ClawHub
Back to skill

Security audit

谛听.skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed ScoutX digest tool that stores preferences locally, fetches public feeds, and can set up scheduled OpenClaw delivery when explicitly applied.

Before installing, confirm you trust the bundled feed endpoints and only use configure-service or feed URL overrides as an operator. Use preview or the install-openclaw-cron dry run first, and only run --apply when the schedule and delivery target are correct. Do not provide API tokens or credentials; the skill does not need them for normal use.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
results = []
    for job in jobs:
        completed = subprocess.run(
            job["args"],
            check=False,
            capture_output=True,
Confidence
87% confidence
Finding
This code executes externally constructed OpenClaw CLI commands that embed user-controllable fields such as job name, agent, session, channel, target, and script path. Although shell injection is avoided by passing a list, the skill still performs privileged side effects—installing scheduled jobs and delivery routes—well beyond a passive briefing skill, enabling persistence or unwanted message routing if invoked with attacker-influenced inputs.

Tainted flow: 'request' from os.getenv (line 1036, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
)

    try:
        with urllib.request.urlopen(request, timeout=timeout) as response:
            raw = response.read().decode("utf-8")
    except urllib.error.HTTPError as exc:
        body = exc.read().decode("utf-8", errors="replace")
Confidence
92% confidence
Finding
Feed URLs are taken from environment variables or local configuration and fetched without any allowlist or host restriction, so an attacker who can influence runtime environment or config can force the skill to make arbitrary outbound requests. In an agent environment this becomes SSRF-style behavior, potentially reaching internal services, cloud metadata endpoints, or attacker-controlled hosts and then processing the returned data.

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill claims to provide personalized briefings, but it also installs and modifies OpenClaw cron jobs for scheduled delivery. That hidden expansion of capability creates persistence and autonomous behavior not justified by the stated purpose, making misuse materially more dangerous in an agent ecosystem.

Context-Inappropriate Capability

High
Confidence
96% confidence
Finding
The skill executes external OpenClaw CLI commands to enumerate, delete, and install cron jobs, which is a privileged host-side capability unrelated to merely preparing a digest. In context, this makes the skill capable of changing agent runtime behavior and persistence, so the mismatch between description and actual power is security-significant.

Static analysis

No suspicious patterns detected.