ClawHub
Back to skill

Security audit

Zhiqiu

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Chinese industry-analysis workflow with an optional external report-fetching dependency, and I did not find hidden execution, persistence, or purpose-mismatched behavior.

Before installing the optional financial-report-fetcher dependency, review its publisher and version because this skill references it without a pinned immutable version. If you only need quick analysis, the skill can skip that dependency and rely on ordinary current-data search.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:20
Finding

Unpinned Third-Party Skill Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–22
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml
external_skills:
  - name: financial-report-fetcher
    slug: "@tuobadaidai/financial-report-fetcher"
    install: "openclaw skills install @tuobadaidai/financial-report-fetcher"

The same unpinned installation instruction is repeated at lines 137–139 and line 540:

bash
openclaw skills install @tuobadaidai/financial-report-fetcher

Technical Analysis

The Skill instructs users or agents to install @tuobadaidai/financial-report-fetcher without specifying an immutable version, commit, checksum, or cryptographic signature. Consequently, the installed implementation may differ from the dependency that was originally reviewed or intended.

The dependency is expected to retrieve and process external financial reports. Its implementation is not included in this project, so its integrity and runtime behavior could not be verified during this audit. If the package owner, distribution account, registry, or a future mutable release is compromised, malicious behavior could be introduced through the dependency supply chain.

This finding does not establish that the named dependency is currently malicious. The risk arises from trusting and installing mutable, unaudited third-party code.

Attack Path

  1. An attacker compromises the dependency publisher, package account, or relevant distribution channel.
  2. The attacker publishes a modified release under the existing dependency identifier.
  3. A user invokes the documented industry-research workflow while the dependency is unavailable locally.
  4. The documentation prompts installation using: openclaw skills install @tuobadaidai/financial-report-fetcher.
  5. Because no version or digest is pinned, the package manager resolves the attacker-controlled release.
  6. The dependency executes within the permissions available to the host age ...[truncated 837 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to a reviewed, immutable version rather than resolving the latest mutable release.
  2. Prefer an immutable content digest or audited commit identifier where the Skill ecosystem supports it.
  3. Verify package signatures or checksums before installation and fail closed on verification errors.
  4. Document the authoritative registry and publisher identity to reduce dependency-confusion and impersonation risks.
  5. Require explicit user approval before installing or updating any third-party Skill.
  6. Audit the dependency and its transitive dependencies before deployment.
  7. Run the dependency with least privilege, restricting filesystem access, credentials, outbound networking, and available tools to those needed for report retrieval.
  8. Maintain a trusted-version allowlist and prevent automatic upgrades until new releases have been reviewed.
  9. Vendor the audited dependency into a controlled repository when licensing and maintenance constraints permit.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

L005 在描述中明确写明“纯行业分析系统”，并整体以中文定义触发词、命令和输出要求，但未说明是否支持用户选择其他语言或按用户语言回复。对语言/locale 没有提供 opt-in 或选择机制，构成自然语言层面的语言策略约束风险。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill declares very broad natural-language triggers such as '行业分析、行业研究、市场规模、行业趋势', which overlap heavily with common user requests and can cause the skill to activate unexpectedly. In a multi-skill agent environment, this increases the chance of prompt-routing mistakes, unintended tool use, and the skill taking over requests better handled by simpler or safer flows.

Content

No source excerpt is available for this finding.