ClawHub
Back to skill

Security audit

BOC Forex Monitor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Bank of China exchange-rate monitor with local state and optional user-configured notifications.

Install this only in a workspace where a recurring forex check is desired. Review the .openclaw-state files, keep notification targets private, and understand that enabling Feishu or another OpenClaw message channel can send alert details outside the local workspace.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Note
Location
scripts/boc_forex_cron_runner.py:137
Finding

Notification Recipient and Account Identifiers Stored Without Enforced Access Restrictions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md
- `scripts/boc_forex_check.py`: fetch + parse + compare + trigger generation

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill instructs the agent to copy and execute Python scripts, read environment variables, write local state files, access the network, and potentially send notifications, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent may exercise broader capabilities than reviewers expect, increasing the risk of unintended file access, command execution, or outbound communication if the bundled scripts or future edits are unsafe.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation instructs users to configure external notifications to Feishu or another messaging target but does not clearly warn that monitoring results and trigger metadata may be transmitted to a third-party service. In a monitoring skill, that omission can cause operators to unintentionally send financial monitoring data, account identifiers, or alert context outside the local environment.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/boc_forex_cron_runner.py (reported line 75)May include surrounding context.

python
def run_check():
    proc = subprocess.run([sys.executable, str(CHECK_SCRIPT)], cwd=str(ROOT), capture_output=True, text=True)
    if proc.returncode not in (0, 10):
        err = (proc.stderr or proc.stdout or '').strip()
        print('❌ 汇率检查执行失败')

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/boc_forex_cron_runner.py (reported line 104)May include surrounding context.

python
cmd = ['openclaw', 'message', 'send', '--channel', channel, '--target', target, '--message', message]
    if account_id:
        cmd.extend(['--account', account_id])
    return subprocess.run(cmd, cwd=str(ROOT), capture_output=True, text=True)


def parse_args():

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file states that the scripts read and write several files under .openclaw-state, but it does not include any caution that running the skill will create and update local state in the target workspace. For markdown files, user-facing documentation should warn about behaviors that affect user data or filesystem state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.