Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent Feishu task-management helper, but it can read work history and write persistent task records from broad or automated triggers, so users should review its scope carefully.
Install only if you expect this agent to access Feishu task data, possible team/subordinate task context, and Cotrace work-history summaries. Use it carefully around vague work updates, because it may treat them as requests to create persistent task records; prefer explicit wording and require confirmation before enabling automated cron/agent recording.
The trigger list includes very broad everyday phrases such as '完成了', '做了', '帮我记', 'record', and 'progress', which can match many ordinary conversations unrelated to task management. This increases the chance of unintended skill activation, causing the agent to access task context or prepare records when the user did not explicitly intend to use this skill.
The activation section allows the skill to trigger on ambiguous descriptions of completed work, mapping generic status updates directly into the task-record flow. In context, this can cause accidental persistence of sensitive work details into the external task system or retrieval of task context without sufficiently clear user intent.
The skill explicitly references another internal skill path, skills/cotrace/SKILL.md, revealing the existence and naming of an internal capability. While not a direct exploit by itself, this aids skill enumeration and can help an attacker map available integrations and target follow-on prompt injection or misuse of the referenced data source.
## **数据源：Cotrace**
当用户说"帮我记录"但未提供具体内容时，**优先使用 Cotrace 获取工作数据**。
详见 `skills/cotrace/SKILL.md`。
The entire skill description and operational guidance are written only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation.
This markdown file presents all user-facing instructions and examples exclusively in Chinese, which effectively forces a specific language for users. The policy allows locale constraints only when opt-in is offered or the regional limitation is clearly documented and justified, neither of which appears here.
The trigger examples in this skill are broad enough to overlap with normal conversational phrases about work progress or generic requests to 'build a task', which can cause the agent to invoke task-creation logic when the user did not clearly intend to create a new structured task. In this context, mistaken invocation is risky because the workflow can create persistent task objects in Feishu, potentially causing duplicate tasks, incorrect project structure, or unwanted state changes in a work-management system.
The trigger phrases include very common expressions such as '记录', '进展', '完成了', and '帮我记', which can match ordinary conversation and cause unintended activation of the skill. In this skill, accidental activation is meaningful because it can lead to task-tree writes and automated handling of user work summaries, creating integrity and privacy risks rather than being merely cosmetic.
Mode B can be activated by vague inputs like '帮我记一下最近做的' or even '用一下记录技能', plus cron or agent automation, without a sharply defined user-consent boundary. Because Mode B then prioritizes pulling work data from Cotrace, ambiguous activation increases the chance of collecting and drafting sensitive work history when the user did not clearly request that behavior.
The skill instructs the agent to automatically query Cotrace for work summaries and details as the preferred path, but it does not require a clear privacy notice or explicit consent at the moment of retrieval. Since Cotrace appears to expose potentially sensitive activity history, automatic collection and summarization can disclose private work context to the model and to downstream task records beyond the user's immediate expectation.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
在模式 B 中，优先使用 Cotrace 的 work-records 获取实际工作数据，参考 skills/cotrace/SKILL.md：
# 检查 Cotrace 是否可用
The file is written as an instruction set that presents the reporting behavior only in Chinese and does not indicate that language should follow user preference. This can violate language or locale policy when the skill is used with users who have not opted into Chinese output.
The trigger list includes very broad everyday phrases such as '今天做的', '帮我记', 'record', and 'progress', which can cause the skill to activate on general conversation unrelated to task reporting. In a multi-skill agent, this increases the chance of unintended invocation, misrouting user intent, and accidental exposure or summarization of task context when the user did not explicitly ask for this skill.
This markdown file documents behavior that accesses $OPENCLAW_DISPLAY_NAME and runs identity commands to determine the user's role and team context. Because the file is a markdown reference and contains no warning about use of personal/organizational identity data, it lacks user-facing disclosure for privacy-relevant behavior.
No suspicious patterns detected.