ClawHub
Back to skill

Security audit

火山引擎短信（Volcengine SMS）

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Volcengine domestic SMS work, but its sensitive document upload path accepts a server-supplied upload host without an approved-domain allowlist.

Install only if you are comfortable giving the skill access to your Volcengine SMS account, sending SMS or batch tasks after confirmation, and uploading qualification documents for remote processing. Review is warranted until the document upload code restricts upload destinations to approved ImageX/Volcengine domains and prevents unsafe redirects/header forwarding.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/qualification_upload.py:1124
Finding

Unrestricted API-Supplied Hostname Used for Sensitive Document Uploads

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (37)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This code chunk appears to be an unrelated third-party frontend library asset (react-dom.production.min.js). Its purpose is to support rendering of a web UI, which is only a generic implementation detail and does not itself implement the declared SMS-related capabilities. Because the supplied code does not substantiate the declared behavior and instead has a materially different direct purpose, the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

代码的主功能非常明确：它是 qualification_mcp_server，围绕 run_qualification_wizard 构建一个 MCP 应用，提供 4 个工具——打开资质申请、确认表单可见、查询申请结果、取消申请。资源部分也只提供一个“火山引擎短信资质表单”HTML 页面。虽然这与声明中“资质敏感材料只通过本机私密表单处理”这一点是一致的，但声明覆盖的范围远大于代码实际行为。声明把技能描述为一个可发送和管理国内短信的综合能力集合，而代码没有任何发送短信、群发、签名/模板申请、发送记录/回执/分析查询等实现痕迹。故这不是轻微遗漏，而是描述的主要用途明显宽于实际代码，属于实质性不匹配。

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/api_client.py (reported line 85)May include surrounding context.

python
"volcengine-cli_1.1.1_SHA256SUMS"
)
DEFAULT_TIMEOUT = 15.0
DEFAULT_ENV_PATH = "~/.openclaw/.env"
LOGIN_PROCESS_LEASE_SECONDS = 30 * 60
MAX_READ_RETRIES = 2
MAX_CLI_CACHE_BYTES = 256 * 1024

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill requests or implies powerful capabilities (environment access, file read/write, network, and shell) but does not declare an explicit tool scope. That creates an over-privileged execution surface where the agent may invoke sensitive operations beyond what is clearly constrained by policy, increasing the risk of misuse, accidental data exposure, or command execution abuse.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document declares lang="zh-CN" and all visible user-facing status and title text are only in Simplified Chinese. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified or the user is offered a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code file contains extensive user-facing natural-language strings that force a specific language/locale, beginning with the role and step labels in Chinese and continuing throughout the workflow. Under the policy, language constraints should either offer user opt-in/choice or be explicitly documented as justified for a region-specific tool; neither is evident in this file.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · assets/qualification_wizard.jsx (reported line 708)May include surrounding context.

jsx
});
  }, [refresh, updateStatus]);

  const stepList = useMemo(
    () => (state ? requiredSteps(state, purpose) : allStepKeys),
    [state, purpose],
  );

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · assets/qualification_wizard.jsx (reported line 1530)May include surrounding context.

jsx
});
  }, [refresh, updateStatus]);

  const stepList = useMemo(
    () => (state ? requiredSteps(state, purpose) : allStepKeys),
    [state, purpose],
  );

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · assets/qualification_wizard.jsx (reported line 1531)May include surrounding context.

jsx
});
  }, [refresh, updateStatus]);

  const stepList = useMemo(
    () => (state ? requiredSteps(state, purpose) : allStepKeys),
    [state, purpose],
  );

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · assets/qualification_wizard.jsx (reported line 1532)May include surrounding context.

jsx
});
  }, [refresh, updateStatus]);

  const stepList = useMemo(
    () => (state ? requiredSteps(state, purpose) : allStepKeys),
    [state, purpose],
  );

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · assets/qualification_wizard.jsx (reported line 1550)May include surrounding context.

jsx
});
  }, [refresh, updateStatus]);

  const stepList = useMemo(
    () => (state ? requiredSteps(state, purpose) : allStepKeys),
    [state, purpose],
  );

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · assets/qualification_wizard.jsx (reported line 1551)May include surrounding context.

jsx
});
  }, [refresh, updateStatus]);

  const stepList = useMemo(
    () => (state ? requiredSteps(state, purpose) : allStepKeys),
    [state, purpose],
  );

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · assets/qualification_wizard.jsx (reported line 1891)May include surrounding context.

jsx
});
  }, [refresh, updateStatus]);

  const stepList = useMemo(
    () => (state ? requiredSteps(state, purpose) : allStepKeys),
    [state, purpose],
  );

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · assets/qualification_wizard.jsx (reported line 2734)May include surrounding context.

jsx
});
  }, [refresh, updateStatus]);

  const stepList = useMemo(
    () => (state ? requiredSteps(state, purpose) : allStepKeys),
    [state, purpose],
  );

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document requires ApplySmsTemplateV2 to use a fixed area=cn, which imposes a specific locale/region constraint. The file does not offer user opt-in or explain that this skill is strictly limited to a China-specific regulatory or product context, so this reads as a natural-language locale policy constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The entire skill content and the prescribed user-facing sentence are written only in Chinese, including the exact message the agent must deliver to the user. This imposes a specific language/locale without user opt-in, which matches the policy-violation category for language constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The contract explicitly allowlists temporary upload credentials and tokens such as accessKeyId, secretAccessKey, sessionToken, and token in action results. Even if short-lived, exposing cloud upload credentials to broader skill layers or end users materially increases the chance of credential leakage, misuse of storage access, and unintended handling of sensitive qualification documents.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest describes sending SMS, bulk SMS, notifications, marketing messages, qualification onboarding, signatures/templates, logs, receipts, and customer-visible analytics. These lines additionally register SendSmsVerifyCodeByMobile and CheckSmsVerifyCodeByMobile, which implement mobile verification-code issuance and validation as a distinct authentication/identity-check workflow not mentioned in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

DeleteBatchTask is a destructive operation by name and is marked read_only=False, but this file provides no user-facing confirmation, warning comment, or explanatory disclosure about deletion behavior. For safety-critical irreversible actions, some visible disclosure is expected unless documented elsewhere.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code forces the Volcengine CLI language via ---lang EN, which is a natural-language locale policy decision embedded in code. The file also contains user-facing Chinese strings elsewhere, so unconditionally forcing English is not clearly documented as a justified region-specific constraint and does not provide user choice.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/api_client.py (reported line 569)May include surrounding context.

python
env: Mapping[str, str],
    timeout: float,
) -> subprocess.CompletedProcess:
    return subprocess.run(
        list(command),
        env=dict(env),
        stdout=subprocess.PIPE,

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The refresh path explicitly appends ---lang EN, enforcing a specific language for CLI interaction. Under the policy, language forcing is a violation unless the user is given a choice or the restriction is clearly justified and documented.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The identity validation command appends ---lang EN, again forcing one language for command output and interaction. This is a natural-language policy issue because no user choice or explicit justification is provided in the file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code defines all tool titles and descriptions in Chinese, and subsequent user-facing status messages are also returned only in Chinese. That creates a language-policy issue because the skill imposes a specific language on users without any opt-in, fallback, or indication that the skill is intentionally limited to a Chinese-language audience.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code uploads business certificate and identity document images, then sends their resulting URIs for OCR processing via external service calls. While the module has internal comments about credential handling, there is no user-facing prompt, print/log disclosure, or inline warning to inform users that sensitive personal/business documents will be transmitted for remote processing.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
assets/qualification_wizard.js:1