msteams china adapter

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:27 AM UTC
• Version: 10.0.2

Overview

The skill appears intended to support Microsoft Teams China, but it rewrites installed OpenClaw program files, changes persistent system settings, and can restart services automatically without enough guardrails.

Review before installing. Use this only on a confirmed Microsoft Teams China/21Vianet OpenClaw host, preferably after backing up the OpenClaw and @openclaw/msteams installations and current environment settings. Run read-only diagnosis first, avoid scheduled auto-fix until you have tested the exact package versions, and be prepared to restore package files and remove CLOUD/SERVICE_URL registry or shell-profile changes if the patch is misapplied.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/patch_all_v10.cjs:83

Finding

Non-atomic broad rewriting of installed executable bundles

Content

View full analysis

Vulnerability Details

File Location: scripts/patch_all_v10.cjs:83-138, 198-217; scripts/apply_patch.cjs:73, 222-231
Vulnerability Type: Unsafe in-place modification of installed application code
Risk Level: High

Vulnerable Code

javascript

function writeCore(fn, c) { fs.writeFileSync(path.join(DIST, fn), c); }

for (const [from, to] of globalRepl) {
  for (const f of coreFiles) {
    let c = readCore(f);
    if (c.includes(to)) continue;
    if (c.includes(from)) {
      c = c.split(from).join(to);
      writeCore(f, c);
      p2++;
    }
  }
}

function writePlugin(fn, c) {
  fs.writeFileSync(path.join(PLUGIN_DIST, fn), c);
}

if (graphContent.includes('https://login.microsoftonline.com/')) {
  graphContent = graphContent.replaceAll(
    'https://login.microsoftonline.com/',
    'https://login.chinacloudapi.cn/'
  );
  ok('MSAL login endpoints');
  p3++;
}

if (graphContent.includes('sts.windows.net')) {
  graphContent = graphContent.replaceAll(
    'sts.windows.net',
    'sts.chinacloudapi.cn'
  );
  ok('STS issuers');
  p3++;
}

if (oauthContent.includes('https://login.microsoftonline.com/')) {
  oauthContent = oauthContent.replaceAll(
    'https://login.microsoftonline.com/',
    'https://login.chinacloudapi.cn/'
  );
  writePlugin(oauthFile, oauthContent);
  ok('OAuth token endpoints');
  p4++;
}

The legacy patcher uses the same unsafe model:

javascript

function writeFileContent(filename, content) {
  fs.writeFileSync(path.join(OPENCLAW_DIST, filename), content);
}

if (content.includes(repl.from)) {
  content = content.split(repl.from).join(repl.to);
  writeFileContent(file, content);
  patchedFiles++;
}

Technical Analysis

The scripts directly overwrite executable JavaScript bundles inside installed OpenClaw and MSTeams packages. Several changes use unrestricted string replacement across complete compiled files.

The implementation does not:

• Verify an exact supported package version before mutation ...[truncated 2365 chars]

Remediation

View remediation

Remediation Suggestions

1. Enforce an explicit allowlist of exact OpenClaw and MSTeams package versions.
2. Verify cryptographic hashes of every target file before applying a patch.
3. Refuse to patch unknown or modified bundles.
4. Create permission-preserving backups before any modification.
5. Write patched content to a temporary file in the same directory, validate it, and atomically rename it into place.
6. Parse source structure or use exact, context-aware patches instead of unrestricted string replacement.
7. Confirm that every expected replacement occurs exactly once unless a different count is explicitly expected.
8. Run JavaScript syntax validation and comprehensive endpoint-policy verification before committing changes.
9. Treat the operation as a transaction: if any phase fails, restore every changed file.
10. Provide a documented rollback command and retain a manifest containing original hashes, patched hashes, and backup locations.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/auto_detect.cjs:224

Finding

Patch failures are recorded as successful upgrades and followed by a gateway restart

Content

View full analysis

Vulnerability Details

File Location: scripts/auto_detect.cjs:224-253
Vulnerability Type: Fail-open update state handling
Risk Level: High

Vulnerable Code

javascript

try {
  const patchOutput = execSync(`node "${patchScriptPath}"`, {
    encoding: 'utf8',
    timeout: 120000,
    stdio: 'pipe',
  });
  console.log(patchOutput);

  if (patchOutput.includes('SUCCESS') &&
      patchOutput.includes('All verifications passed')) {
    ok('Patch applied successfully!');
  } else {
    warn('Patch may have issues. Check output above.');
  }
} catch (e) {
  fail(`Patch execution failed: ${e.message}`);
  warn('Continuing with version save and restart attempt...');
}

// Step 5: Saving version state
info('Step 5: Saving version state...');
saveCurrentVersion(currentVersion);

// Step 6: Auto-restarting Gateway
info('Step 6: Auto-restarting Gateway...');
const wasRunning = isGatewayRunning();
info(`Gateway was ${wasRunning ? 'running' : 'not running'}`);

const restartOk = restartGateway();

Technical Analysis

The automation catches patch execution failures but deliberately continues. It then records the current OpenClaw version in ~/.openclaw/.msteams-china-version and restarts the gateway.

The same unsafe continuation occurs when the patch command exits successfully but its output does not contain the expected success markers: the script only prints a warning and proceeds.

Because future runs compare the installed version with the saved state, storing the version after a failed patch suppresses automatic retry:

javascript

if (storedVersion === currentVersion) {
  ok(`Version unchanged (${storedVersion}). No patch needed.`);
  info('Auto-fix skipped. Version matches stored state.');
  process.exit(0);
}

This creates a persistent false-success state. It is especially dangerous because the patcher performs immediate, non-transactional writes and may fail after modifying only part of the installation.

Attack Pa

...[truncated 1487 chars]

Remediation

View remediation

Remediation Suggestions

1. Exit immediately with a nonzero status if patch execution throws an exception.
2. Treat missing success and verification markers as a hard failure rather than a warning.
3. Save the new version only after:
   • Every patch phase succeeds.
   • Syntax and integrity checks pass.
   • The gateway restarts successfully.
   • A post-restart health check succeeds.
4. Restore all modified files from backups when patching or verification fails.
5. Store separate state values such as detectedVersion, successfullyPatchedVersion, and lastFailure.
6. Allow failed versions to be retried, with bounded backoff to avoid restart loops.
7. Do not restart a previously stopped gateway automatically.
8. Add a dry-run mode and require explicit approval before applying an incompatible-version patch.
9. Record a transaction manifest so operators can identify and reverse partial modifications.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/patch_all_v10.cjs:275

Finding

Persistent machine-wide environment changes and recurring self-modification exceed least privilege

Content

View full analysis

Vulnerability Details

File Location: scripts/patch_all_v10.cjs:275-288; SKILL.md:216-236
Vulnerability Type: Overprivileged persistent configuration modification
Risk Level: Medium

Vulnerable Code

javascript

const curCloud =
  process.env.CLOUD ||
  execSync('reg query HKCU\\Environment /v CLOUD 2>nul', {
    encoding: 'utf8'
  }).trim() ||
  '';

const curServiceUrl = process.env.SERVICE_URL || '';

if (curCloud.toLowerCase() !== 'china') {
  const isWin = os.platform() === 'win32';
  if (isWin) {
    execSync(
      'reg add HKCU\\Environment /v CLOUD /t REG_SZ /d china /f',
      { stdio: 'pipe' }
    );
    execSync(
      'reg add HKCU\\Environment /v SERVICE_URL /t REG_SZ /d "https://smba.trafficmanager.cn/teams" /f',
      { stdio: 'pipe' }
    );

    try {
      execSync(
        'reg add HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment /v CLOUD /t REG_SZ /d china /f',
        { stdio: 'pipe' }
      );
    } catch (e) {}

    try {
      execSync(
        'reg add HKLM\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Environment /v SERVICE_URL /t REG_SZ /d "https://smba.trafficmanager.cn/teams" /f',
        { stdio: 'pipe' }
      );
    } catch (e) {}
  } else {
    execSync(
      'echo "export CLOUD=china" >> ~/.bashrc',
      { stdio: 'pipe' }
    );
    execSync(
      'echo "export SERVICE_URL=https://smba.trafficmanager.cn/teams" >> ~/.bashrc',
      { stdio: 'pipe' }
    );
  }
}

The Skill also recommends recurring execution:

bash

openclaw cron add --name "msteams-china-auto-detect" \
  --schedule '{"kind":"cron","expr":"0 * * * *","tz":"Asia/Shanghai"}' \
  --payload '{"kind":"agentTurn","message":"Run MSTeams China auto-detection: node <SKILL_DIR>/scripts/auto_detect.cjs","lightContext":true}' \
  --delivery '{"mode":"none"}'

Technical Analysis

The patcher persists generic environment variables at user or machine scope:

• HKCU\Environment affects the curren ...[truncated 2927 chars]

Remediation

View remediation

Remediation Suggestions

1. Configure CLOUD and SERVICE_URL only in the OpenClaw gateway service environment.
2. Do not modify HKLM, HKCU, or shell startup files by default.
3. If persistent configuration is necessary, request explicit user approval and clearly identify the target scope.
4. Use application-specific namespaced settings rather than generic variables where supported.
5. Detect and update an existing managed configuration block instead of repeatedly appending lines to .bashrc.
6. Provide complete uninstall and rollback procedures for:
   • HKCU values.
   • HKLM values.
   • Shell-profile entries.
   • Cron or heartbeat tasks.
   • Version-state files.
7. Default recurring automation to notification-only mode.
8. Require interactive confirmation before patching executable bundles or restarting the gateway.
9. Restrict automated patching to exact, cryptographically verified package versions.
10. Preserve whether the gateway was originally running and never start a previously stopped service without approval.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (65)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CHANGELOG.md (reported line 3)May include surrounding context.

md

# Changelog

All notable changes to the MSTeams China Patch skill will be documented in this file.

## [10.1.0] - 2026-05-06

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code aligns with only a narrow subset of the description: static diagnosis of whether OpenClaw dist files contain China-specific versus global endpoint strings. It inspects filesystem paths, runs version/npm-root commands, and reports findings. The declared purpose, however, promises a much broader and more active skill: complete diagnosis, repair, verification, automatic version-upgrade detection, and one-click remediation across several specific Teams/AAD/JWT/SSRF/Graph/message-delivery failure modes. None of those capabilities are implemented in this code chunk. While recommending a separate apply_patch.js script is consistent with a larger patching workflow, this supplied code itself does not perform the claimed repair or validation behaviors. Therefore the description materially overstates the actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The description promises a complete diagnose-fix-verify workflow for many operational scenarios, including automatic detection of version changes and one-click remediation. The actual code only performs static verification of whether expected China endpoints and allowlist strings exist in OpenClaw dist files. It reads local filesystem contents but does not patch files, restart services, contact Teams/Graph endpoints, inspect actual webhook/JWT failures, or auto-fix anything. Because the primary purpose of this code chunk is narrower than the declared full remediation skill, this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The skill is explicitly designed to patch OpenClaw core and plugin dist files, inject configuration into runtime code, and persist system-level environment changes. Self-modifying or host-modifying behavior is high risk because it alters installed software outside normal package/update controls, can break integrity guarantees, and creates a durable persistence/change surface that may be hard to audit or roll back.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

description: "Patch OpenClaw to support Microsoft Teams China (世纪互联/21Vianet). 触发场景: (1) msteams webhook 401/AADSTS90002/AADSTS500011 错误; (2) JWT 验证失败/SigningKeyNotFoundError; (3) Teams 中国区首次配置; (4) OpenClaw 版本升级后 Teams 不工作; (5) 用户报告 Teams bot 无响应; (6) SSRF Blocked hostname 错误 (Blocked hostname (not in allowlist)); (7) Graph API 请求被安全策略阻止; (8) Teams bot 收到消息但无法回复 (sent-message state failed); (9) 版本升级自动检测与修复。此技能执行完整的诊断、修复、验证流程，支持自动检测版本变更并一键自动修复，输出标准化报告。"
---

# MSTeams China Patch Skill v10

> 修复 OpenClaw 以支持 Microsoft Teams 中国版 (世纪互联/21Vianet)
> 支持 **自动检测** OpenClaw 版本升级 → 自动执行 6 阶段修复 → 自动重启 Gateway

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

The skill includes a destructive shell command (rm ~/.openclaw/.msteams-china-version) as part of its operating instructions. Even though limited to a version-tracking file, recommending raw deletion commands without safeguards can enable accidental misuse, path confusion, or normalization into broader unsafe command execution patterns in automation contexts.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

2026.5.4

手动重置（下次运行会重新记录版本，不执行修复）

rm ~/.openclaw/.msteams-china-version

text

---

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 477)May include surrounding context.

md

| **v10.1** | 2026-05-06 | **自动检测**: 新增 `scripts/auto_detect.cjs`、版本跟踪系统、自动修复 + 自动重启 Gateway + 会话保留 |

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/workflow.md (reported line 169)May include surrounding context.

vironment /v CLOUD /t REG_SZ /d china /f reg add HKCU\Environment /v SERVICE_URL /t REG_SZ /d "https://smba.trafficmanager.cn/teams" /f reg add HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment /v CLOUD /t REG_SZ /d china /f reg add HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment /v SERVICE_URL /t REG_SZ /d "https://smba.trafficmanager.cn/teams" /f

Linux/macOS

echo "export CLOUD=china" >> ~/.bashrc echo "export SERVICE_URL=https://smba.trafficmanager.cn/teams" >> ~/.bashrc

text

**环境变量优先级**: `options.cloud` > `process.env.CLOUD` > 默认 `PUBLIC`
- 代码注入的 `cloud: sdk.CHINA` 拥有最高优先级
- 环境变量作为双重保障（当 SDK 内部 `cloudFromName` 起作用时）

---

### 阶段 3: 重启 Gateway

```bash
openclaw gateway restart

验证:

bash

openclaw gateway status
openclaw logs --limit 50 | grep msteams

---

阶段 4: 验证

1. 在 Teams 中发送测试消息
2. 检查日志确认：
   • `

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/patch_all_v10.cjs (reported line 287)May include surrounding context.

js

vironment /v CLOUD /t REG_SZ /d china /f
reg add HKCU\Environment /v SERVICE_URL /t REG_SZ /d "https://smba.trafficmanager.cn/teams" /f
reg add HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment /v CLOUD /t REG_SZ /d china /f
reg add HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment /v SERVICE_URL /t REG_SZ /d "https://smba.trafficmanager.cn/teams" /f

# Linux/macOS
echo "export CLOUD=china" >> ~/.bashrc
echo "export SERVICE_URL=https://smba.trafficmanager.cn/teams" >> ~/.bashrc
```

**环境变量优先级**: `options.cloud` > `process.env.CLOUD` > 默认 `PUBLIC`
- 代码注入的 `cloud: sdk.CHINA` 拥有最高优先级
- 环境变量作为双重保障（当 SDK 内部 `cloudFromName` 起作用时）

---

### 阶段 3: 重启 Gateway

```bash
openclaw gateway restart
```

**验证**:
```bash
openclaw gateway status
openclaw logs --limit 50 | grep msteams
```

---

### 阶段 4: 验证

1. 在 Teams 中发送测试消息
2. 检查日志确认：
   - `

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script persistently changes HKCU/HKLM environment variables on Windows and appends exports to ~/.bashrc on Unix without prior confirmation. This alters future sessions and can have cross-application effects; writing HKLM is especially sensitive because it attempts system-wide persistence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The changelog explicitly states the skill can automatically execute repairs and restart the OpenClaw gateway, which are state-changing operations with availability and session impact. Documenting such behavior without clear user-consent, rollback, or warning language increases the risk of unintended disruption when the skill is invoked or upgraded.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The changelog describes automatic injection of China-specific cloud configuration and persistent environment-variable changes, but does not indicate a verified locale check or user approval. Forcing cloud/endpoint settings can misroute traffic, break non-China deployments, or create persistent configuration drift that is difficult to detect and undo.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README promotes an automated patch script that modifies installed OpenClaw and plugin dist files and sets system/user environment variables, but it does not clearly warn users that it is making persistent system-level changes. In a security-sensitive agent skill, undocumented binary/script patching and config mutation increase the risk of breaking trust boundaries, obscuring rollback needs, and normalizing unsafe modification of installed software.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill describes reading and setting environment variables (CLOUD, SERVICE_URL) and relies on scripts with system-modifying behavior, but it declares no explicit tool scope or permission boundaries. This is dangerous because consumers and execution frameworks cannot clearly constrain or review the skill's access before it inspects or changes host configuration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill promotes automatic repair and automatic Gateway restart but does not present a prominent safety confirmation, rollback guidance, or clear warning about service interruption and unintended host modification. In an operational environment, this can cause unreviewed changes to production files and trigger outages or loss of availability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file instructs users to run a one-click repair script and restart the gateway, while earlier text states the repair includes modifying system registry or bashrc settings. The document does not provide a clear warning that these actions change local/system configuration and may affect service availability or require backup/verification before proceeding.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The troubleshooting guide instructs users to run automated repair scripts that modify installed package files and restart the gateway, but it does not clearly warn that these are system-changing actions. In a security-sensitive operations context, undocumented automated mutation of runtime files and services increases the risk of accidental disruption, unsafe execution, and reduced operator scrutiny.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This command persistently writes the CLOUD environment variable into the current user's registry environment hive, creating a lasting configuration change outside the current troubleshooting session. Persistent environment changes can alter future application behavior and are risky when documentation does not clearly justify permanence, scope, or rollback.

Content

Scanner excerpt · TROUBLESHOOTING.md (reported line 237)May include surrounding context.

powershell

# Windows (Admin recommended)
reg add HKCU\Environment /v CLOUD /t REG_SZ /d china /f
reg add HKCU\Environment /v SERVICE_URL /t REG_SZ /d "https://smba.trafficmanager.cn/teams" /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v CLOUD /t REG_SZ /d china /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v SERVICE_URL /t REG_SZ /d "https://smba.trafficmanager.cn/teams" /f

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This command persistently stores SERVICE_URL in the user environment via the registry, affecting future executions beyond the immediate repair flow. Because service endpoint variables influence outbound communications, making them persistent without strong warnings or rollback guidance can cause misrouting, policy bypass assumptions, or hard-to-diagnose behavior later.

Content

Scanner excerpt · TROUBLESHOOTING.md (reported line 238)May include surrounding context.

powershell

# Windows (Admin recommended)
reg add HKCU\Environment /v CLOUD /t REG_SZ /d china /f
reg add HKCU\Environment /v SERVICE_URL /t REG_SZ /d "https://smba.trafficmanager.cn/teams" /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v CLOUD /t REG_SZ /d china /f
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v SERVICE_URL /t REG_SZ /d "https://smba.trafficmanager.cn/teams" /f

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

This command writes CLOUD into the machine-wide HKLM environment, requiring elevated privileges and affecting all users and processes on the host. System-wide persistent configuration changes materially increase blast radius and can unintentionally change behavior of unrelated workloads or future administrative sessions.

Content

Scanner excerpt · TROUBLESHOOTING.md (reported line 239)May include surrounding context.

Windows (Admin recommended)

reg add HKCU\Environment /v CLOUD /t REG_SZ /d china /f reg add HKCU\Environment /v SERVICE_URL /t REG_SZ /d "https://smba.trafficmanager.cn/teams" /f reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v CLOUD /t REG_SZ /d china /f reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v SERVICE_URL /t REG_SZ /d "https://smba.trafficmanager.cn/teams" /f

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

This command persists a machine-wide SERVICE_URL endpoint in HKLM, altering outbound service targeting for all users and potentially all compatible processes on the system. Because endpoint configuration directly affects where authentication and messaging traffic is sent, documenting a global registry modification without strict guardrails is dangerous in enterprise environments.

Content

Scanner excerpt · TROUBLESHOOTING.md (reported line 240)May include surrounding context.

reg add HKCU\Environment /v CLOUD /t REG_SZ /d china /f reg add HKCU\Environment /v SERVICE_URL /t REG_SZ /d "https://smba.trafficmanager.cn/teams" /f reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v CLOUD /t REG_SZ /d china /f reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v SERVICE_URL /t REG_SZ /d "https://smba.trafficmanager.cn/teams" /f

text

---

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger phrase at line 43 is broad enough to match ordinary troubleshooting or operational discussion, which can cause the skill to activate outside the user's clear intent. In a skill with patching, auto-fix, environment changes, and restart capabilities, accidental activation materially increases the chance of unauthorized or disruptive modifications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrase at line 44 is ambiguous and overly generic, making unintended activation likely during normal support conversations. Because this skill performs diagnosis, patching, verification, and automatic remediation, ambiguity in activation can turn routine text into configuration changes or restarts without sufficiently explicit operator consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Version-change and auto-upgrade detection triggers are insufficiently specific for a skill that can auto-fix and auto-restart, creating a path for automated execution based on loosely interpreted lifecycle events. In this context, an imprecise trigger is more dangerous than in a read-only skill because it can cause repeated or unsanctioned patching after upgrades, potentially weakening SSRF protections or altering production behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The checklist hardcodes China-cloud endpoints and environment settings as the expected correct state, without an explicit eligibility check, operator opt-in, or guardrail verifying that the deployment actually belongs in the 21Vianet/China cloud. If followed in the wrong environment, this could misroute authentication and messaging traffic, break integrations, or push a production bot onto incorrect regional endpoints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The checklist directs operators to modify runtime environment configuration and restart the gateway, but it does not include explicit safeguards such as backup instructions, rollback steps, maintenance-window guidance, or warning about service interruption. In an operational skill, this can cause unintended downtime, configuration drift, or breakage if applied to the wrong host or tenant.

Content

No source excerpt is available for this finding.