T09 · Insecure Skill Coding Practices
Warning
- Location
config.yaml:16- Finding
Plaintext Credential Storage in Configuration Template
- Content
View full analysis
- Remediation
View remediation
Security audit
111
Security checks for vulnerabilities and agentic risk
Overview
This skill appears to generate A-share market reports as advertised, but it asks users to store several credentials in plaintext and has unclear automatic persistence behavior.
Review this skill before installing. Do not put broker, data-provider, email, or webhook credentials into the YAML file unless you understand where that file will be stored and backed up; prefer environment variables or a local secret manager. Check for any cron job before running it, and be aware that generated financial reports are saved under ~/.openclaw/workspace/reports by default.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrase "分析市场" is broad and likely to appear in ordinary conversation about finance, which can cause accidental invocation of the skill. Because the skill is designed to generate trading analysis and may kick off downstream automated behavior, unintended activation could confuse users or trigger unwanted actions at the wrong time.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Using the single word "Marcus" as a trigger is highly ambiguous because it can refer to a person's name in normal dialogue. This increases the chance of unintended skill activation whenever a user mentions Marcus casually, which is especially risky in an agent setting where activation may lead to automated analysis or task execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill states that a Tushare token is embedded, which implies a credential is stored inside the skill or its runtime environment. Even if the literal token is not shown in this file, documenting embedded credentials without warning or secure-handling guidance normalizes insecure secret management and increases the risk of credential leakage, unauthorized API use, or downstream compromise if logs, code, or configs are exposed.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
This manifest-style config embeds all user-facing instructions and labels in Chinese, including setup steps and operational guidance. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the restriction is explicitly justified or alternatives are offered.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file's natural-language interface, title, and execution description are entirely in Chinese and targeted specifically at A-share users, with no indication that other languages are supported or that the user can choose a locale. Under the policy rule, forcing a specific language without opt-in is a natural-language policy concern.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script exposes an optional
-o/--outputpath but unconditionally also writes a second copy of the generated report to~/.openclaw/workspace/reportsviasave_report(). This can violate user expectations, leak potentially sensitive financial analysis or configuration-derived content into a fixed location, and create unauthorized persistence on shared or managed systems.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The package description is written entirely in Chinese and specifically frames the skill as an 'A股' analysis agent, which suggests a language/locale assumption without any indication that users can choose another language. Under the policy, language or locale constraints should be opt-in or clearly justified.
- Content