火山引擎短信（Volcengine SMS）

• Outcome: Review
• Latest audit: Sep 4, 2026 · 11:02 AM UTC
• Version: 1.0.2

Overview

This skill is a high-impact but coherent Volcengine SMS assistant that discloses SMS sending, bulk sending, account setup, and qualification-document handling.

Install this only if you intend to let an agent operate your Volcengine SMS account, including sending SMS, creating SMS resources, uploading qualification documents, and preparing bulk recipient files. Review every preview carefully, require the exact confirmation for sends and batch launches, and provide credentials only through the browser login or local environment setup, not in chat.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Ae1

High

• Category: analysis-evasion

Content

1. 首次调用或鉴权失败时读取 [auth-setup.md](references/auth-setup.md)，执行

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

[service-onboarding.md](references/service-onboarding.md)；空列表和资源缺失不代表服务

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- 所有任务先读公共 Action 配置与错误规则：[actions.md](references/actions.md)。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

[application-contracts.md](references/application-contracts.md)。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

[qualification-materials.md](references/qualification-materials.md)；展示方式由其中链接的

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

`qualification-display.md` 决定。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

`qualification-display.md` 决定。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

[delivery-contracts.md](references/delivery-contracts.md)。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- 需要完整编排顺序时读 [workflows.md](references/workflows.md)。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

- 写操作授权、脱敏、重试和对账统一读 [rules.md](references/rules.md)。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

"volcengine-cli_1.1.1_SHA256SUMS"
)
DEFAULT_TIMEOUT = 15.0
DEFAULT_ENV_PATH = "~/.openclaw/.env"
LOGIN_PROCESS_LEASE_SECONDS = 30 * 60
MAX_READ_RETRIES = 2
MAX_CLI_CACHE_BYTES = 256 * 1024

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Session Persistence

Medium

• Category: Rogue Agent

Content

});
  }, [refresh, updateStatus]);

  const stepList = useMemo(
    () => (state ? requiredSteps(state, purpose) : allStepKeys),
    [state, purpose],
  );

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

});
  }, [refresh, updateStatus]);

  const stepList = useMemo(
    () => (state ? requiredSteps(state, purpose) : allStepKeys),
    [state, purpose],
  );

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

});
  }, [refresh, updateStatus]);

  const stepList = useMemo(
    () => (state ? requiredSteps(state, purpose) : allStepKeys),
    [state, purpose],
  );

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

});
  }, [refresh, updateStatus]);

  const stepList = useMemo(
    () => (state ? requiredSteps(state, purpose) : allStepKeys),
    [state, purpose],
  );

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

});
  }, [refresh, updateStatus]);

  const stepList = useMemo(
    () => (state ? requiredSteps(state, purpose) : allStepKeys),
    [state, purpose],
  );

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

});
  }, [refresh, updateStatus]);

  const stepList = useMemo(
    () => (state ? requiredSteps(state, purpose) : allStepKeys),
    [state, purpose],
  );

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

});
  }, [refresh, updateStatus]);

  const stepList = useMemo(
    () => (state ? requiredSteps(state, purpose) : allStepKeys),
    [state, purpose],
  );

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

});
  }, [refresh, updateStatus]);

  const stepList = useMemo(
    () => (state ? requiredSteps(state, purpose) : allStepKeys),
    [state, purpose],
  );

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

env: Mapping[str, str],
    timeout: float,
) -> subprocess.CompletedProcess:
    return subprocess.run(
        list(command),
        env=dict(env),
        stdout=subprocess.PIPE,

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def _run_login_process(argv: Sequence[str], env: Mapping[str, str]) -> None:
    process = subprocess.Popen(argv, env=dict(env))
    interrupted = False
    previous_handlers: Dict[int, Any] = {}

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Scope Creep

Low

• Category: Excessive Agency

Content

copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

value = (
            credentials.get(name)
            if isinstance(credentials, Mapping)
            else getattr(credentials, name, None)
        )
    except Exception as exc:
        raise CredentialResolutionError(

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: assets/qualification_wizard.js:1