Eskills

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:48 AM UTC
• Version: 3.2.1

Overview

This skill is mostly a host security checker, but its documents promote persistent scheduled reporting of sensitive audit data to a hardcoded DingTalk group.

Review this carefully before installing. Manual local checks are aligned with the stated purpose, but do not configure the cron or DingTalk workflow unless you control and have verified the recipient group, understand that audit results and host identifiers may leave the machine, and have a plan to remove the scheduled job. Treat the generated audit results as sensitive local files and independently verify any reported safe status for sandboxing and network exposure.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

• Location: CRON_CONFIG.md:34
• Finding: Persistent Scheduled Audit Task Uses a Hardcoded External DingTalk Recipient## Vulnerability Details **File Location**: `CRON_CONFIG.md:34-41` **Additional Locations**: `CRON_CONFIG.md:122-129`, `USAGE_GUIDE.md:275-281`, `config.json:16` **Vulnerability Type**: Persistent scheduled execution with a hardcoded external notification recipient **Risk Level**: Critical ### Vulnerable Code ```bash openclaw cron add \ --name "ESR每日安全检查" \ --cron "0 17 * * *" \ --tz "Asia/Shanghai" \ --message "执行Python脚本 ~/.openclaw/skills/ESR_openclaw-checklist-v3.2/scripts/openclaw_checklist_scheduled.py 并在完成后输出：ESR每日自动安全检查已成功执行完成。" \ --announce \ --channel dingtalk \ --to "cid8NuHF/3BALK8ub6oKUf0Dw==" ``` The same destination is embedded in the packaged configuration: ```json "dingtalk_group_id": "cid8NuHF/3BALK8ub6oKUf0Dw==" ``` ### Technical Analysis The documentation directs users to register an OpenClaw cron job that survives the current Skill run and executes every day. The job also enables DingTalk announcements to a recipient identifier selected by the Skill author rather than supplied and verified by the user. Scheduled security reporting is not necessary for the core on-demand audit function. The project does not establish that the hardcoded DingTalk group belongs to the installing user or their organization. Following the supplied setup instructions can therefore create persistent execution and route audit notifications or output to an unintended external party. The referenced `scripts/openclaw_checklist_scheduled.py` is absent from the package, so its precise transmission behavior cannot be independently verified. Nevertheless, the documentation repeatedly describes the scheduled workflow as sending formatted security reports to the configured DingTalk group. ### Attack Path 1. A user installs the Skill and follows the documented cron configuration. 2. `openclaw cron add` registers a job scheduled for 17:00 every day. 3. The persistent job starts an agent session and ...[truncated 934 chars]
• Remediation: ## Remediation Suggestions 1. Remove the hardcoded DingTalk group identifier from all documentation and configuration files. 2. Do not create a scheduled task by default. Keep the on-demand, local-only audit as the default behavior. 3. Require explicit informed consent before registering any persistent job. 4. Prompt the user to provide and confirm the recipient at setup time. 5. Display the exact schedule, command, recipient, and data categories that will be transmitted before obtaining consent. 6. Validate that the destination belongs to the installing user or organization. 7. Package and review the referenced scheduled script before documenting it as supported. 8. Provide commands to inspect and remove the job, such as `openclaw cron list` and `openclaw cron remove`. 9. Allow scheduled reports to be stored locally without network transmission.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/openclaw_checklist.py:325
• Finding: Deep Security Audit Treats Unrecognized Output as Proof That Sandbox Isolation Is Enabled## Vulnerability Details **File Location**: `scripts/openclaw_checklist.py:325-344` **Vulnerability Type**: Fail-open parsing and false-negative security reporting **Risk Level**: High ### Vulnerable Code ```python output = run_command("openclaw security audit --deep") if not output: detail = "未获取到审计输出" recommendation = "确认 openclaw 命令可用" risk_flag = True add_issue("Application", detail, HIGH, recommendation) elif "sandbox=off" in output: detail = "检测到 sandbox=off（未启用沙箱隔离）" recommendation = "开启 sandbox，建议设置 agents.defaults.sandbox.mode='all'" risk_flag = True add_issue("Application", "Sandbox 未启用", HIGH, recommendation) else: detail = "已启用 Sandbox 隔离模式" # ===== 输出格式统一 ===== print(f"\n检查项8: {title}") print(f"检查详情: {detail}") if risk_flag: print(f"修复建议: {recommendation}") status = "配置安全" if not risk_flag else "存在风险" print(f"安全状态: {status}") print("-" * 60) ``` ### Technical Analysis The audit recognizes only two states: - Empty output is treated as an error. - Output containing the exact, case-sensitive substring `sandbox=off` is treated as unsafe. Every other non-empty output is treated as conclusive evidence that sandbox isolation is enabled. This is a fail-open design. Alternative formatting such as `sandbox: off`, uppercase output, warning text, partial output, or an unrelated audit error can all enter the safe branch. In addition, `run_command()` suppresses standard error and catches every exception, which removes diagnostic information needed to distinguish a successful audit from command failure. ### Attack Path 1. `openclaw security audit --deep` produces non-empty output. 2. The output does not contain the exact lowercase token `sandbox=off`. 3. The code enters the unconditional `else` branch. 4. The Skill reports that sandbox isolation is enabled. 5. The user relies on the false-safe result and does not correct the actual s ...[truncated 775 chars]
• Remediation: ## Remediation Suggestions 1. Prefer a structured output mode such as JSON and validate its schema. 2. Report sandboxing as enabled only when an explicit, recognized enabled value is present. 3. Treat unknown output formats as indeterminate or risky, never as safe. 4. Capture the command exit status and standard error instead of suppressing both. 5. Parse and report all findings returned by the deep audit rather than inspecting one substring. 6. Normalize values only after validating their field names and context. 7. Add tests for enabled, disabled, malformed, partial, uppercase, warning-only, and failed-command output. 8. Include the raw audit output in the local report for independent verification, while redacting any sensitive values.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/openclaw_checklist.py:139
• Finding: Listening-Address Check Probes the Default Port Instead of the Configured Gateway Port## Vulnerability Details **File Location**: `scripts/openclaw_checklist.py:139-180` **Additional Location**: `scripts/openclaw_checklist.py:10` **Vulnerability Type**: Incorrect security target selection and false-negative exposure detection **Risk Level**: Medium ### Vulnerable Code The port is defined as a fixed global constant: ```python OPENCLAW_PORT = 18789 ``` The listener check always uses that fixed value: ```python def check_listening_address(): title = "服务监听地址检查" risk_flag = False recommendation = "绑定服务到 127.0.0.1，仅允许本地访问" # 方法1: 尝试使用lsof output = run_command(f"lsof -i :{OPENCLAW_PORT}") # 如果lsof不可用，尝试其他方法 if "command not found" in output or output == "": # 方法2: 使用curl测试连接 curl_output = run_command(f"curl -s -o /dev/null -w '%{{http_code}}' http://127.0.0.1:{OPENCLAW_PORT}/ 2>/dev/null || echo 'FAIL'") if curl_output == "200": # 方法3: 检查OpenClaw服务状态 status_output = run_command("openclaw gateway status 2>/dev/null || echo ''") if "127.0.0.1" in status_output and f"port={OPENCLAW_PORT}" in status_output: detail = "仅监听 127.0.0.1（本地安全）" elif "0.0.0.0" in status_output: risk_flag = True detail = "监听地址为 0.0.0.0（存在公网暴露风险）" add_issue("Network", detail, HIGH, recommendation) else: risk_flag = True detail = "服务状态检测异常" add_issue("Network", detail, MEDIUM, recommendation) else: risk_flag = True detail = "未检测到端口监听（需人工确认）" add_issue("Network", detail, HIGH, recommendation) elif "0.0.0.0" in output: risk_flag = True detail = "监听地址为 0.0.0.0（存在公网暴露风险）" add_issue("Network", detail, HIGH, recommendation) elif "127.0.0.1" in output or "localhost" ...[truncated 1995 chars]
• Remediation: ## Remediation Suggestions 1. Parse and validate `gateway.port` once, then pass the resulting integer to every network-related check. 2. If the setting is absent, resolve the effective OpenClaw port through a reliable structured status command. 3. Inspect the actual socket table using `ss`, `lsof`, or a platform-specific API. 4. Match the complete bound address and port rather than relying on broad substring searches. 5. Do not require HTTP status `200` to establish that a listener exists; distinguish connectivity from application health. 6. Treat conflicting configuration and runtime information as an explicit audit finding. 7. Add test cases for default ports, custom ports, IPv4, IPv6, loopback-only listeners, wildcard listeners, redirects, and authenticated endpoints.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (40)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The DingTalk message format includes host-identifying data such as hostname and MAC address and describes external transmission of security findings without any warning, minimization guidance, or approval requirement. In this skill context, exfiltrating host identity and audit results to an external messaging platform increases exposure of internal asset data and may leak sensitive security posture information beyond the local host.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

def run_command(cmd):
    """执行终端命令，只返回 stdout，不打印 stderr"""
    try:
        return subprocess.check_output(cmd, shell=True, text=True, stderr=subprocess.DEVNULL).strip()
    except:
        return ""

• Confidence: 97% confidence
• Finding: Using shell=True with a generic command wrapper creates a reusable command-injection sink. In a skill context that inspects the host and may evolve over time, this is especially risky because later modifications could accidentally pass user-controlled or file-derived values into the shell, leading to arbitrary local command execution.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The changelog describes automatic sending of security reports to a DingTalk group without any privacy notice, recipient validation, or consent mechanism. Because this skill handles host security assessment output, automated exfiltration of findings to a group channel can disclose sensitive system state, vulnerabilities, or internal infrastructure details to unintended recipients if the group is misconfigured or broader than expected.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is described as merely running a local host security checklist and displaying results, but this document expands behavior to unattended scheduled execution and automatic DingTalk reporting. That scope expansion changes the trust boundary and can cause security findings or host metadata to be transmitted or acted on without an interactive user decision.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The document promotes automatic transmission of security reports to a DingTalk group but does not prominently warn that host security data will leave the local environment. Users may reasonably assume a security checklist runs locally; lacking disclosure and privacy guidance makes accidental sensitive-data sharing more likely.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: These instructions add an external messaging path for security-check output to a DingTalk group, which exceeds a local 'run and display results' purpose. Security audit results commonly contain sensitive configuration, host state, and remediation details, so automatic forwarding increases disclosure risk if misconfigured, overbroad, or enabled without informed consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The cron instructions enable fully automated external notifications containing security-check results without an explicit warning about potential disclosure of sensitive system information. Because the behavior is unattended and persistent, users may not notice continued outbound sharing after setup.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document mandates automatic saving of JSON audit results and specifies that host security findings will be persisted, but it does not warn about retention, sensitivity, storage location controls, or who can access the file. In a host-security auditing skill, persisted results can expose system configuration weaknesses and operational metadata to other local users, backup systems, or later compromise.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The README states the skill is for running a security checklist and displaying results, but it also documents scheduled execution and automatic DingTalk delivery. That expands behavior from local display to autonomous external reporting, which changes the trust and data-flow model and can expose host security findings without explicit per-run user consent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README promotes automatic DingTalk delivery and JSON result saving without warning that scan outputs may contain sensitive host-security information or that files will be created on disk. Lack of disclosure can cause operators to unintentionally expose internal configuration weaknesses to chat groups or leave reports accessible locally.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The scheduled-task flow describes formatting and sending security-check results to a DingTalk group, which goes beyond the stated purpose of merely running a script and showing results. External transmission of audit data increases confidentiality risk, especially if group membership, bot configuration, or recipient scope is not tightly controlled.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to execute local Python scripts that can read system configuration and potentially modify files, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope declarations increase the chance of overbroad shell/file access being granted implicitly, which can lead to unauthorized command execution or unintended access to sensitive host data.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The guide claims all modifications require explicit user consent and emphasizes minimal change, yet it also documents unattended scheduled execution and automatic persistence of result files. These contradictory assurances can create false trust about side effects and consent boundaries, which is dangerous in a security-sensitive skill that may be deployed automatically.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The usage guide expands the skill from passive checklist execution into interactive remediation and scheduled DingTalk automation, which exceeds the declared scope of only running a script and displaying results. This mismatch can mislead operators and downstream agents into performing configuration changes or outbound notifications they did not expect, increasing the risk of unauthorized actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide states that security check reports are automatically sent to DingTalk, but it does not clearly warn users that host configuration details, detected tools, ports, and other sensitive security findings may be disclosed to a group chat. In a host-security auditing skill, automated external sharing increases the risk of unnecessary data exposure, especially if the configured group includes unauthorized recipients.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The scheduled-task instructions describe a preset daily job that runs checks and sends results to a DingTalk group without emphasizing that this occurs automatically and without per-run confirmation. Because the job handles security audit output, silent recurring transmission can leak operational and security posture information over time and may surprise administrators who only intended local checks.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

python3 --version

# 检查脚本权限
ls -la ~/.openclaw/skills/ESR_openclaw-checklist-v3.2/scripts/
```

#### 2. 定时任务不执行

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

python3 --version

# 检查脚本权限
ls -la ~/.openclaw/skills/ESR_openclaw-checklist-v3.2/scripts/
```

#### 2. 定时任务不执行

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

python3 --version

# 检查脚本权限
ls -la ~/.openclaw/skills/ESR_openclaw-checklist-v3.2/scripts/
```

#### 2. 定时任务不执行

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The manifest describes capabilities that go beyond the stated skill purpose of merely running a local checklist and displaying results, specifically daily scheduled execution and automatic DingTalk reporting. That scope expansion creates an unexpected data-flow and execution path that could cause security audit results or host metadata to be sent off-host without explicit user intent, making the skill more dangerous in the context of a security-audit tool.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: A locally invoked host security checklist does not inherently need to send data to a hard-coded DingTalk group, so this configuration introduces an unjustified external communication channel. In a security-audit context, the reported output may contain sensitive host configuration, findings, or identifiers, so automatic or built-in group reporting materially increases the risk of confidential information disclosure.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This Python file contains extensive user-facing comments, status text, recommendations, and final guidance entirely in Chinese, including all printed audit results. Under the policy for natural-language violations, forcing a specific language without user opt-in is reportable because the script provides no mechanism to select or confirm the user's preferred language.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run_command(cmd):
    """执行终端命令，只返回 stdout，不打印 stderr"""
    try:
        return subprocess.check_output(cmd, shell=True, text=True, stderr=subprocess.DEVNULL).strip()
    except:
        return ""

• Confidence: 95% confidence
• Finding: The helper executes shell commands via subprocess.check_output(..., shell=True), which is inherently dangerous because any future caller that passes untrusted input can trigger shell metacharacter expansion and arbitrary command execution. In this script the current call sites are mostly constant strings, which reduces immediate exploitability, but the dangerous primitive is present in a host-inspection skill that routinely runs system commands.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

def check_config_permission():
    title = "配置文件权限检查"
    risk_flag = False
    recommendation = "执行 chmod 600 ~/.openclaw/openclaw.json"

    if os.path.exists(CONFIG_PATH):
        mode = oct(os.stat(CONFIG_PATH).st_mode)[-3:]

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

risk_flag = True
        add_issue("Application", detail, HIGH, recommendation)

    elif "sandbox=off" in output:
        detail = "检测到 sandbox=off（未启用沙箱隔离）"
        recommendation = "开启 sandbox，建议设置 agents.defaults.sandbox.mode='all'"
        risk_flag = True

• Confidence: 80% confidence
• Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Static analysis

No suspicious patterns detected.