Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its AI news briefing purpose, but it includes unsafe networking, over-privileged scheduling guidance, and a helper that can send report content to a hard-coded DingTalk group.
Install only if you are comfortable with a Chinese-focused AI news aggregator that contacts external feeds and APIs. Do not use the DingTalk push helper until the destination is configurable and verified. Avoid the root systemd setup; prefer manual runs or user-level scheduling. Remove the curl-to-bash pyenv step, keep API keys out of shell startup files when possible, and fix TLS verification before using Tavily or other authenticated network calls on untrusted networks.
INSTALL.md:210Unverified Remote Installer Is Piped Directly Into a Shell
scripts/ai_daily.py:258TLS Certificate Verification Is Disabled for All Application Requests
scripts/push-to-dingtalk.sh:5Generated Report Content Is Sent to a Hard-Coded DingTalk Group
INSTALL.md:133Installation Guide Creates a Root-Managed Persistent systemd Timer
Piping a remote script from https://pyenv.run directly into a shell executes network-fetched code without prior inspection, signature verification, or integrity pinning. This is dangerous because compromise of the remote host, transit path, DNS, or installer content can lead to immediate arbitrary code execution on the user's machine.
sudo apt install python3.8
curl https://pyenv.run | bash pyenv install 3.8.10 pyenv global 3.8.10
The | bash construct turns downloaded content directly into executed shell commands, a classic command-chaining anti-pattern. In installation documentation, this materially increases risk because users are encouraged to run opaque remote code with no validation step, making arbitrary execution trivial if the source is malicious or compromised.
sudo apt install python3.8
curl https://pyenv.run | bash pyenv install 3.8.10 pyenv global 3.8.10
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
The skill is described primarily as fetching and generating a daily brief, but it also exposes a 'view' command for reading previously generated local Markdown files from an output directory. That is a real description-behavior mismatch: undeclared local file access broadens the skill's capability surface and may let users retrieve local content beyond what they expect from a 'generate brief' skill.
The skill is described primarily as fetching and generating a daily brief, but it also exposes a 'view' command for reading previously generated local Markdown files from an output directory. That is a real description-behavior mismatch: undeclared local file access broadens the skill's capability surface and may let users retrieve local content beyond what they expect from a 'generate brief' skill.
The code disables TLS certificate validation globally for outbound requests by setting check_hostname to False and verify_mode to ssl.CERT_NONE. This allows a man-in-the-middle attacker to intercept or alter RSS feeds, search API responses, article content, and arXiv data, potentially poisoning the generated report or stealing API-backed request contents.
The changelog repeatedly describes automatic generation of "中文摘要" for multiple content types, which indicates a fixed language behavior. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is documented and justified.
The text says the skill will "自动生成简洁中文说明," which implies the skill outputs content in Chinese by default. There is no accompanying note that this is region-specific, optional, or configurable, so it appears to impose a locale without user choice.
The report explicitly describes external data sources and API keys, but does not clearly warn users that content, queries, and possibly fetched material will be sent to third-party services. In a skill that aggregates news and uses LLM processing, this omission can mislead users about privacy, data handling, network activity, and cost exposure.
The guide tells users to place API keys in shell startup files, which stores secrets in plaintext and causes them to be automatically loaded into future shell sessions. This increases exposure through local file disclosure, accidental backup/sync, shell debugging, inherited environments, or leakage into child processes and logs.
The cron example establishes recurring execution, which is a persistence mechanism. In a skill that fetches external content and runs scripts regularly, persistence raises risk because any later compromise of the script, config, or dependencies will be repeatedly executed automatically.
crontab -e
# 添加每日 8:00 执行
0 8 * * * cd /home/admin/.openclaw/workspace/skills/ai-daily && bash scripts/generate.sh >> /var/log/ai-daily.log 2>&1
The instructions create system-wide systemd units under /etc/systemd/system using sudo, which modifies privileged persistence mechanisms. Even if intended for convenience, this teaches users to install scheduled execution with elevated configuration scope without warning about the trust and persistence implications.
This command requires sudo to write a system service definition into a privileged directory, enabling persistent execution at the system level. In skill-install documentation, normalizing privileged setup increases the blast radius if the referenced script is later modified, replaced, or behaves unexpectedly.
# 创建 service
sudo tee /etc/systemd/system/ai-daily.service > /dev/null <<EOF
[Unit]
Description=AI Daily Report Generator
This second sudo tee writes a timer unit into /etc/systemd/system, creating another privileged persistence mechanism. It expands the attack surface by scheduling code execution through system-managed startup without emphasizing review and least privilege.
EOF
# 创建 timer
sudo tee /etc/systemd/system/ai-daily.timer > /dev/null <<EOF
[Unit]
Description=Run AI Daily every day at 8:00
sudo systemctl enable ai-daily.timer persists execution across reboots and user sessions at system scope. In the context of a downloadable skill, enabling persistence with elevated privileges can be abused if the underlying script, its dependencies, or fetched content are compromised later.
EOF
sudo systemctl enable ai-daily.timer sudo systemctl start ai-daily.timer
systemctl enable explicitly configures persistence, causing the timer to survive reboots. This is more sensitive in a content-aggregation skill because it will continue executing unattended and may process attacker-controlled external inputs over time.
EOF
sudo systemctl enable ai-daily.timer sudo systemctl start ai-daily.timer
Starting the timer with sudo systemctl start activates the privileged persistent task immediately. While not inherently malicious, it operationalizes elevated scheduled execution in a way that can magnify the impact of future script changes or compromise.
sudo systemctl enable ai-daily.timer sudo systemctl start ai-daily.timer
## 📊 输出示例
This markdown explicitly describes optimizing the output to increase Chinese media dominance, including prioritizing zh-CN sources and making them occupy most top results. The file does not indicate any user choice, opt-in, or region-specific justification for this language/locale bias, which conflicts with the policy against forcing a specific language or locale.
The embedded configuration sets the added sources' language to "zh-CN" and the surrounding text frames the change as a general optimization rather than a user-selected option. Because the file presents this as a default behavior and does not offer an alternative locale path, it constitutes a natural-language locale policy concern.
The document explicitly boosts Chinese-language keywords and specific Chinese media sources in ranking, which creates a baked-in source and language bias without any indication of user preference, transparency, or override controls. In a news-summarization skill, this can systematically skew what users see, suppress alternative high-quality sources, and misrepresent coverage as objective selection.
The reported output distribution shows 100% dominance by a single Chinese source, normalizing a highly concentrated and non-user-driven editorial bias. In the context of an AI daily briefing skill, this makes the generated report less trustworthy and more susceptible to information narrowing, agenda shaping, and omission of relevant perspectives from other reputable sources.
The README says the tool generates a structured Chinese briefing, and the rest of the documentation presents Chinese output as the fixed behavior. There is no indication that users can opt into another language or that the Chinese-only constraint is required for a documented region-specific use case.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# 编辑 crontab
crontab -e
# 添加每日 8:00 执行
0 8 * * * cd /home/admin/.openclaw/workspace/skills/ai-daily && bash scripts/generate.sh >> /var/log/ai-daily.log 2>&1
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# 编辑 crontab
crontab -e
# 添加每日 8:00 执行
0 8 * * * cd /home/admin/.openclaw/workspace/skills/ai-daily && bash scripts/generate.sh >> /var/log/ai-daily.log 2>&1
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
启用：
sudo systemctl enable ai-daily.timer
sudo systemctl start ai-daily.timer
No suspicious patterns detected.