生成每日金融日报

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:16 AM UTC
• Version: 1.0.0

Overview

This skill has a clear financial-reporting purpose, but it relies on unaudited local configuration and automatically reaches an email-sending step, so it needs review before installation.

Review before installing. Only use this in a controlled OpenClaw workspace where the external config path and sibling skills are trusted, and require a manual review/confirmation step before email delivery. Confirm recipients, attachments, and output paths, because failures in earlier report stages may not stop the email stage.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/generate_daily_report.py:3

Finding

External Configuration Import Enables Local Tool Hijacking

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_daily_report.py, lines 3-7 and 28-32
Vulnerability Type: Untrusted external module and executable path resolution
Risk Level: High

Relevant Code:

python

import sys
sys.path.insert(0, r"C:\Users\qu669\.openclaw\workspace-yoyo")
sys.stdout.reconfigure(encoding='utf-8')
import os, datetime, subprocess, logging
import config

python

for label, rel_path in scripts:
    script = os.path.join(config.SKILLS_BASE, rel_path)
    log.info(f"\n{label}...")
    if not os.path.exists(script):
        log.error(f"Script does not exist: {script}"); continue
    result = subprocess.run([config.PYTHON, script])

Technical Analysis

The script places a hard-coded directory outside the audited project at the beginning of sys.path and then imports config. Python executes the top-level code of a module during import, so a malicious or replaced config.py in that directory can execute arbitrary code immediately.

The imported configuration also controls config.PYTHON and config.SKILLS_BASE. These values determine the executable and scripts passed to subprocess.run. The code only checks whether each selected script exists; it does not verify that the executable and scripts are trusted, reside under an approved directory, or match expected files.

The external config.py, Python executable, and workflow scripts are absent from the audited project. Their integrity and behavior therefore cannot be established from this artifact.

Attack Path

1. An attacker obtains write access to C:\Users\qu669\.openclaw\workspace-yoyo, or replaces a preexisting file in that directory through another local compromise.
2. The attacker creates or modifies config.py.
3. The malicious module either executes its payload as top-level import code or assigns attacker-controlled paths to PYTHON and SKILLS_BASE.
4. A user or Agent invokes the ...[truncated 758 chars]

Remediation

View remediation

Remediation Suggestions

• Store configuration within the audited project and resolve it relative to __file__.
• Do not prepend a user-writable external directory to sys.path.
• Prefer explicit configuration parsing that does not execute Python code, such as a validated JSON or TOML file.
• Use sys.executable or an administrator-approved absolute interpreter path instead of an externally controlled config.PYTHON value.
• Resolve every workflow script to a canonical path and verify that it remains beneath an approved, read-only Skill directory.
• Reject symlinks, path traversal, unexpected executables, and scripts outside the allowlisted project root.
• Protect the Skill and configuration directories with restrictive filesystem permissions.
• Where feasible, verify script hashes or signed release manifests before execution.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_daily_report.py:28

Finding

Workflow Continues to Email Delivery After Required Stage Failures

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_daily_report.py, lines 28-41
Vulnerability Type: Fail-open workflow and insufficient output validation
Risk Level: Medium

Relevant Code:

python

for label, rel_path in scripts:
    script = os.path.join(config.SKILLS_BASE, rel_path)
    log.info(f"\n{label}...")
    if not os.path.exists(script):
        log.error(f"Script does not exist: {script}"); continue
    result = subprocess.run([config.PYTHON, script])
    if result.returncode != 0:
        log.warning(f"Return code: {result.returncode}")

log.info(f"\n{'='*50}")
log.info(f"Workflow completed. Date: {config.REPORT_DATE}")
if os.path.exists(config.OUTPUT_DIR):
    for f in os.listdir(config.OUTPUT_DIR):
        if f.endswith(('.docx', '.pptx', '.json')):
            size = os.path.getsize(os.path.join(config.OUTPUT_DIR, f))
            log.info(f"Attachment: {f} ({size:,} bytes)")

Technical Analysis

The four stages are executed in order, including the final email-sending stage. When a required script is absent, the program logs the condition and continues. When a subprocess exits unsuccessfully, the program records only a warning and still proceeds to subsequent stages.

There is no dependency gate preventing email delivery after data collection or document generation fails. The code also does not validate that expected output files were freshly generated for config.REPORT_DATE, are complete, or correspond to the current workflow run. Finally, it emits an unconditional completion message and does not return a nonzero process status for stage failures.

This fail-open behavior can cause an email stage to consume stale, partial, malformed, or mismatched artifacts remaining in the output directory.

Attack Path

1. An attacker or operational failure causes the collection, Word-generation, or presentation-generation script to be missing, terminate unsuccessfully, ...[truncated 957 chars]

Remediation

View remediation

Remediation Suggestions

• Stop the workflow immediately when any required stage is missing or returns a nonzero status.
• Use subprocess.run(..., check=True) and handle CalledProcessError by recording failure and exiting with a nonzero status.
• Run email delivery only after all required prerequisite stages have succeeded.
• Create a unique output directory for each workflow invocation instead of reusing residual artifacts.
• Before delivery, verify the presence, type, expected name, report date, size, and successful parseability of every required attachment.
• Record generated artifacts in a per-run manifest and allow the email stage to use only files listed in that manifest.
• Remove partial files after a failed stage or write outputs atomically using temporary files followed by a rename.
• Emit a success message only after email delivery succeeds; otherwise emit an explicit failure state and propagate a nonzero exit code.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill orchestrates local file generation and script execution, but it does not declare any explicit tool scope or permissions. This creates an authorization ambiguity where an agent may invoke shell or file access more broadly than users expect, increasing the risk of unintended command execution or filesystem access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description advertises generating Word/PPT files and sending email, but it does not warn the user about filesystem writes or outbound data transmission. In this context, the lack of transparency is dangerous because the workflow collects external data, writes to a local path, and then sends results by email, which could expose sensitive content or surprise the user with external actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are broad and generic enough that the skill could activate for ordinary requests like generating a daily report or morning brief, even when the user did not intend to run this financial-report workflow. Because the workflow performs data collection, file creation, and email sending, accidental invocation could lead to unnecessary external queries and unintended data transmission.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This orchestrator automatically runs a multi-step workflow that culminates in sending email, but there is no confirmation gate, dry-run mode, or user-visible warning in this file before that outbound action occurs. In an agent setting, automatic external communication increases the risk of unintended disclosure, accidental mass sending, or triggering side effects without the user clearly authorizing the final step.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_daily_report.py (reported line 31)May include surrounding context.

python

log.info(f"\n{label}...")
    if not os.path.exists(script):
        log.error(f"❌ 脚本不存在: {script}"); continue
    result = subprocess.run([config.PYTHON, script])
    if result.returncode != 0:
        log.warning(f"   ⚠️ 返回码 {result.returncode}")

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest describes a workflow for collecting data, generating reports, and sending email, but this file achieves that by spawning arbitrary Python scripts from other skill directories. Launching subprocesses is a materially broader execution capability than ordinary report generation logic and is not itself declared in the skill description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The top-level natural-language description and all user-facing log messages are in Chinese, indicating the skill is designed to operate in a fixed language. There is no visible opt-in, language selection, or documented region-specific justification in this file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.