ClawHub
Back to skill

Security audit

China Localization

Security checks for vulnerabilities and agentic risk

Overview

The skill does not show theft or destructive behavior, but it asks users to store powerful third-party credentials for integrations that are mostly unimplemented.

Review this skill before installing. Use only the localization and implemented search features unless you are comfortable exposing the listed third-party credentials, and avoid adding Feishu, WeChat, DingTalk, Amap, or Alipay secrets until the corresponding integrations are actually implemented and scoped. Treat Baidu and Feishu outputs as placeholders, not live service data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
_meta.json:13
Finding

Unimplemented Integrations Request and Load Unnecessary Sensitive Credentials

Content
View full analysis

Vulnerability Details

File Location: _meta.json:13-29; supporting credential loading in config.ts:13-48 and setup instructions in SKILL.md:46-65
Vulnerability Type: Violation of least privilege through unnecessary credential collection and loading
Risk Level: Medium

Relevant code from _meta.json:

json
"requiredCredentials": [
  "TAVILY_API_KEY",
  "FEISHU_APP_ID",
  "FEISHU_APP_SECRET",
  "WECHAT_APP_ID",
  "WECHAT_APP_SECRET",
  "DINGTALK_WEBHOOK",
  "AMAP_API_KEY",
  "ALIPAY_APP_ID",
  "ALIPAY_PRIVATE_KEY",
  "ALIPAY_PUBLIC_KEY"
],
"optionalCredentials": [
  "FEISHU_USER_ACCESS_TOKEN",
  "DINGTALK_APP_KEY",
  "DINGTALK_APP_SECRET",
  "ALIPAY_SANDBOX"
],

Supporting code from config.ts:

ts
export const FEISHU_CONFIG = {
  enabled: process.env.FEISHU_ENABLED === 'true',
  appId: process.env.FEISHU_APP_ID || '',
  appSecret: process.env.FEISHU_APP_SECRET || '',
  userAccessToken: process.env.FEISHU_USER_ACCESS_TOKEN || '',
};

export const WECHAT_CONFIG = {
  enabled: process.env.WECHAT_ENABLED === 'true',
  appId: process.env.WECHAT_APP_ID || '',
  appSecret: process.env.WECHAT_APP_SECRET || '',
};

export const DINGTALK_CONFIG = {
  enabled: process.env.DINGTALK_ENABLED === 'true',
  webhook: process.env.DINGTALK_WEBHOOK || '',
  appKey: process.env.DINGTALK_APP_KEY || '',
  appSecret: process.env.DINGTALK_APP_SECRET || '',
};

export const AMAP_CONFIG = {
  enabled: process.env.AMAP_ENABLED === 'true',
  apiKey: process.env.AMAP_API_KEY || '',
};

export const ALIPAY_CONFIG = {
  enabled: process.env.ALIPAY_ENABLED === 'true',
  appId: process.env.ALIPAY_APP_ID || '',
  privateKey: process.env.ALIPAY_PRIVATE_KEY || '',
  alipayPublicKey: process.env.ALIPAY_PUBLIC_KEY || '',
  sandbox: process.env.ALIPAY_SANDBOX === 'true' || true,
};

Technical Analysis

The Skill declares numerous high-value cred ...[truncated 2774 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove all credentials for unimplemented integrations from _meta.json and SKILL.md.
  2. Retain only TAVILY_API_KEY for the currently implemented authenticated operation, and make it optional unless Tavily search is explicitly selected.
  3. Do not load all credentials at module initialization. Read each credential only inside the integration method that requires it.
  4. Separate payment functionality from the general localization package. Do not expose an Alipay private key to a process that only provides localization and search.
  5. Mark integration credentials as optional and conditionally request them only after explicit user activation.
  6. Store secrets in a dedicated secret manager where available rather than a broad process environment.
  7. Validate that enabled integrations have only the minimum service scopes necessary.
  8. Add tests confirming that importing the localization or Baidu search functionality does not access unrelated credentials.
  9. Correct the Alipay sandbox expression because process.env.ALIPAY_SANDBOX === 'true' || true always evaluates to true.

T08 · Insecure Dependencies

Note
Location
package-lock.json:19
Finding

Dependency Lockfile Retrieves Packages from a Third-Party Registry Mirror

Content
View full analysis

Vulnerability Details

File Location: package-lock.json:19-208; installation command in SKILL.md:27-32
Vulnerability Type: Third-party dependency source and supply-chain exposure
Risk Level: Low

Representative locked dependency entries:

json
"node_modules/@cspotcode/source-map-support": {
  "version": "0.8.1",
  "resolved": "https://registry.npmmirror.com/@cspotcode/source-map-support/-/source-map-support-0.8.1.tgz",
  "integrity": "sha512-IchNf6dN4tHoMFIn/7OE8LWZ19Y6q/67Bmf6vnGREv8RSbBVb9LPJxEcnwrcwX6ixSvaiGoomAUvu4YSxXrVgw==",
  "license": "MIT"
}
json
"node_modules/typescript": {
  "version": "5.9.3",
  "resolved": "https://registry.npmmirror.com/typescript/-/typescript-5.9.3.tgz",
  "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
  "license": "Apache-2.0",
  "bin": {
    "tsc": "bin/tsc",
    "tsserver": "bin/tsserver"
  }
}

Installation instructions:

bash
git clone https://github.com/vincentlau2046-sudo/china-localization.git /home/Vincent/.openclaw/workspace/dev-skills/china-localization-v2

cd /home/Vincent/.openclaw/workspace/dev-skills/china-localization-v2
npm install

Technical Analysis

The lockfile resolves all audited npm dependencies through registry.npmmirror.com rather than the official npm registry. This introduces an additional third-party distribution service into the package installation trust chain.

The lockfile includes SHA-512 integrity values, which materially reduces the likelihood that silently modified archives will be accepted by a correctly operating npm client. Therefore, this is not evidence that the existing dependencies are malicious. Nevertheless, availability, governance, certificate trust, mirror synchronization, and artifact provenance depend on an additional service.

The package also declares TypeScript, ts-node, and @types/node as p ...[truncated 1639 chars]

Remediation
View remediation

Remediation Suggestions

  1. Regenerate package-lock.json using the official npm registry at https://registry.npmjs.org/.
  2. Retain and verify SHA-512 integrity hashes for every dependency.
  3. Use npm ci instead of npm install in documented reproducible installation procedures.
  4. Move typescript, ts-node, and @types/node from dependencies to devDependencies.
  5. Publish compiled JavaScript artifacts so production users do not need TypeScript build tooling.
  6. Enforce an approved registry through project-level npm configuration and continuous integration checks.
  7. Add automated dependency provenance, vulnerability, and lockfile-diff review.
  8. Reject unexpected dependency lifecycle scripts unless they have been explicitly reviewed and approved.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

将环境变量添加到 OpenClaw 配置中：

bash
# 编辑 ~/.openclaw/.env 文件
echo "TAVILY_API_KEY=tvly-your-api-key" >> ~/.openclaw/.env
echo "FEISHU_ENABLED=true" >> ~/.openclaw/.env
# ... 添加其他需要的环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

将环境变量添加到 OpenClaw 配置中：

bash
# 编辑 ~/.openclaw/.env 文件
echo "TAVILY_API_KEY=tvly-your-api-key" >> ~/.openclaw/.env
echo "FEISHU_ENABLED=true" >> ~/.openclaw/.env
# ... 添加其他需要的环境变量

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

将环境变量添加到 OpenClaw 配置中：

bash
# 编辑 ~/.openclaw/.env 文件
echo "TAVILY_API_KEY=tvly-your-api-key" >> ~/.openclaw/.env
echo "FEISHU_ENABLED=true" >> ~/.openclaw/.env
# ... 添加其他需要的环境变量

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill markets itself as a fully Chinese interface by default without clearly stating that language selection is optional or user-controlled. This can override user expectations, reduce transparency, and create social-engineering risk if users are funneled into a localization mode they did not explicitly choose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description advertises integrations with Feishu, WeChat, DingTalk, maps, payments, and search services but does not warn that user queries, calendar/task data, location data, or messages may be transmitted to third parties. In a skill context, this lack of privacy disclosure can cause users to unknowingly expose sensitive personal or enterprise data to external platforms.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description states "全中文界面" and frames the skill as enabling use for Chinese users, which implies a mandatory Chinese-only interface. The file does not indicate that users can choose another language or opt in to this locale behavior, making it a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The function is presented as performing a real Baidu search but actually fabricates a mock result using user input. This can mislead downstream agents or users into treating synthetic content as authoritative external data, which is a data integrity and trust-boundary problem rather than direct code execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
71% confidence
Finding

The natural-language comments are written entirely in Chinese and the integration naming is localized, which may indicate a language/locale constraint without any opt-in or justification. The policy requires avoiding forced language or locale behavior unless the skill explicitly offers a choice or documents a justified region-specific scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · config.ts (reported line 10)May include surrounding context.

ts
// Tavily API 配置
export const TAVILY_CONFIG = {
  apiKey: process.env.TAVILY_API_KEY || '',
  apiUrl: 'https://api.tavily.com/search',
};

// 飞书集成配置

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The top-level documentation presents this as a China localization pack with local service integration and security/compliance characteristics. In the code, Feishu calendar/tasks are not integrated at all and return sample data, while weather retrieval and search depend on external search services such as Baidu/Tavily instead of any demonstrated local integrations. This is an intent-level mismatch between the comments and the implemented behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The code initializes the active language to 'zh-CN' by default, which forces a specific language/locale before the user has chosen one. This matches the policy category for locale/language constraints without explicit opt-in, even though a setter exists later.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The package name "china-localization" indicates a locale-specific behavior tied to China, but this manifest file provides no accompanying natural-language indication that users can opt into that locale or that the restriction is justified. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The description states "全中文界面" (fully Chinese interface), which indicates a fixed language choice rather than an optional localization setting. Under the policy, language constraints should offer user choice or clearly document a justified locale-specific limitation, neither of which is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The file’s comments, log messages, test inputs, and the referenced ChinaLocalization functionality consistently assume Chinese language and locale behavior. There is no indication in this file that users can choose another language or explicitly opt into a China-specific localization mode, which can violate language/locale policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The comment states the module is "optimized for Chinese users," which imposes a locale-specific scope in natural language without indicating user choice or opt-in. Under the policy, locale constraints should either be optional for the user or clearly justified as region-specific compliance tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code accesses multiple sensitive environment variables, including API keys, secrets, access tokens, and private keys, but provides no user-facing warning, confirmation, or runtime disclosure about handling credential material. Under the code-file criteria, sensitive environment variable access should be accompanied by some visible explanation unless covered elsewhere, which is not evident in this file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file-level comments emphasize environment-variable-driven configuration, and ALIPAY_CONFIG appears to follow that pattern. However, process.env.ALIPAY_SANDBOX === 'true' || true always evaluates to true, so the environment variable cannot disable sandbox mode, contradicting the documented intent of externally controlled configuration.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

Using caret ranges for dependencies allows newer package versions to be installed automatically within the same major version, which can introduce unexpected behavior, supply-chain risk, or break builds if an upstream release is compromised or unstable. While this package.json does not itself show malicious code, permissive version ranges reduce build reproducibility and increase exposure to dependency drift.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json
"license": "MIT",
  "type": "commonjs",
  "dependencies": {
    "@types/node": "^25.4.0",
    "ts-node": "^10.9.2",
    "typescript": "^5.9.3"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The ts-node dependency is specified with a caret version, permitting automatic installation of later compatible releases. This weakens reproducibility and can expose consumers to upstream supply-chain issues or unexpected runtime changes if a published dependency version is malicious or faulty.

Content

Scanner excerpt · package.json (reported line 15)May include surrounding context.

json
"type": "commonjs",
  "dependencies": {
    "@types/node": "^25.4.0",
    "ts-node": "^10.9.2",
    "typescript": "^5.9.3"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
91% confidence
Finding

The typescript dependency is also unpinned, which allows dependency drift over time and can pull in changed transitive content without explicit review. In security-sensitive environments, this increases supply-chain uncertainty even when the dependency is widely used and commonly trusted.

Content

Scanner excerpt · package.json (reported line 16)May include surrounding context.

json
"dependencies": {
    "@types/node": "^25.4.0",
    "ts-node": "^10.9.2",
    "typescript": "^5.9.3"
  }
}

Static analysis

No suspicious patterns detected.