Ai Xifu Caopan

• Outcome: Review
• Latest audit: Jun 9, 2026 · 8:04 AM UTC
• Version: 5.4.1

Overview

The skill mostly matches a finance-document generator, but it also includes under-disclosed memory backup, conversation archiving, cloud upload, and restore code that is not proportionate to that purpose.

Review before installing. The ordinary market-data and .docx generation behavior is expected for this kind of skill, but the bundled memory_bridge_v2.py script can archive conversations and memory/profile files and upload them through a separate cloud-drive integration. Install only if you understand and accept that extra capability, and avoid running backup_cloud/all or restore modes unless you explicitly want that data movement and persistence.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

script = os.path.join(GS_SCRIPTS_DIR, "gs_stock_market_query.py")
    
    try:
        result = subprocess.run(
            ["python3", script, "single_hq", "--code", symbol, "--set_code", str(set_code)],
            capture_output=True, text=True, timeout=20,
            env={**os.environ}

• Confidence: 92% confidence
• Finding: This code launches an external Python script from a user-writable path under the home directory and passes through the full inherited environment. Even though shell injection is avoided by using an argument list, execution of a sibling skill script creates a trust-boundary problem: if that script or environment is tampered with, this adapter will execute untrusted code with the agent's privileges and secrets.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

script = os.path.join(GS_SCRIPTS_DIR, "gs_stock_market_query.py")
    
    try:
        result = subprocess.run(
            ["python3", script, "past_hq", "--code", symbol, "--set_code", str(set_code), "--want_nums", str(days)],
            capture_output=True, text=True, timeout=20,
            env={**os.environ}

• Confidence: 92% confidence
• Finding: This second subprocess call has the same trust-boundary weakness: it executes an external script from ~/.openclaw/workspace and forwards the entire process environment. An attacker who can modify that script path or influence inherited environment variables can turn a market-data fetch into arbitrary code execution or secret leakage.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The skill makes conflicting privacy claims: it says no user data is stored beyond the current session, yet elsewhere states it may automatically save a watchlist for future use. Even if the watchlist only contains symbols, this is still persistence of user-derived data and can mislead users about retention and privacy expectations.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The documentation claims subprocess calls do not modify files, but the skill elsewhere states that it generates and saves .docx files locally. This inconsistency can misrepresent the skill's side effects, weakening user trust and auditability and making it harder to reason about what data is written to disk.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The template repeatedly claims it is for 'educational reference only', but it also provides highly actionable trading content: directional calls, entry/exit levels, stop-losses, position sizing, Kelly-based sizing, risk scores, and explicit buy/sell frameworks. This disclaimer-instruction mismatch can mislead users or downstream agents into treating regulated or risky financial advice as exempt educational material, increasing legal, safety, and user-harm exposure.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The code comments state the document will not be saved unless explicitly requested, but the function always writes a .docx file to disk. In an agent setting, this creates an undeclared side effect that can leak sensitive user-supplied financial data into local storage, violate user expectations, and leave persistent artifacts for later access.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: Trigger phrases such as '看600519' or '做个茅台方案' are broad enough that they may overlap with ordinary conversation, increasing the chance of unintended activation. In a skill that can call external APIs, write files, send documents, and update a watchlist, accidental triggering can cause unexpected data processing and side effects.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The script packages chat logs, memory files, and related documents, then uploads them to cloud storage automatically with no consent gate, review step, minimization, or privacy notice. In this skill context, the data includes persistent conversation history and profile-like memory files, making unauthorized or unexpected exfiltration materially dangerous.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The restore routine overwrites key local memory files from archived content without confirmation, version checks, or integrity validation. In a memory-management skill, this can silently replace current state with stale or tampered data, causing data loss, persistence of malicious content, or operational confusion.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The module is explicitly designed to retain, archive, and later reuse full conversations and memory artifacts, including cloud backup. In this context, that materially increases exposure of sensitive user data, creates long-lived privacy risk, and expands the blast radius if the local workspace or cloud target is compromised.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The code extracts detailed user and assistant messages into daily transcript files and builds persistent keyword indexes from them. This creates searchable long-term records of potentially sensitive conversations, increasing both privacy harm and discoverability of confidential topics if the files are accessed by other local processes or later uploaded.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The backup routine aggregates memory files, identity/profile-like files, chat logs, and generated documents into a single archive set. Consolidating diverse sensitive artifacts in one place significantly increases exposure and makes later exfiltration or accidental disclosure more damaging.

Static analysis

No suspicious patterns detected.