T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
init.py:45- Finding
Automatic Access to User Profile and Conversation Memory Without Explicit Consent
- Content
View full analysis
- Remediation
View remediation
Security audit
HF Daily Deep Researcher
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent paper-research assistant, but it automatically reads local profile and conversation-memory files and uses broad external search and shell-fetch behavior that users should review before installing.
Install only if you are comfortable with the setup script reading OpenClaw profile and memory files to infer research interests, storing that information in the skill configuration, sending research topics and paper metadata to arXiv, HuggingFace/GitHub, Kimi where available, and optionally Feishu after authorization. Prefer manually configuring research_focus and reviewing config.json before scheduled or cloud-upload use.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
agents/searcher_prompt.md:31- Finding
Mutable Third-Party Research Feed Retrieved Through General Shell Execution
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (31)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill describes capabilities that read environment data, read/write workspace files, and orchestrate networked research, but it does not declare an explicit tool scope or permissions boundary. That creates a transparency and least-privilege problem: users and hosting platforms cannot easily constrain what the skill may access, increasing the chance of overbroad file access, unintended persistence, or exposure of local data during execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill automatically writes user-derived research focus, fetched paper data, intermediate analyses, and generated reports to local workspace files, yet this persistence is not prominently disclosed up front. That is a privacy and integrity risk because users may unknowingly leave sensitive interests, notes, or generated content on disk where other tools, users, or later runs can access or reuse it.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill performs automatic network transmission to multiple third-party services and also supports optional upload to Feishu, but it lacks a strong privacy/integrity warning and consent checkpoint before sending content off-box. User research topics, selected papers, generated summaries, and possibly workspace-derived context could be disclosed to external services, and third-party content may also be ingested without clear trust boundaries.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation expands the skill from research/search into shell command execution via exec and curl, which materially increases attack surface. Once shell execution is permitted, untrusted inputs such as URLs, topics, config-derived strings, or future prompt changes could lead to command injection, arbitrary network access, secret leakage, or writing attacker-controlled content into the workspace.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code presents its module description and command-line help/output in Chinese, which is a natural-language locale constraint. The file does not indicate that the tool is region-specific or provide any opt-in or alternative language choice, so it violates the language/locale policy criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The argparse description and help text shown to users are all fixed in Chinese. Because the skill does not offer a language choice or document a justified region-specific scope, this is a natural-language policy violation under the locale requirement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill instructions are written entirely in Chinese and explicitly prescribe the output format and content language, but do not offer any user opt-in or alternative locale. This creates a natural-language policy concern because it effectively fixes the interaction language without documenting a justified region-specific constraint.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The title and instructions define the agent behavior entirely in Chinese, and the output format requires the final reply in that same language context. There is no indication that the user may choose another language or that the locale restriction is justified as region-specific, which makes this a language/locale policy issue.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The prompt contains conflicting control instructions: one section forbids any intermediate output, while a later timeout section requires progress reports before completion. In an orchestrated multi-agent workflow, this ambiguity can cause the agent to violate caller expectations, leak partial work, or break parsers that assume only a final-formatted response.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The entire skill prompt is written as a mandatory Chinese-language operating specification, with no indication that the user may choose another language or locale. This creates a natural-language policy issue because it effectively constrains the agent to a specific language without explicit user opt-in or a documented regional/compliance reason.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The prompt explicitly instructs the agent to invoke
execwithcurlagainst an external URL, expanding the skill from constrained research/search behavior into arbitrary shell-command execution. Even though the example is limited, granting shell execution in a prompt creates a dangerous capability boundary: the agent may run commands in the host environment, access local state, or be steered into broader command use by later prompt context or tool misuse.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file is entirely written as a Chinese-only task definition and repeatedly specifies required output behavior without any opt-in or alternative language path. Under the policy rule, forcing a specific language or locale without user choice is a natural-language policy violation unless the constraint is explicitly justified as region-specific, which is not stated here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This markdown skill is written entirely in Chinese and defines the agent role, constraints, and output format exclusively in Chinese, which effectively imposes a specific language on the interaction. The file does not offer an opt-in language choice or explain a justified region-specific requirement, matching the language/locale policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This markdown file contains user-facing operational instructions in Chinese only, beginning with the title and role definition. Under the policy, forcing a specific language without giving the user a choice is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The file title and all operative instructions are written in Chinese, and the output is required to be produced in that form with no opt-in or alternative locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The entire role, instructions, and required output format are written in Chinese and the skill does not provide any opt-in, language-selection mechanism, or justification that it is intended only for a Chinese-language context. This creates a natural-language policy issue because it effectively constrains the interaction locale by default.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The file’s natural-language instructions are entirely in Chinese and prescribe the agent’s role, inputs, and output format in that language, with no opt-in or alternative locale. This creates a language/locale policy issue because the skill appears to mandate a specific language regardless of user preference.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file is written as a mandatory Chinese-language prompt and instructs the agent in Chinese without offering any user choice of language or locale. This creates a natural-language policy concern because the skill appears to enforce a specific language by default rather than allowing user opt-in or selection.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This code file contains natural-language content that forces a specific language/locale for usage instructions and warnings. Under the policy, language constraints should either offer user opt-in or be explicitly justified as region-specific, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This Python file contains its primary module docstring and multiple user-facing status messages entirely in Chinese, which imposes a specific language/locale on users. The file does not indicate that Chinese is optional, configurable, or required for a region-specific compliance reason, so it conflicts with the language-choice policy.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python period_str = f"Monthly_{date.strftime('%Y%m')}" else: # 大范围扫描，显示具体日期范围 start_date = date - __import__('datetime').timedelta(days=days) period_str = f"{days}days_{start_date.strftime('%Y%b')}-{date.strftime('%Y%b')}" else: # 从配置读取
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This markdown template is written entirely in Chinese and prescribes section headings, labels, and output structure in Chinese, which effectively enforces a specific language for generated reports. The file does not indicate user opt-in, language selection, or a region-specific justification for this locale restriction.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The template title and all section headings and instructional text are written exclusively in Chinese, which implies the skill produces output in a fixed language. The policy for this audit flags language/locale constraints when they are imposed without user opt-in or a documented, justified regional scope.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The file's natural-language descriptions and user-facing strings are entirely in Chinese, with no indication that another language can be selected. Under the policy, forcing a specific language without user opt-in is a locale/language policy concern.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The code removes files from the .tmp directory during prepare_run, but there is no confirmation prompt or visible disclosure to the user that existing temporary outputs will be deleted. Since file deletion can remove prior intermediate work, this is a safety-relevant operation that should be surfaced clearly.
- Content
Static analysis
No suspicious patterns detected.