中文工具包

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:30 PM UTC
• Version: 1.0.1

Overview

The skill advertises Chinese text tools, but its package includes an installer that can download and run unreviewed code plus unrelated mailbox, forum, and release-automation material.

Install only after reviewing the installer and removing or isolating the out-of-scope release, inbox, forum, and documentation-validator materials. Do not run install.sh unless it is changed to use only reviewed, pinned package contents, and do not provide mailbox credentials or execute the bundled publishing/reset commands as part of normal use.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: install.sh:145

Finding

Installer Retrieves and Executes Mutable Code from an Undeclared Repository

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/doc-search.md:317

Finding

Documentation Validator Executes Arbitrary Python Example Files

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/inbox.md:474

Finding

Unrelated Email Integration Requests Full Mailbox Credentials and Message Content

Content

View full analysis

List[Dict]: """获取未读邮件""" if not self.mail: self.connect() # 搜索未读邮件 status, messages = self.mail.search(None, 'UNSEEN') email_ids = messages[0].split() emails = [] for email_id in email_ids: email_data = self._fetch_email(email_id) if email_data: emails.append(email_data) return emails def _fetch_email(self, email_id: bytes) -> Dict: """获取单个邮件""" status, msg_data = self.mail.fetch(email_id, '(RFC822)') if status != 'OK': return None # 解析邮件 msg = email.message_from_bytes(msg_data[0][1]) # 解码主题 subject, encoding = decode_header(msg["Subject"])[0] if isinstance(subject, bytes): subject = subject.decode(encoding if encoding else 'utf-8') # 获取发件人 from_ = msg.get("From") # 获取邮件正文 body = self._extract_body(msg) # 获取附件 attachments = self._extract_attachments(msg) return { ...[truncated 2834 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (256)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · COMPLETE_RELEASE_GUIDE.md (reported line 79)May include surrounding context.

A3. 推送到GitHub

powershell

# 1. 推送代码
git push github master

# 2. 推送标签
git push github "v$version"

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The embedded complete_release.ps1 automates version changes, commits, tags, remote pushes, login, and marketplace publication, none of which match the stated language-processing function. Bundling maintainer release automation inside a user-facing skill materially increases risk because it can induce users or agents to perform privileged source-control and publication actions unrelated to expected functionality.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The release script invokes remote publication tooling and repository operations unrelated to Chinese NLP functionality. In context, this makes the skill more dangerous because the commands affect external accounts and repositories, so misuse or social engineering can turn a benign-seeming toolkit into a vehicle for privileged deployment actions.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

git reset --hard HEAD is a destructive command presented as a quick troubleshooting step without safeguards, making it dangerous in practice even if not classic injection. In the context of an agent skill, instructing users to run hard-reset operations can cause immediate local data loss and may be blindly executed by automation or hurried operators.

Content

Scanner excerpt · COMPLETE_RELEASE_GUIDE.md (reported line 356)May include surrounding context.

手动GitHub发布

powershell

# 1. 重置状态
git reset --hard HEAD
git clean -fd

# 2. 重新提交

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · FINAL_RELEASE_GUIDE.md (reported line 206)May include surrounding context.

powershell

# 问题: 推送被拒绝
# 解决方案:
git pull origin main --allow-unrelated-histories
git push -u origin main

# 问题: 认证失败

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · GITHUB_RELEASE_GUIDE.md (reported line 296)May include surrounding context.

ssh-keygen -t ed25519 -C "[e-mail]"

添加SSH密钥到GitHub

1. 复制公钥: cat ~/.ssh/id_ed25519.pub

2. 添加到GitHub: https://github.com/settings/keys

text

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · README.md (reported line 69)May include surrounding context.

过ClawHub安装 (推荐)

bash

npx clawhub install chinese-toolkit

手动安装

bash

# 克隆仓库
git clone https://github.com/openclaw-cn/chinese-toolkit.git
cd chinese-toolkit

# 安装依赖
pip install -r requirements.txt

Python包安装

bash

pip install openclaw-chinese-toolkit

基本使用

Python API

python

from chinese_tools_core import ChineseToolkit

# 初始化工具包
toolkit = ChineseToolkit()

# 中文分词
segments = toolkit.segment("今天天气真好")
print(segments)  # ['今天天气', '真', '好']

# 拼音转换
pinyin = toolkit.to_pinyin("中文", style='tone')
print(pinyin)  # zhōng wén

# 文本翻译
translated = toolkit.translate("你好", 'zh', 'en')
print(translated)  # Hello

命令行使用

bash

# 中文分词
python chinese_tools_core.py segment "今天天气真好"

# 拼音转换
python chinese_tools_core.py pinyin "中文" --style tone

# 文本翻译
python chinese_tools_core.py translat

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

A language-processing skill that actually initializes git, stages files, commits, or guides repository publishing represents a severe description mismatch. Repository operations can alter user workspaces and exfiltration risk increases if users are persuaded to push content externally under the guise of a text toolkit.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A language-processing skill that actually initializes git, stages files, commits, or guides repository publishing represents a severe description mismatch. Repository operations can alter user workspaces and exfiltration risk increases if users are persuaded to push content externally under the guise of a text toolkit.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A language-processing skill that actually initializes git, stages files, commits, or guides repository publishing represents a severe description mismatch. Repository operations can alter user workspaces and exfiltration risk increases if users are persuaded to push content externally under the guise of a text toolkit.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

A language-processing skill that actually initializes git, stages files, commits, or guides repository publishing represents a severe description mismatch. Repository operations can alter user workspaces and exfiltration risk increases if users are persuaded to push content externally under the guise of a text toolkit.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

A language-processing skill that actually initializes git, stages files, commits, or guides repository publishing represents a severe description mismatch. Repository operations can alter user workspaces and exfiltration risk increases if users are persuaded to push content externally under the guise of a text toolkit.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A language-processing skill that actually initializes git, stages files, commits, or guides repository publishing represents a severe description mismatch. Repository operations can alter user workspaces and exfiltration risk increases if users are persuaded to push content externally under the guise of a text toolkit.

Content

No source excerpt is available for this finding.

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · MARKET_PAGE_TEMPLATE.md (reported line 155)May include surrounding context.

md

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
OpenClaw中文工具包基础使用示例
"""

import sys
import os

# 添加父目录到路径
sys.path.append(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

from chinese_tools import ChineseToolkit

def main():
    """主函数"""
    print("🎯 OpenClaw中文工具包基础使用示例")
    print("=" * 50)
    
    # 初始化工具包
    print("🔧 初始化中文工具包...")
    toolkit = ChineseToolkit()
    
    # 示例文本
    sample_text = "今天天气真好，我们一起去公园散步吧。人工智能正在改变世界。"
    
    print(f"\n📝 示例文本: {sample_text}")
    print("=" * 50)
    
    # 1. 中文分词
    print("\n1. 📖 中文分词:")
    segments = toolkit.segment(sample_text)
    print(f"   分词结果: {' | '.join(segments)}")

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL_MARKET_PAGE.md (reported line 71)May include surrounding context.

md

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
OpenClaw中文工具包基础使用示例
"""

import sys
import os

# 添加父目录到路径
sys.path.append(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

from chinese_tools import ChineseToolkit

def main():
    """主函数"""
    print("🎯 OpenClaw中文工具包基础使用示例")
    print("=" * 50)
    
    # 初始化工具包
    print("🔧 初始化中文工具包...")
    toolkit = ChineseToolkit()
    
    # 示例文本
    sample_text = "今天天气真好，我们一起去公园散步吧。人工智能正在改变世界。"
    
    print(f"\n📝 示例文本: {sample_text}")
    print("=" * 50)
    
    # 1. 中文分词
    print("\n1. 📖 中文分词:")
    segments = toolkit.segment(sample_text)
    print(f"   分词结果: {' | '.join(segments)}")

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · check_release_ascii.py (reported line 172)May include surrounding context.

python

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
OpenClaw中文工具包基础使用示例
"""

import sys
import os

# 添加父目录到路径
sys.path.append(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

from chinese_tools import ChineseToolkit

def main():
    """主函数"""
    print("🎯 OpenClaw中文工具包基础使用示例")
    print("=" * 50)
    
    # 初始化工具包
    print("🔧 初始化中文工具包...")
    toolkit = ChineseToolkit()
    
    # 示例文本
    sample_text = "今天天气真好，我们一起去公园散步吧。人工智能正在改变世界。"
    
    print(f"\n📝 示例文本: {sample_text}")
    print("=" * 50)
    
    # 1. 中文分词
    print("\n1. 📖 中文分词:")
    segments = toolkit.segment(sample_text)
    print(f"   分词结果: {' | '.join(segments)}")

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · check_release_status.py (reported line 220)May include surrounding context.

python

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
OpenClaw中文工具包基础使用示例
"""

import sys
import os

# 添加父目录到路径
sys.path.append(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

from chinese_tools import ChineseToolkit

def main():
    """主函数"""
    print("🎯 OpenClaw中文工具包基础使用示例")
    print("=" * 50)
    
    # 初始化工具包
    print("🔧 初始化中文工具包...")
    toolkit = ChineseToolkit()
    
    # 示例文本
    sample_text = "今天天气真好，我们一起去公园散步吧。人工智能正在改变世界。"
    
    print(f"\n📝 示例文本: {sample_text}")
    print("=" * 50)
    
    # 1. 中文分词
    print("\n1. 📖 中文分词:")
    segments = toolkit.segment(sample_text)
    print(f"   分词结果: {' | '.join(segments)}")

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · chinese_tools_core.py (reported line 22)May include surrounding context.

python

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
OpenClaw中文工具包基础使用示例
"""

import sys
import os

# 添加父目录到路径
sys.path.append(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

from chinese_tools import ChineseToolkit

def main():
    """主函数"""
    print("🎯 OpenClaw中文工具包基础使用示例")
    print("=" * 50)
    
    # 初始化工具包
    print("🔧 初始化中文工具包...")
    toolkit = ChineseToolkit()
    
    # 示例文本
    sample_text = "今天天气真好，我们一起去公园散步吧。人工智能正在改变世界。"
    
    print(f"\n📝 示例文本: {sample_text}")
    print("=" * 50)
    
    # 1. 中文分词
    print("\n1. 📖 中文分词:")
    segments = toolkit.segment(sample_text)
    print(f"   分词结果: {' | '.join(segments)}")

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · chinese_tools_fixed.py (reported line 17)May include surrounding context.

python

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
OpenClaw中文工具包基础使用示例
"""

import sys
import os

# 添加父目录到路径
sys.path.append(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

from chinese_tools import ChineseToolkit

def main():
    """主函数"""
    print("🎯 OpenClaw中文工具包基础使用示例")
    print("=" * 50)
    
    # 初始化工具包
    print("🔧 初始化中文工具包...")
    toolkit = ChineseToolkit()
    
    # 示例文本
    sample_text = "今天天气真好，我们一起去公园散步吧。人工智能正在改变世界。"
    
    print(f"\n📝 示例文本: {sample_text}")
    print("=" * 50)
    
    # 1. 中文分词
    print("\n1. 📖 中文分词:")
    segments = toolkit.segment(sample_text)
    print(f"   分词结果: {' | '.join(segments)}")

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · examples/basic_usage.py (reported line 13)May include surrounding context.

python

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
OpenClaw中文工具包基础使用示例
"""

import sys
import os

# 添加父目录到路径
sys.path.append(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

from chinese_tools import ChineseToolkit

def main():
    """主函数"""
    print("🎯 OpenClaw中文工具包基础使用示例")
    print("=" * 50)
    
    # 初始化工具包
    print("🔧 初始化中文工具包...")
    toolkit = ChineseToolkit()
    
    # 示例文本
    sample_text = "今天天气真好，我们一起去公园散步吧。人工智能正在改变世界。"
    
    print(f"\n📝 示例文本: {sample_text}")
    print("=" * 50)
    
    # 1. 中文分词
    print("\n1. 📖 中文分词:")
    segments = toolkit.segment(sample_text)
    print(f"   分词结果: {' | '.join(segments)}")

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · openclaw_integration.py (reported line 17)May include surrounding context.

python

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
OpenClaw中文工具包基础使用示例
"""

import sys
import os

# 添加父目录到路径
sys.path.append(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

from chinese_tools import ChineseToolkit

def main():
    """主函数"""
    print("🎯 OpenClaw中文工具包基础使用示例")
    print("=" * 50)
    
    # 初始化工具包
    print("🔧 初始化中文工具包...")
    toolkit = ChineseToolkit()
    
    # 示例文本
    sample_text = "今天天气真好，我们一起去公园散步吧。人工智能正在改变世界。"
    
    print(f"\n📝 示例文本: {sample_text}")
    print("=" * 50)
    
    # 1. 中文分词
    print("\n1. 📖 中文分词:")
    segments = toolkit.segment(sample_text)
    print(f"   分词结果: {' | '.join(segments)}")

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · quick_test.py (reported line 14)May include surrounding context.

python

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
OpenClaw中文工具包基础使用示例
"""

import sys
import os

# 添加父目录到路径
sys.path.append(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))

from chinese_tools import ChineseToolkit

def main():
    """主函数"""
    print("🎯 OpenClaw中文工具包基础使用示例")
    print("=" * 50)
    
    # 初始化工具包
    print("🔧 初始化中文工具包...")
    toolkit = ChineseToolkit()
    
    # 示例文本
    sample_text = "今天天气真好，我们一起去公园散步吧。人工智能正在改变世界。"
    
    print(f"\n📝 示例文本: {sample_text}")
    print("=" * 50)
    
    # 1. 中文分词
    print("\n1. 📖 中文分词:")
    segments = toolkit.segment(sample_text)
    print(f"   分词结果: {' | '.join(segments)}")

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file contains extensive community management, Discord bot, ticketing, knowledge base, and analytics functionality that is materially unrelated to the declared purpose of a Chinese text-processing toolkit. This kind of capability mismatch is dangerous because it expands the skill's operational scope into user interaction, moderation, data collection, and external service integration that reviewers and users would not reasonably expect, increasing the risk of hidden data handling and privilege abuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Discord bot introduces messaging automation, member access, moderator actions, and support-ticket handling that do not fit the stated text-processing purpose. In this context, the mismatch is security-relevant because it could obtain bot credentials, access community data, and perform actions in external systems under the guise of an unrelated toolkit.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The local SQLite ticketing, knowledge base, feedback, and analytics systems significantly broaden the skill into persistent storage and user-tracking functionality outside its declared domain. That scope expansion is risky because it enables collection and retention of potentially sensitive user data without users expecting such behavior from a language-processing tool.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.