ClawHub
Back to skill

Security audit

YiDunAppDefense

Security checks for vulnerabilities and agentic risk

Overview

The skill fits its YiDun app-protection purpose, but it downloads and runs unverified remote Java tooling and handles sensitive AppKey/signing configuration with avoidable exposure risks.

Review this skill before installing. Use it only if you are comfortable sending application packages and related metadata to YiDun, and run it in a constrained environment because it downloads and executes vendor Java code that is not pinned or signature-verified. Prefer interactive hidden AppKey entry, protect ~/.yidun-defense/config.ini, avoid storing signing passwords unless necessary, and rotate any AppKey that may have appeared in shell history or CI logs.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/setup.sh:103
Finding

Unverified Remote JAR Download and Execution

Content
View full analysis

Vulnerability Details

File Location: scripts/setup.sh:103-126, scripts/setup.sh:202-225, and scripts/defense-smart.sh:317
Vulnerability Type: Unverified remote payload retrieval and execution
Risk Level: High

bash
if command -v curl &> /dev/null; then
    log_info "Using curl to download..."
    if curl -L -o "$TOOL_ZIP" "$TOOL_URL"; then
        log_success "Tool downloaded successfully!"
        return 0
    else
        log_error "Download with curl failed"
        rm -f "$TOOL_ZIP"
    fi
fi

if command -v wget &> /dev/null; then
    log_info "Using wget to download..."
    if wget -O "$TOOL_ZIP" "$TOOL_URL"; then
        log_success "Tool downloaded successfully!"
        return 0
    else
        log_error "Download with wget failed"
        rm -f "$TOOL_ZIP"
    fi
fi

The downloaded JAR is validated only by size and archive format:

bash
file_size=$(stat -f%z "$TOOL_JAR" 2>/dev/null || stat -c%s "$TOOL_JAR" 2>/dev/null)
if [ "$file_size" -lt 102400 ]; then
    log_error "Tool file size is abnormal and may be incomplete"
    log_info "File size: $file_size bytes"
    exit 1
fi

if ! file "$TOOL_JAR" | grep -q "Java archive\|Zip archive"; then
    log_error "Invalid tool format; the file is not a valid JAR"
    exit 1
fi

It is subsequently executed:

bash
if java -jar "$TOOL_JAR" "${params_array[@]}" -input "$file" -output "$output_file" 2>&1 | tee "$LOG_FILE"; then

Technical Analysis

The setup process retrieves a mutable executable archive from an external endpoint and follows HTTP redirects through curl -L. It does not verify a pinned cryptographic digest, package signature, signing certificate, or trusted release manifest.

A size threshold and archive-format check establish only that the file resembles a JAR or ZIP. They provide no assurance that the payload was published by the expecte ...[truncated 1607 chars]

Remediation
View remediation

Remediation Suggestions

  1. Publish a SHA-256 or stronger digest through a separately authenticated release channel and verify it before extraction.
  2. Prefer a digitally signed release manifest or signed JAR, and validate the signature against a pinned vendor public key.
  3. Pin a specific tool version rather than downloading a mutable latest release.
  4. Restrict redirects to an explicit allowlist, or reject cross-origin redirects entirely.
  5. Download into a private temporary directory created with mktemp -d and restrictive permissions.
  6. Abort and delete the archive and extracted files on any integrity-verification failure.
  7. Verify every executable component extracted from the archive, not only the primary JAR.
  8. Run the third-party tool in a sandbox or isolated container with minimal filesystem access, no unnecessary credentials, and restricted network access.
  9. Do not describe file size and format checks as integrity verification; they should only be supplemental validation.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/configure.sh:65
Finding

Credential Configuration Permissions Are Not Preserved During Updates

Content
View full analysis

Vulnerability Details

File Location: scripts/configure.sh:65-72
Vulnerability Type: Insecure temporary file and sensitive-file permission handling
Risk Level: Medium

bash
awk -v key="$appkey" '
    /^\[appkey\]/ { in_section=1 }
    /^\[/ && !/^\[appkey\]/ { in_section=0 }
    in_section && /^key=/ { print "key=" key; next }
    { print }
' "$CONFIG_FILE" > "$CONFIG_FILE.tmp" && mv "$CONFIG_FILE.tmp" "$CONFIG_FILE"

Technical Analysis

Initial setup applies mode 600 to config.ini, but the update operation does not preserve that mode. Shell redirection creates config.ini.tmp according to the process umask. Under a common umask of 022, the temporary file is created with mode 644.

The subsequent mv does not copy the original configuration's restrictive permissions. It replaces the original file with the newly created temporary file and therefore retains the temporary file's potentially permissive mode.

The configuration may contain not only the AppKey but also Android and Harmony signing passwords and key material paths. Updating the AppKey can consequently weaken protection for every secret in the file.

The predictable temporary filename also permits denial-of-service or file-manipulation attempts by another process operating with sufficient access to the directory, although normal protection of the home directory may limit that secondary risk.

Attack Path

  1. The user has an existing ~/.yidun-defense/config.ini protected with mode 600.
  2. The user runs scripts/configure.sh to update the AppKey.
  3. The shell creates config.ini.tmp using the current umask, potentially with mode 644.
  4. mv replaces the protected configuration with the permissive temporary file.
  5. Another local account or process reads the AppKey and any signing passwords if directory traversal permissions permit access.

Impact Assessment

Exploitation can disc ...[truncated 382 chars]

Remediation
View remediation

Remediation Suggestions

  1. Set a restrictive umask before creating any sensitive file:
    bash
    umask 077
  2. Create the replacement file securely with mktemp inside ~/.yidun-defense.
  3. Explicitly apply mode 600 before moving the replacement into place.
  4. Preserve and validate the original file owner and group.
  5. Apply chmod 700 to ~/.yidun-defense so other users cannot traverse or inspect the directory.
  6. Install cleanup traps so temporary files are removed on interruption or failure.
  7. After replacement, verify that the resulting configuration is a regular file owned by the current user and has no group or world permissions.
  8. Consider storing signing passwords in an operating-system keychain or dedicated secrets manager rather than a plaintext INI file.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/configure.sh:118
Finding

AppKey Accepted and Documented as a Command-Line Argument

Content
View full analysis

Vulnerability Details

File Location: scripts/configure.sh:118-130 and INSTALL.md:142-145
Vulnerability Type: Secret exposure through command-line arguments
Risk Level: Medium

bash
cli_configure() {
    local appkey="$1"

    if [ -z "$appkey" ]; then
        log_error "Please provide an AppKey"
        echo "Usage: $0 <appkey>"
        exit 1
    fi

    set_appkey "$appkey"
}

The installation documentation explicitly recommends this usage:

bash
./scripts/configure.sh your_appkey_here

Technical Analysis

Passing credentials as positional command-line arguments can expose them through shell history, process listings, terminal recording, command auditing, CI job output, debugging traces, and wrapper scripts.

Although some operating systems restrict access to other users' process arguments, the command remains likely to be stored in the invoking user's shell history. CI systems may also echo the full command unless secret masking happens to recognize the value.

The script already supports hidden interactive input, so the command-line secret mode is unnecessary and creates avoidable exposure.

Attack Path

  1. A user follows the documented non-interactive example and runs the configuration script with the actual AppKey as an argument.
  2. The shell records the complete command in its history, or a CI runner logs the executed command.
  3. A local attacker, support operator, log reader, compromised process, or later recipient of archived CI logs accesses that record.
  4. The attacker extracts and reuses the AppKey.

Impact Assessment

Exposure allows unauthorized use of the affected YiDun AppKey within the permissions and quota assigned to that key. Potential consequences include service abuse, quota consumption, unauthorized application-protection requests, and access to account-associated workflows supported by the external service.

This issue alone does ...[truncated 95 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove support for passing the AppKey as a positional command-line argument.
  2. Retain hidden interactive input with read -s for manual use.
  3. For automation, read the secret from a protected file descriptor, standard input without command echoing, an operating-system keychain, or a CI secrets provider.
  4. Avoid putting the secret directly into an environment variable where same-user processes or diagnostic dumps may expose it.
  5. Update all installation, API, guide, README, and CI examples so they never embed the AppKey in a command.
  6. Warn existing users to remove exposed commands from shell histories and CI logs and rotate any AppKey that may already have been recorded.
  7. Ensure scripts do not enable shell tracing while handling secrets.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (46)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 289)May include surrounding context.

bash
# 删除 Skill 目录
rm -rf ~/.openclaw/skills/yidun-app-defense

# 删除工作目录（可选）
rm -rf ~/.yidun-defense

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 292)May include surrounding context.

bash
# 删除 Skill 目录
rm -rf ~/.openclaw/skills/yidun-app-defense

# 删除工作目录（可选）
rm -rf ~/.yidun-defense

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 289)May include surrounding context.

bash
# 删除 Skill 目录
rm -rf ~/.openclaw/skills/yidun-app-defense

# 删除工作目录（可选）
rm -rf ~/.yidun-defense

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 292)May include surrounding context.

rm -rf ~/.openclaw/skills/yidun-app-defense

删除工作目录（可选）

rm -rf ~/.yidun-defense

text

---

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/setup.sh (reported line 103)May include surrounding context.

sh
if [ "$FORCE_REINSTALL" = true ]; then
        log_info "强制重新安装，删除旧文件..."
        rm -f "$TOOL_JAR"
        rm -rf "$YIDUN_DIR/YiDunPackTool2-"*
        rm -rf "$YIDUN_DIR/tool"
        rm -rf "$YIDUN_DIR/ProtectBin"
    fi

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/setup.sh (reported line 104)May include surrounding context.

sh
log_info "强制重新安装，删除旧文件..."
        rm -f "$TOOL_JAR"
        rm -rf "$YIDUN_DIR/YiDunPackTool2-"*
        rm -rf "$YIDUN_DIR/tool"
        rm -rf "$YIDUN_DIR/ProtectBin"
    fi

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/setup.sh (reported line 105)May include surrounding context.

sh
rm -f "$TOOL_JAR"
        rm -rf "$YIDUN_DIR/YiDunPackTool2-"*
        rm -rf "$YIDUN_DIR/tool"
        rm -rf "$YIDUN_DIR/ProtectBin"
    fi

    # 尝试使用 curl 下载

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALL.md (reported line 53)May include surrounding context.

  1. 解压到目标目录
    bash
    mkdir -p ~/.openclaw/skills/
tar -xzf yidun-app-defense-1.0.1.tar.gz -C ~/.openclaw/skills/
cd ~/.openclaw/skills/yidun-app-defense

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The installation guide explicitly recommends passing the AppKey as a positional command-line argument. Secrets supplied this way are commonly exposed through shell history, process listings, audit logs, and terminal scrollback, which can leak credentials to other local users or monitoring tools.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 197)May include surrounding context.

Ubuntu / Debian

bash
sudo apt update
sudo apt install openjdk-11-jre

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 198)May include surrounding context.

Ubuntu / Debian

bash
sudo apt update
sudo apt install openjdk-11-jre

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 204)May include surrounding context.

Ubuntu / Debian

bash
sudo apt update
sudo apt install openjdk-11-jre

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 377)May include surrounding context.

Ubuntu / Debian

bash
sudo apt update
sudo apt install openjdk-11-jre

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · INSTALL.md (reported line 264)May include surrounding context.

chmod +x scripts/*.sh

确保工作目录可写

chmod 755 ~/.yidun-defense

text

### 问题 4: AppKey 配置失败

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

对于 markdown 文件，若描述会影响用户数据或系统完整性的行为，应包含适当警告。L287-L292 指导用户执行 rm -rf 删除技能目录和工作目录，其中工作目录可能包含下载工具和配置，但文档未提醒该操作不可恢复，也未提示先备份配置。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README describes a one-click protection workflow but does not clearly disclose that application binaries and related metadata are sent to a remote YiDun service for processing. This omission can mislead users about data handling and trust boundaries; in a code-signing/app-binary context, uploaded binaries may contain proprietary code, embedded secrets, or unreleased product assets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README instructs users to enter an AppKey interactively and to pass it via CI secrets, but it does not clearly warn that this credential is sensitive and must never be exposed in chat transcripts, shell history, screenshots, logs, or build artifacts. In an AI-agent context, this is more dangerous because users may paste secrets directly into conversational interfaces or because agents may echo commands and values into logs, increasing the chance of credential leakage.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 384)May include surrounding context.

bash
# 手动下载
mkdir -p ~/.yidun-defense
curl -L -o ~/.yidun-defense/yidun-tool.jar \
  "https://clienttool.dun.163.com/api/v1/client/jarTool/download"

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 384)May include surrounding context.

bash
# 手动下载
mkdir -p ~/.yidun-defense
curl -L -o ~/.yidun-defense/yidun-tool.jar \
  "https://clienttool.dun.163.com/api/v1/client/jarTool/download"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill advertises operational shell-based behavior such as downloading tools, configuring credentials, and processing app packages, but it does not declare an explicit tool scope or permissions boundary. This creates a trust and execution-control gap: an agent may invoke shell capabilities more broadly than a user expects, including network download and filesystem modification, which is risky in a build or developer environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill's title, description, examples, and command phrases are presented entirely in Chinese, including the explicit examples of what the agent can understand. There is no indication that users may interact in other languages or that Chinese is a required locale for a region-specific compliance reason.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs users to enter an AppKey and later documents storage in ~/.yidun-defense/config.ini, but it does not present a clear security warning about local credential storage. Storing service credentials in plaintext or predictable locations can expose them to other local users, malware, logs, backups, or accidental commits if the file is copied into project automation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The embedded SKILL.md metadata describes the skill as "AI Agent Skill for Android APK protection", implying Android-only scope. Elsewhere, the same document states that defense-smart.sh supports android/ios/harmony/h5/sdk/pc and labels it a "智能多平台加固脚本", which directly contradicts the narrower metadata claim rather than merely omitting details.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The stated manifest context says the skill is for "multi-platform app protection", but the agent integration pseudocode and prompt-recognition rules only describe handling APK inputs and APK-oriented phrases. That creates a semantic mismatch between the claimed broad multi-platform scope and the actual documented invocation behavior exposed to the agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The guide instructs users to run a setup flow that downloads vendor tooling and later processes application binaries, but it does not clearly disclose that binaries, metadata, and logs may be transmitted to YiDun services during protection. In a security-sensitive skill that handles proprietary mobile apps, missing data-handling transparency can cause unintended third-party disclosure of confidential code, assets, or build metadata.

Content

No source excerpt is available for this finding.