T09 · Insecure Skill Coding Practices
Warning
- Location
math/agent.yaml:11- Finding
Hardcoded Activation Codes Allow Paid Mathematics Authorization Bypass
- Content
View full analysis
- Remediation
View remediation
Security audit
Educlaw Multi-Subject Agent
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed Chinese-language tutoring skill with simple routing and no executable tools, but its paid math access control is only a documented test/demo mechanism.
Install only if you are comfortable with a Chinese-language tutoring experience and local OpenClaw routing changes. Do not rely on the included math activation codes or conversation-memory authorization for real paid access control; treat this package as a test/demo unless entitlement checks are moved to a trusted service.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documented English-skill trigger phrases are short, natural-language utterances that users could say in ordinary conversation, increasing the chance of accidental routing to this skill. In a multi-agent environment, broad triggers can cause misrouting, unintended data exposure to the wrong skill, or unreliable agent selection, even if the skill itself is not overtly malicious.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The Math-skill trigger phrases are similarly broad and conversational, making them susceptible to ambiguous matches and accidental invocation. Because this skill also includes paid-flow and activation behavior, incorrect routing could lead to confusing monetization prompts or undesired handling of user context by the wrong agent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language instructions and examples are entirely in Chinese, including the activation phrases users are told to use. Because the skill is described as supporting subjects like English and math but does not state that Chinese is optional or provide a locale choice, it appears to impose a specific language without user opt-in.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill hard-codes Chinese-language interaction and does not offer the user a language preference or fallback, which can exclude or confuse users who initiated an English-learning interaction in another language. This is not a code-execution or data-exfiltration issue, but it is a genuine safety/quality problem because it can impair accessibility, informed consent, and correct task fulfillment.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The natural-language instructions and required reply text are entirely specified in Chinese and present a fixed persona and response pattern, with no indication that the user may choose another language. This creates a language/locale constraint without opt-in, which matches the policy-violation category for forced language behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The manifest says the skill activates when a student says "学数学" or "开始数学", which are broad everyday phrases that could easily appear in normal conversation rather than as an intentional invocation. The file does not provide negative examples, exclusion conditions, or narrower context to distinguish casual mention from deliberate activation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
This manifest file defines a fallback agent for any case where intent is unclear, but it does not document boundaries, exclusions, or negative examples for when the fallback should or should not activate. In a router configuration, such unspecified catch-all behavior can cause unintended invocation on ordinary or ambiguous user speech.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
All example invocations and interaction instructions are presented only in Chinese, with no indication that users may choose another language for operation. Under the stated policy, a language constraint should be optional or explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 73% confidence
- Finding
The natural-language content in this file is presented only in Chinese, including agent identifiers and comments, and the routing appears centered on Chinese-language usage without any documented user opt-in or alternative locale. This can constitute a language/locale policy issue when the skill implicitly forces one language experience.
- Content