Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly fits its 96Push publishing purpose, but it needs Review because it can send draft content to 96Push without a confirmation gate and its rules command can read Markdown files outside the intended rules folder.
Install only if you trust 96Push and intend to let an agent operate your connected social accounts. Treat create as sensitive because it sends draft content to api.96.cn even before publishing, require explicit user approval before using it, avoid arbitrary platform names in the rules command until path handling is fixed, and review all target accounts/settings before any publish, delete, upload, queue cancel, or platform-config change.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
key = os.environ.get("PUSH_API_KEY", "").strip()
if key:
return key
env_file = os.path.expanduser("~/.openclaw/.env")
if os.path.isfile(env_file):
with open(env_file) as f:
for line in f:
The skill can access environment variables, read files, and make network requests, yet the manifest does not declare an explicit tool scope or allowed-tools boundary. That weakens defense-in-depth by making the skill's effective capabilities less transparent and easier to overgrant, which is significant here because the skill can drive high-impact publishing actions against logged-in social media accounts.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
---
name: 96push
description: "User-approved 96Push desktop client publishing helper — query platforms/accounts, create content, inspect platform rules, and publish only after explicit confirmation. Use when user mentions 96push, publishing, social media, multi-platform, or content distribution."
homepage: https://push.96.cn
metadata:
openclaw:
The manifest trigger text includes broad phrases like 'publishing,' 'social media,' 'multi-platform,' and 'content distribution,' which may cause the skill to activate for generic user requests not specifically intended for 96Push. In this skill, accidental activation is riskier than usual because the tool can enumerate accounts, inspect drafts, and perform destructive or public posting actions once later steps are taken.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Do not run `update`, `publish`, `delete-article`, `cancel-queue`, `create-plat-set`, `update-plat-set`, or `delete-plat-set` until the user explicitly approves that exact action.
- Before asking for approval, show the content ID/title, content type, target account IDs/platforms, draft/live publish state, visibility, and platform settings.
- Prefer draft mode or a single account first. Publishing to multiple accounts requires a second explicit confirmation for the full account list.
- Never ask the user to paste `PUSH_API_KEY` into chat by default. Prefer that the user stores it locally in an environment variable or `~/.openclaw/.env`.
- Never echo API keys, draft private content, or unpublished media URLs in responses.
- Only use this skill when the user intends to operate 96Push and trusts the 96Push service at [https://push.96.cn](https://push.96.cn).
The entire skill file is written as a mandatory Chinese-language rules document and does not indicate that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
The file's instructional content is entirely in Chinese, which effectively forces a specific language on users. Under the policy, language constraints should either provide user choice or be explicitly documented as a justified locale-specific requirement.
The natural-language content from L03 onward is exclusively Chinese, and the file does not indicate that the skill is region-specific or that users may choose another language. This can violate language/locale policy where skills should not force a specific language without user opt-in or justification.
This markdown file presents all operational instructions in Chinese and does not indicate that the user can choose another language or that the skill is intentionally limited to Chinese-speaking users. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import urllib.parse
import uuid
BASE_URL = "https://api.96.cn/api/push/proxy"
SCRIPT_DIR = os.path.dirname(os.path.abspath(__file__))
SKILL_DIR = os.path.dirname(SCRIPT_DIR)
RULES_DIR = os.path.join(SKILL_DIR, "references", "platform-rules")
Multiple user-facing labels and messages are hard-coded in Chinese, such as content type labels and later stderr/status outputs, while the CLI does not offer a language selection or opt-in. This can violate language/locale policy when a skill forces a specific language for outputs regardless of user preference.
The skill metadata says publishing occurs only after explicit confirmation, but create executes immediately and sends supplied title/body/media URLs to the remote 96Push API without a comparable confirmation gate. In an agent setting, this mismatch can cause unintended external transmission or remote draft/content creation even when the operator believes all state-changing actions are approval-gated.
The create path transmits user-supplied article text, markdown, descriptions, and media URLs to api.96.cn immediately, with no action-point warning or confirmation requirement. In an LLM/agent workflow this is risky because users may treat 'create' as local preparation, but it actually performs an external write and can disclose sensitive draft content to a third party.
The skill description focuses on querying, creating content, inspecting rules, and publishing, but the code also supports creating, updating, and deleting platform publish configurations on the remote service. This undocumented capability expands the blast radius: an agent or user may invoke remote account-setting changes without realizing the skill can alter persistent publish behavior beyond a single post.
This markdown file presents all operational guidance exclusively in Chinese and does not indicate that users may choose another language. Under the natural-language policy criteria, forcing a specific language without user opt-in can be a policy violation unless the locale restriction is clearly documented and justified.
The file’s natural-language instructions are entirely in Chinese, and there is no indication that the skill is intended only for Chinese-speaking users or that users can opt into another language. Under the policy, forcing a specific language without user choice can be a locale/language policy issue.
This markdown file presents all usage instructions exclusively in Chinese, and there is no indication that the skill is intended only for Chinese-speaking users or that users can opt into another language. Under the language/locale policy, forcing a single language without user choice or justification can be a natural-language policy violation.
The entire skill file is written only in Chinese and does not indicate that users may choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy concern unless the locale restriction is explicitly documented and justified.
This markdown reference forces a specific language/locale for all readers through its natural-language content. Under the policy, language-specific instructions should either offer user choice or clearly document a justified locale restriction.
The top-level docstring characterizes the script narrowly as a remote-control CLI that wraps the proxy API. In practice, the code also opens local files for rules, uploads, and credential loading, which contradicts the docstring's implication that it is only an API wrapper.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
def require_confirm(args, action: str, flag: str = "confirm"):
if getattr(args, flag, False):
return None
return confirmation_error(action, f"--{flag.replace('_', '-')}")
The stated purpose is a desktop publishing helper for interacting with 96Push. The implementation additionally reads authentication material from process environment variables and ~/.openclaw/.env, which is a local secret-access capability not mentioned in the manifest text.
No suspicious patterns detected.