ClawHub
Back to skill

Security audit

PaperDaily

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it asks for Feishu credentials while most runtime behavior is delegated to an unpinned external package that is not included for inspection.

Install only if you are comfortable trusting the openclaw-paperdaily npm package version resolved at install time. Use a least-privilege Feishu app, avoid broad workspace permissions, protect and rotate the App Secret, and prefer a release that pins the dependency, includes a lockfile, and clearly documents what is sent to Feishu.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
package.json:5
Finding

Unpinned and Unauditable Third-Party Runtime Dependency

Content
View full analysis

Vulnerability Details

File Location: package.json:5-8; related installation and secret-handling instructions at SKILL.md:10-17
Vulnerability Type: Supply-chain exposure through an unpinned external dependency
Risk Level: Medium

Vulnerable Code

package.json:5-8:

json
"main": "dist/index.js",
"type": "module",
"dependencies": {
  "openclaw-paperdaily": "^0.1.0"
}

SKILL.md:10-17:

bash
cd ~/.openclaw/skills/paperdaily
npm install

After installation, create the configuration file node_modules/openclaw-paperdaily/.env:

env
# Feishu application configuration (required)
FEISHU_APP_ID=your_app_id
FEISHU_APP_SECRET=your_app_secret

Technical Analysis

The artifact does not contain the declared dist/index.js implementation or any other runtime source code. Its functionality is therefore delegated entirely to the externally installed openclaw-paperdaily package.

The dependency uses the range ^0.1.0 rather than an exact version, and the reviewed artifact contains no lockfile or integrity metadata. A later package release satisfying this range may consequently be selected during installation. In addition, npm install may execute lifecycle scripts supplied by resolved packages unless installation scripts are explicitly disabled.

The documentation directs users to place a Feishu application secret in the dependency's own directory. Code in that dependency can inherently read this value once configured. Because the dependency implementation and resolved package version are absent from the audited artifact, its runtime network activity, credential handling, and correspondence with the stated arXiv recommendation behavior cannot be verified.

This finding does not establish that the current dependency is malicious. It establishes a supply-chain trust boundary that is mutable and not auditable from the submitted project.

Attack Path

  1. An attacker ...[truncated 1465 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin openclaw-paperdaily to a reviewed exact version rather than using a caret range.
  2. Generate and commit a package lockfile containing resolved versions and integrity hashes, and use npm ci for reproducible installation.
  3. Vendor or include the actual runtime implementation in the audited artifact so its network behavior, credential handling, command handlers, and caching logic can be reviewed.
  4. Review the resolved dependency and its transitive dependencies before deployment, including lifecycle scripts and package ownership history.
  5. Install with lifecycle scripts disabled where they are unnecessary, for example using npm ci --ignore-scripts.
  6. Store credentials outside node_modules in a dedicated secret store or protected configuration path with least-privilege file permissions.
  7. Grant the Feishu application only the minimum permissions required, rotate credentials after suspected dependency compromise, and monitor application API activity.
  8. Add automated dependency integrity, vulnerability, and provenance checks to the release process.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documentation instructs the user to supply Feishu App ID, App Secret, and a target chat ID, but it does not clearly warn that the skill will use those credentials to send content to an external messaging platform. This creates a real transparency and consent issue: users may provide sensitive credentials or enable outbound data flows without understanding that chat content, summaries, or metadata could be transmitted to Feishu.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill activates only for the hard-coded Chinese phrases '今日文献' and '刷新文献'. This creates a language-specific access constraint without any visible user opt-in, fallback, or documentation in this file explaining that the skill is intentionally limited to a Chinese locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest exposes its user-facing commands only in Chinese (e.g. "今日文献", "刷新文献") and does not provide an alternative language option or opt-in. This can violate language/locale policy because the skill effectively forces a specific language for invocation and understanding without documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The natural-language interface is defined only with Chinese trigger phrases (今日文献, 刷新文献) and the surrounding instructions are also Chinese, with no indication of alternative language support or user choice. Under the stated policy, forcing a specific language without opt-in is a locale/language policy concern.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
89% confidence
Finding

The dependency uses a caret range (^0.1.0), which allows automatic installation of future compatible versions within the 0.x range semantics. This increases supply-chain risk because a compromised or maliciously updated upstream package version could be pulled in without explicit review, especially since this skill’s behavior depends almost entirely on that external package.

Content

Scanner excerpt · package.json (reported line 8)May include surrounding context.

json
"main": "dist/index.js",
  "type": "module",
  "dependencies": {
    "openclaw-paperdaily": "^0.1.0"
  }
}

Static analysis

No suspicious patterns detected.