content-qa-guard

• Outcome: Review
• Latest audit: Aug 15, 2026 · 3:53 AM UTC
• Version: 1.0.0

Overview

This content-review skill is not clearly malicious, but it needs Review because it can send reviewed text through external agents and its safety claims exceed what the code reliably performs.

Install only if you are comfortable with reviewed content being sent to configured OpenClaw/MCP agents and possibly to a QA test chat. Do not use it for sensitive, confidential, regulated, or unpublished business text unless outbound calls and verification messaging are disabled or explicitly controlled.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

# db_logger统一日志 (R14统一入口铁律)
# 路径: skills/_lazy/content-qa-guard/scripts/ → parents[4]=项目根
sys.path.insert(0, str(__import__('pathlib').Path(__file__).resolve().parents[4] / "scripts"))
sys.path.insert(0, str(__import__('pathlib').Path(__file__).resolve().parents[4]))  # 项目根(R45修复: parents[5]→parents[4])
from mcps.shared.db_logger import get_logger
logger = get_logger("content-qa-guard", source="check_compliance.py(v25.0合并)")

• Confidence: 88% confidence
• Finding: The code prepends a computed project-root path to sys.path before importing mcps.shared.db_logger, which changes Python's module resolution order globally. If an attacker can place or influence files in that inserted path, they may cause the process to import a malicious module and achieve arbitrary code execution during startup.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

# db_logger统一日志 (R14统一入口铁律)
# 路径: skills/_lazy/content-qa-guard/scripts/ → parents[4]=项目根
sys.path.insert(0, str(__import__('pathlib').Path(__file__).resolve().parents[4] / "scripts"))
sys.path.insert(0, str(__import__('pathlib').Path(__file__).resolve().parents[4]))  # 项目根(R45修复: parents[5]→parents[4])
from mcps.shared.db_logger import get_logger
logger = get_logger("content-qa-guard", source="check_compliance.py(v25.0合并)")

• Confidence: 88% confidence
• Finding: This line inserts a writable/variable project subdirectory at the front of sys.path using dynamic import mechanics, affecting subsequent imports. In environments where repository contents or adjacent files can be modified, this creates a module-hijacking opportunity that can lead to arbitrary code execution under the skill's privileges.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence
• Finding: The skill declares read/exec tool access and documents shell execution plus local log writing, but the permission model/disclosure does not clearly bound those capabilities. In a user-invocable content-review skill, undeclared file and shell behaviors expand the attack surface and can be abused to read local data, run unintended commands, or persist data without clear user consent.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The stated purpose is content compliance review, but the documented behavior also includes local persistence, external MCP/service calls, and quota enforcement that are not transparently described as part of the skill's effective data flow. This mismatch can cause users or orchestrators to trust the skill with sensitive content while it transmits or stores that content in additional places, increasing confidentiality and governance risk.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The documentation claims the skill does not provide publishing capability, yet the workflow includes sending a test message through an external agent and recording verification logs. Even if framed as QA, this is still outbound content transmission and contradicts the trust expectations of a review-only guard, creating a risk of unintended data disclosure or action-taking.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: A content-review guard does not naturally need to send messages to an external endpoint; adding message-sending creates an unnecessary exfiltration path for reviewed content and metadata. Because the send occurs on pass/warning, benign-looking content could still be copied to a test chat without the caller fully appreciating that side effect.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is presented as a content-audit guard, but its workflow includes sending a test message via another agent using an environment-provided chat ID. That creates an outbound side effect inconsistent with the stated non-publishing role, which can be abused for unintended messaging, data leakage, or covert external signaling if reviewed content is embedded in the message flow.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: An active messaging capability is unnecessary for a guardrail skill whose purpose is analysis and compliance checking. Because the skill has exec capability and can trigger an external agent action, it expands the attack surface and enables actions beyond passive review, making the skill more dangerous than its context suggests.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The business rules add an optional post-review action that sends a message via an external MCP and writes verification logs, which goes beyond passive content compliance checking. Even if framed as QA, this creates side effects, external communication, and possible data handling without clear necessity, consent, or tight scoping, increasing the attack surface for data leakage or unintended outbound actions.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The documented end-to-end verification behavior conflicts with the skill's stated non-publishing/non-action scope by introducing an outbound send_message operation after review. Scope expansion like this is dangerous because users may invoke a compliance checker expecting analysis only, while the skill can perform external actions that may expose reviewed content or trigger unintended interactions.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The skill metadata and docstring claim a stronger compliance pipeline, including delegation to a `risk-detector` for 10-category risk detection, but the implementation only performs local keyword checks and a generic agent call. This mismatch can create a false sense of safety, causing users or upstream systems to rely on incomplete screening for high-risk content.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The docstring says the code calls a specific MCP tool, but it actually shells out to `openclaw agent` with a free-form natural-language message. That indirection weakens guarantees about what tool is really invoked and how arguments are interpreted, increasing the chance of prompt-manipulation, policy bypass, or unintended data handling by the agent layer.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The code claims a three-level review with AI semantic analysis, but level 2 is effectively unimplemented and always returns an empty finding set. This can silently under-detect policy-violating content while still reporting a completed review, which is dangerous in a compliance-guard skill whose purpose is to block risky text before release.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation fails to clearly warn users that content deemed acceptable may be sent to an external test messaging endpoint. This missing transparency undermines informed consent and can lead to accidental leakage of sensitive or proprietary content during what users believe is a local or review-only operation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The markdown describes sending test messages and persisting verification logs but does not provide a user-facing warning about external transmission or storage. This lack of transparency can lead to unconsented handling of potentially sensitive content, especially in a compliance-review context where submitted text may contain private, regulated, or business-sensitive material.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: User-supplied content is transmitted to an external CLI/agent for analysis without any disclosure, consent, or data-classification guard in this file. Because this skill handles potentially sensitive unpublished content, sending it to an external agent expands the data exposure boundary and may violate privacy, confidentiality, or platform obligations.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: When content is flagged, the full text may be sent again to an external tool for rewrite suggestions, creating a second disclosure path for the same potentially sensitive material. Re-transmission increases the chance of leakage and may expose exactly the content that was judged risky or confidential.

Unvalidated Output Injection

High

• Category: Output Handling

Content

f"调用MCP工具 {tool_name} 参数: {json.dumps(arguments, ensure_ascii=False)}",
            "--agent", "xingbu"
        ]
        result = subprocess.run(agent_cmd, capture_output=True, text=True, timeout=60, encoding="utf-8")
        if result.returncode == 0:
            return {"success": True, "output": result.stdout.strip()}
        else:

• Confidence: 84% confidence
• Finding: The code passes attacker-controlled text into a free-form message for an external agent and then trusts the agent's raw stdout as tool output without validation. In a security-review workflow, this can let prompt-injected content manipulate the agent's behavior or produce spoofed results that the skill treats as authoritative, leading to false passes, false rewrites, or downstream unsafe decisions.

Static analysis

No suspicious patterns detected.