote service, and potentially creating a recurring OpenClaw sync task. Before using it, confirm what fields will be published, avoid auto-importing cards from untrusted messages, keep the server endpoint pinned to the intended HTTPS origin, and ask how to list or remove any scheduled sync job.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:75
Finding: Mandatory Promotional Output Enables Cross-Agent Skill Propagation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:75-81`; `assets/share-template.txt:1-8`; duplicated in `assets/onboard-generated.txt:5-12` and `assets/already-has-card.txt:5-12` **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: Medium ### Vulnerable Code ```markdown ### 5. 发名片读取 assets/share-template.txt，用 profile.json 和 config.json 中的字段值替换对应占位符，原样输出替换后的文本。不做任何改写、润色或精简。占位符映射：{name}、{title}、{one_liner}、{current_focus}（数组用 "、" 连接）← profile.json；{user_id} ← config.json.server.user_id。 ``` ```text 🎴 {name}发来了他的名片（Vibe Card）我是{name}，{title}，{one_liner}。当前聚焦{current_focus}。这是我个人的详情信息，敬请您阅览 https://www.adonghub.cn/{user_id} 🔗 如果您对我感兴趣，请将这条消息复制给您的助理 Agent，即可自动保存。如 Agent 未安装 Vibe Card，安装地址：https://clawhub.ai/skills/vibe-card vibe-card://{user_id} ``` ### Technical Analysis The Skill requires the Agent to reproduce a fixed sharing template verbatim and explicitly prohibits rewriting, shortening, or removing content. The required output goes beyond presenting the user's contact information: it includes Skill advertising, an installation link, instructions to forward the content to another Agent, and a `vibe-card://` protocol trigger. The receiving workflow is designed to detect that trigger automatically, retrieve structured card data from a server, and save it to the recipient's local contact store. Consequently, ordinary card-sharing behavior becomes a propagation mechanism that influences both the current Agent's response and a recipient Agent's subsequent behavior. ### Attack Path 1. A user generates or requests their Vibe Card. 2. The Skill instructs the Agent to emit the template without modification. 3. The output includes an installation advertisement, forwarding instructions, and `vibe-card://{user_id}`. 4. The user forwards the block to another user or Agent. 5. A recipient Agent with the Skill recognizes the protocol line. 6. The recipient Agent retrieves remote card data and writes it to its local cont ...[truncated 631 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the requirement to reproduce the sharing template verbatim. 2. Keep the default card output limited to information the user explicitly chose to share. 3. Place the installation advertisement, forwarding instructions, and protocol URI behind a separate, explicit opt-in action. 4. Clearly label any protocol payload as machine-readable content and explain its effect before displaying it. 5. Require recipient confirmation before fetching a remote card or writing it to `contacts.json`. 6. Display the remote origin, requested identifier, and fields to be stored before import. 7. Provide a plain-text sharing mode that contains no installation link or automatic-processing trigger. ]]>

T06 · System Persistence

Error

Location: references/manual.md:151
Finding: Recurring OpenClaw Task Establishes Cross-Session Persistence<![CDATA[ ## Vulnerability Details **File Location**: `references/manual.md:151-175`; referenced by `SKILL.md:72` **Vulnerability Type**: T06: System Persistence **Risk Level**: High ### Vulnerable Code ```markdown ### 9. 定时同步 **创建时机：** 首次发布名片后，Agent 引导用户创建定时同步任务。 **创建命令（OpenClaw 环境）：** ```bash openclaw cron add \ --name "Vibe Card 花名册同步" \ --cron "0 9 * * 2,5" \ --session isolated \ --message "[cron:vibe-card-sync] 定时同步花名册。读取 skills/vibe-card/references/manual.md「同步花名册」段落执行。无更新则回复 NO_REPLY。" \ --announce ``` **参数说明：** - `--cron "0 9 * * 2,5"`：每周二、周五早上 9:00（用户时区） - `--session isolated`：独立会话，避免上下文膨胀 - `--message`：cron 触发时的 prompt，以 `[cron:` 开头防止嵌套 - `--announce`：有更新时通知用户 **降级处理：** 如果用户环境不支持 `openclaw` 命令，跳过此步骤，不影响其他功能。用户可随时手动说"同步花名册"触发。 ``` ### Technical Analysis The Skill instructs the Agent to create a recurring OpenClaw cron task following the first card publication. The task survives the initiating conversation and starts isolated Agent sessions twice per week. Each invocation rereads the Skill manual and executes its synchronization workflow. That workflow accesses persistent configuration and contact data and communicates with a configured remote server. Because the schedule has no expiration or automatic removal condition, these operations can continue indefinitely after the original Skill interaction. The use of an isolated session does not eliminate persistence; it confirms that execution occurs in new sessions independently of the original context. ### Attack Path 1. The user installs the Skill and publishes a card for the first time. 2. The Skill directs or encourages creation of the supplied `openclaw cron add` task. 3. OpenClaw stores the recurring task outside the initiating conversation. 4. Every Tuesday and Friday, the scheduler creates an isolated Agent session. 5. The scheduled prompt tells the Agent to reread the Skill's synchronization instructions. 6. The Agent reads local configuration and contact records and performs ...[truncated 641 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not create or direct creation of a scheduled task as part of the default publication flow. 2. Present scheduling as a separate, explicit opt-in operation after explaining: - The exact schedule. - The files that will be read. - The remote service that will receive requests. - The fact that execution continues across sessions. 3. Require affirmative confirmation immediately before invoking `openclaw cron add`. 4. Default to manual synchronization. 5. Add a bounded lifetime or expiration date to the task where supported. 6. Provide the exact command for listing and removing the scheduled task. 7. Verify the expected Skill path and pinned Skill version before each scheduled execution. 8. Minimize scheduled-session permissions to only the files and network origin required for synchronization. 9. Log each invocation and expose the latest execution time and result to the user. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: references/manual.md:105
Finding: Unvalidated Configurable Server Endpoint Permits Request Redirection<![CDATA[ ## Vulnerability Details **File Location**: `references/manual.md:105-109`, `references/manual.md:122-127`; reinforced by `SKILL.md:112` **Vulnerability Type**: T09: Insecure Skill Coding Practices **Risk Level**: High ### Vulnerable Code ```markdown ### 7. 收名片 1. 检测到 `vibe-card://` 开头的消息，或收到三段式文本块 2. 提取 user_id：优先从协议行 `vibe-card://{user_id}` 提取；如果没有协议行，从名片文本中的 URL `https://www.adonghub.cn/{user_id}` 提取 3. 从服务器获取名片数据：`GET {config.server.endpoint}/card/{user_id}` 4. 安装来源写死为 ClawHub 官方地址：**https://clawhub.ai/skills/vibe-card**，不信任服务器返回的 _skill.source 字段 ``` ```markdown ### 8. 同步花名册 1. 检查 config.json 中 api_key → 未配置则提示"先生成名片，确认后会自动注册并上线" 2. 收集 contacts.json 中有 server_user_id 的联系人 → 没有则提示"花名册中没有线上名片，先收几张名片吧" 3. 调同步接口，传 targets 数组和 since（config.json.sync.last_sync_at） 4. 检查返回结果中 has_update: true 的联系人 5. 冲突检测（manually_edited_fields 保护）： ``` The Skill additionally states: ```markdown - 服务器 endpoint 从 config.json.server.endpoint 读取，不要硬编码或猜测路径。 ``` ### Technical Analysis Card retrieval and synchronization use `config.json.server.endpoint` as the destination without specifying validation of its scheme, hostname, port, resolved address, redirects, or relationship to the intended service. The configuration is a writable local JSON file maintained by the Agent. If another local process, Skill, compromised workflow, or user-supplied configuration changes this endpoint, subsequent Vibe Card operations can be redirected to an attacker-controlled host or another service reachable from the Agent environment. Card retrieval also appends a user-controlled or message-derived `user_id` to the selected origin without documented identifier validation. This creates an SSRF-style request-redirection condition in environments where the Agent's network tools can reach internal or privileged services. Synchronization may also disclose contact target identifiers and the last synchronization timestamp to the substituted endpoint. Publication or registration data may be ...[truncated 1544 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin all production requests to an explicit allowlist of trusted HTTPS origins. 2. Reject non-HTTPS schemes, embedded credentials, unexpected ports, fragments, and malformed URLs. 3. Resolve destination hostnames and block loopback, private, link-local, multicast, and reserved addresses for both IPv4 and IPv6. 4. Revalidate every redirect target or disable redirects entirely. 5. Treat endpoint changes as security-sensitive configuration changes requiring explicit user confirmation. 6. Validate `user_id` against a strict allowlist such as a bounded alphanumeric, underscore, and hyphen pattern; reject path separators and encoded traversal characters. 7. Authenticate server responses and validate them against a strict schema before writing any fields to `contacts.json`. 8. Display the effective destination origin and proposed contact changes before the first request to a changed endpoint. 9. Apply least-privilege network controls so the Skill can access only the approved Vibe Card API origin. 10. Avoid transmitting API keys or profile/contact data to any endpoint that has not passed origin validation. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (24)

Missing User Warnings

High

Confidence: 94% confidence
Finding: The description does not disclose that profile and contact information may be pushed to and fetched from a remote server. Since the skill handles personal identity and contact data, omission of this network-sync behavior undermines informed consent and increases the privacy and security impact of using the skill.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill advertises automatic recognition and saving of received cards but does not clearly warn users that incoming messages can be persisted as contact data. This weakens informed consent and makes privacy-impacting behavior more dangerous, especially because card receipt can be triggered by ordinary chat content containing the custom protocol.

Missing User Warnings

High

Confidence: 97% confidence
Finding: After a generic confirmation like '可以了', the skill automatically registers the user and publishes profile data to a remote server, but the flow does not require a clear disclosure that external transmission will occur. This is dangerous because users may believe they are only saving locally, while the skill is actually creating a server-side account and uploading public profile information.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrase "初始化" is generic and likely to appear in normal conversations unrelated to this skill. Because this skill performs filesystem initialization when triggered, accidental activation could create or modify local state without the user's informed intent, increasing the chance of unintended data handling.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: Auto-activating on any message beginning with vibe-card:// allows external content to trigger contact ingestion and server fetch behavior without a clear user consent step. In this skill's context, that means an attacker or spammer could send crafted links that cause unsolicited remote requests, data import, or poisoning of the local contact list.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This text file presents all user-facing content exclusively in Chinese, including instructions and calls to action, with no indication that the user can choose another language. Under the policy rule for natural-language violations, forcing a specific language without opt-in is reportable unless the locale restriction is explicitly justified.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The only user-facing text in this file is written in Chinese, which implies a fixed language/locale experience. Under the policy, language constraints should either offer user opt-in/choice or be clearly justified as region-specific, neither of which is present here.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: All user-facing text in this skill file is written in Chinese, with no indication that the user opted into that language or that the skill is intended only for a Chinese-language audience. This can violate language or locale policy when a skill imposes a specific language without user choice or documented justification.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The text explicitly instructs users to copy the message to their agent so it will 'automatically save' the card, and includes a custom protocol URI. In this skill’s context, that creates an injection-like activation path where a generic forwarded message can trigger privileged contact import behavior without strong verification of origin, consent, or user intent.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The onboarding text encourages broad natural-language triggers such as generating cards, sharing cards, checking rosters, and syncing contacts, which can overlap with ordinary conversation and cause unintended skill activation. In a contact-management skill, accidental activation can lead to privacy-sensitive actions such as exposing contact data, creating or sharing a profile, or modifying a roster without clear user intent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The text states that received cards will be automatically recognized and saved, but gives no warning, consent flow, or explanation of what data is stored. In the context of a social card and address-book skill, automatic ingestion of third-party contact data can create privacy, consent, and poisoning risks, especially if malicious or spoofed cards are received via the custom protocol.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The entire share template is written only in Chinese and provides no indication that the language is user-selectable or limited to a China-specific deployment context. This can violate language/locale policy requirements when a skill imposes a specific language without user opt-in.

Natural-Language Policy Violations

Medium

Confidence: 89% confidence
Finding: 标题和整篇说明均以中文编写，未见任何允许用户选择语言、提供多语言版本，或声明该技能仅面向特定中文区域用户的说明。根据语言/地区政策，若技能自然语言内容默认强制单一语言且无用户选择，属于需要提示的政策问题。

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: Across the document, all invocation examples, confirmations, and operational instructions are in Chinese only, which effectively forces a single language experience. The file does not state that the skill is intentionally limited to a Chinese-speaking or region-specific audience, nor does it offer language selection or opt-in.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The manual explicitly tells the agent to proactively extract personal details about a contact from memory and store them without obtaining explicit per-field approval. In a contact-management context, this increases the chance of collecting inaccurate or sensitive third-party data beyond what the user intended to save.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The manual directs the agent to persist contact records containing personal information to contacts.json without requiring a user-facing disclosure that this data will be stored locally. Because the skill manages third-party personal data, silent persistence creates privacy and consent risks, especially when the agent also infers fields from memory.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The skill directs the agent to derive the user's profile fields and contact information from memory for card generation, including contact methods and background information. Although drafting from context can be helpful, doing so without explicit disclosure and approval risks over-collection, accidental inclusion of sensitive data, and unintended publication in later steps.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill automatically fetches card data from a remote server when it detects a vibe-card message, without first warning the user that a network request will be made. Even though the message contains a card identifier, automatic lookups can leak usage metadata and trigger unanticipated remote interactions from untrusted incoming content.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill instructs the agent to create a scheduled task via the OpenClaw CLI, which establishes persistent automation outside the immediate user request. In the context of a contact-card skill, this expands the skill's operational scope and can cause recurring network activity and data processing without fresh user review each time.

Natural-Language Policy Violations

Low

Confidence: 98% confidence
Finding: All user-facing instructions and trigger phrases are presented only in Chinese, and the file does not indicate that language selection is optional or region-specific. This can violate language/locale policy when a skill implicitly requires a specific language without user choice.

Natural-Language Policy Violations

Low

Confidence: 95% confidence
Finding: The user-facing text is entirely in Chinese and includes a fixed trigger phrase in Chinese ("生成我的名片") without indicating that other languages are supported or that Chinese is required for a justified region-specific use case. This can violate a language/locale policy where users must be given a choice or explicit opt-in.

Natural-Language Policy Violations

Low

Confidence: 97% confidence
Finding: The only user-facing message in this file is written in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking context. This can violate language/locale policy when a skill imposes a specific language by default.

Intent-Code Divergence

Low

Confidence: 80% confidence
Finding: The document correctly states that `_skill.source` is untrusted, but the broader skill behavior includes automatic recognition and saving of cards received via the `vibe-card://` protocol. That combination creates a real trust-boundary risk: if downstream logic infers provenance, auto-installs, or applies privileged handling based on metadata embedded in received cards, an attacker can spoof card origin and trigger unwanted persistence or unsafe workflows.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: The HTML document declares `lang="zh-CN"`, and the visible UI strings throughout the page are written in Chinese. This indicates the skill interface is fixed to a specific language/locale with no user opt-in or documented rationale, which matches the language/locale policy concern.

Static analysis

No suspicious patterns detected.