T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:48- Finding
Destructive production operations lack mandatory authorization and least-privilege controls
- Content
View full analysis
- Remediation
View remediation
Security audit
冒烟测试
Security checks for vulnerabilities and agentic risk
Overview
This web QA skill is not malicious, but it needs review because it can guide agents into destructive tests, production code changes, service restarts, and persistent memory writes without strong approval gates.
Only use this skill on systems you own or are explicitly authorized to test. Keep it to read-only or staging environments by default, and require separate confirmation before any write, deletion, production upload, database restore, SSH action, service restart, or memory/knowledge-base update. Use scoped test credentials and review generated reports for secrets or untrusted application text before publishing or persisting them.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:137- Finding
Untrusted QA conclusions may be written into persistent Agent memory without review
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger phrases are broad enough to match common requests like 'test', 'audit', or '修复验证', which can cause the skill to activate in contexts the user did not intend. Because this skill includes invasive QA, code modification, restart, and reporting behaviors, accidental activation materially raises the risk of unauthorized or surprising actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a broad, iterative, LLM-assisted web QA and bug-fixing system, including comprehensive functional testing, analysis, remediation, and regression validation. The supplied code instead performs a very specific static/dynamic probe: it loads one page, enumerates inline onclick handlers, verifies whether the referenced global functions exist on window, collects console errors, and emits JSON. This is a materially narrower and different primary purpose than the declared workflow. While it is loosely related to web testing, it lacks nearly all of the major declared capabilities and does not implement fixing, analysis, or comprehensive auditing behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The code does relate to web UI regression/smoke testing, so it partially aligns with the testing portion of the description. However, the declared purpose substantially overstates the skill’s behavior. The script only performs browser-based smoke checks: view switching, DOM metric collection, forbidden-string scanning, screenshots, console/page error capture, and simple expected-value assertions. It does not use an LLM, does not run an iterative QA/fixing loop, does not compare UI values to API truth, does not analyze root causes, and does not modify code or verify fixes beyond reporting test results. Therefore the description does not accurately represent what this code chunk actually does.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly directs destructive testing, production file downloads/uploads, backend source edits, service restarts, and knowledge-base updates, but it does not require strong safety interlocks, staging-only restrictions, or explicit user risk acknowledgment. In a real deployment this can lead to outages, data loss, integrity violations, or irreversible changes to live systems under the guise of QA or remediation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 74% confidence
- Finding
The README is written as a Chinese-only skill description and does not indicate any option for the user to choose language or locale. Because the skill is presented for general-purpose Web QA workflows rather than a clearly region-specific use case, this can conflict with a language-choice policy if the skill implicitly expects or forces Chinese interaction.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
unzip webapp-qa-workflow.zip -d ~/.openclaw/skills/
text 解压后目录结构应为：`~/.openclaw/skills/webapp-qa-workflow/SKILL.md`。 ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README explicitly describes downloading, editing, uploading code, restarting backend services, and publishing reports, but does not present clear safety gates, environment scoping, backup/rollback requirements, or user approval warnings. In a production-like environment, these actions can alter systems, interrupt service, expose sensitive data in reports, or create unintended persistence.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill declares an empty
allowed-tools:scope while its instructions clearly contemplate access to execution environments and operational tooling such as Playwright, Node, Python, curl, and SSH. Missing or ambiguous tool scoping can let the platform infer broader capabilities than intended, reducing containment and making it easier for the skill to be invoked with more power than users expect.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases are extremely broad, including generic terms like 'test', 'audit', and 'fix bugs', which can cause accidental activation on ordinary requests. In this skill's context, accidental activation is more dangerous because the workflow includes destructive testing, production modification, service restarts, and persistence of conclusions to long-term memory/knowledge bases.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This manifest file includes example trigger text '帮我做功能测试，确认修复有没有生效', which is a broad request for functional testing and fix verification rather than a clearly bounded smoke-test invocation. Because the skill appears specialized for a '测试—修复' workflow, this vague phrasing could cause unintended activation on ordinary QA requests without explicit scope limits or exclusion conditions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This section explicitly instructs stopping a backend service and copying live database/config files before and after destructive tests, but it does not require any user confirmation, environment scoping, or safety guardrails. In a QA automation skill, these steps could be followed against a production-like or misconfigured target, causing service interruption, data loss, or restoration of stale state.
- Content
Static analysis
No suspicious patterns detected.