Security audit
Security checks for vulnerabilities and agentic risk
The skill is a real review coach, but it uses broad private data access, external model calls, and unaudited installation patching that users should review before installing.
Install only after an admin reviews the external GitHub installer and OpenClaw patch at a pinned commit, confirms OpenRouter data handling is acceptable for confidential drafts, restricts use to isolated Feishu/WeCom workspaces, and disables or tightly scopes delivery, purge, and legacy credential behaviors.
scripts/scan.py:40Confidential review material is transmitted to OpenRouter without explicit disclosure or data minimization
scripts/qa-step.py:237Unrestricted session paths permit cross-workspace file access and modification
POST_INSTALL.md:10Installation instructions retrieve mutable remote code and execute a host-wide OpenClaw patch
The troubleshooting guidance tells an operator to run a wildcarded rm -f against session files, which is a destructive action that can erase agent history and context with no confirmation or backup step. In this skill's context, those JSONL sessions may contain operational state and possibly sensitive review data, so broad deletion can cause data loss and incident-response blind spots even if the command is intended as maintenance.
## Troubleshooting
- **`replies=0` on dispatch_complete** → subagent's `message` tool call has wrong `target`. Check the subagent's jsonl for bare open_ids. Our SOUL.md forbids this but older sessions may have cached. Clear: `rm -f ~/.openclaw/agents/feishu-ou_*/sessions/*.jsonl` then re-test.
- **Subagent replies with "Hey I just came online, who am I?"** → the feishu-seed patch didn't land. Run step 1 again and confirm `grep "review-agent local patch" /opt/homebrew/lib/node_modules/openclaw/dist/monitor-D9C3Olkl.js` returns a line.
- **"Thinking Process:" shows up in Lark replies** → SOUL.md didn't load. Check `~/.openclaw/workspace-feishu-<open_id>/SOUL.md` exists and contains "不要填 target 字段".
- **Each DM triggers a new `creating dynamic agent` log line** → harmless. openclaw re-spawns per-message due to an internal consistency quirk. The cp -R seed is idempotent; your workspace data is preserved.
This finding highlights undeclared operational scope: attachment/URL ingestion, local session storage, external OCR/PDF/audio tooling, and optional third-party access are materially broader than a simple chat review description suggests. In a non-isolated main-agent deployment, such hidden resource use can expose user content, increase attack surface through parsers and shell tools, and make unsafe access paths easier to trigger unexpectedly.
This finding highlights undeclared operational scope: attachment/URL ingestion, local session storage, external OCR/PDF/audio tooling, and optional third-party access are materially broader than a simple chat review description suggests. In a non-isolated main-agent deployment, such hidden resource use can expose user content, increase attack surface through parsers and shell tools, and make unsafe access paths easier to trigger unexpectedly.
This finding highlights undeclared operational scope: attachment/URL ingestion, local session storage, external OCR/PDF/audio tooling, and optional third-party access are materially broader than a simple chat review description suggests. In a non-isolated main-agent deployment, such hidden resource use can expose user content, increase attack surface through parsers and shell tools, and make unsafe access paths easier to trigger unexpectedly.
This finding highlights undeclared operational scope: attachment/URL ingestion, local session storage, external OCR/PDF/audio tooling, and optional third-party access are materially broader than a simple chat review description suggests. In a non-isolated main-agent deployment, such hidden resource use can expose user content, increase attack surface through parsers and shell tools, and make unsafe access paths easier to trigger unexpectedly.
This finding highlights undeclared operational scope: attachment/URL ingestion, local session storage, external OCR/PDF/audio tooling, and optional third-party access are materially broader than a simple chat review description suggests. In a non-isolated main-agent deployment, such hidden resource use can expose user content, increase attack surface through parsers and shell tools, and make unsafe access paths easier to trigger unexpectedly.
This finding highlights undeclared operational scope: attachment/URL ingestion, local session storage, external OCR/PDF/audio tooling, and optional third-party access are materially broader than a simple chat review description suggests. In a non-isolated main-agent deployment, such hidden resource use can expose user content, increase attack surface through parsers and shell tools, and make unsafe access paths easier to trigger unexpectedly.
The persona states the agent's core value is to challenge the requester and that it 'cannot write answers for them.' Later, the same reference defines a document merge stage that can generate final/revised.md and even directly edit Lark or Google Docs, which goes beyond critique into drafting/editing work the documentation says it should not do.
The 'do not' section explicitly bans phrases like 'I’ll help you rewrite it' and says findings must point out problems rather than do the homework. However, later sections require 'specific modification suggestions (verb + replacement text)' and even prescribe messages like 'Original X → change to Y,' which is an active contradiction in the documented intent.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
### `lark_dm`
- Uses `~/bin/lark_send` (or the in-repo `scripts/send-lark.sh` if not installed globally)
- Sends: a text/post message + (attempt) file — if file upload fails (app missing `im:resource:upload`), inline as `post` rich text with linked summary
- Reads tenant access token via openclaw `feishu` config
### `local_path`
- Simple file copy
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
def _strip_line_comments(s: str) -> str:
# Remove // ... line comments, but only when NOT inside a string.
# Simple heuristic: track string state.
out = []
i, n = 0, len(s)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Centralizes lookups that v1 hardcoded for hermes:
- load_openrouter_key() — v1 read ~/.hermes/.env; v2 reads openclaw.json
(~/.openclaw/openclaw.json → models.providers.openrouter.apiKey) with
.env fallback for transitional setups.
- resolve_responder(workspace) — v1 walked ~/.review-agent/users/<oid>/...;
v2 reads the current workspace's owner.json / USER.md.
- workspace_root() — the peer workspace root. Defaults to cwd (where the
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Centralizes lookups that v1 hardcoded for hermes:
- load_openrouter_key() — v1 read ~/.hermes/.env; v2 reads openclaw.json
(~/.openclaw/openclaw.json → models.providers.openrouter.apiKey) with
.env fallback for transitional setups.
- resolve_responder(workspace) — v1 walked ~/.review-agent/users/<oid>/...;
v2 reads the current workspace's owner.json / USER.md.
- workspace_root() — the peer workspace root. Defaults to cwd (where the
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Centralizes lookups that v1 hardcoded for hermes:
- load_openrouter_key() — v1 read ~/.hermes/.env; v2 reads openclaw.json
(~/.openclaw/openclaw.json → models.providers.openrouter.apiKey) with
.env fallback for transitional setups.
- resolve_responder(workspace) — v1 walked ~/.review-agent/users/<oid>/...;
v2 reads the current workspace's owner.json / USER.md.
- workspace_root() — the peer workspace root. Defaults to cwd (where the
The code reads a legacy ~/.hermes/.env file from the user's home directory and extracts OPENROUTER_API_KEY. While this is likely intended as backward-compatible configuration loading, it expands the trust boundary by consuming secrets from an additional file outside the current workspace, which can inadvertently use sensitive credentials in broader channel contexts where the skill runs in the main agent rather than a per-peer isolated subagent.
except Exception:
pass
# Legacy .hermes/.env
hermes_env = Path.home() / ".hermes" / ".env"
if hermes_env.exists():
for line in hermes_env.read_text().splitlines():
This code opens and parses ~/.hermes/.env to recover an API key, which is a form of local credential access. In this skill's context, the risk is elevated because the agent may operate without per-peer isolation on some channels, so loading host-level credentials from the operator's home directory can unintentionally expose privileged account usage across conversations or environments if other parts of the skill misuse the loaded key.
pass
# Legacy .hermes/.env
hermes_env = Path.home() / ".hermes" / ".env"
if hermes_env.exists():
for line in hermes_env.read_text().splitlines():
if line.startswith("OPENROUTER_API_KEY="):
This markdown file documents an operation that deletes all peer data and labels it as irreversible, but it does not provide a stronger user warning about backup/recovery implications or an explicit caution before execution. For destructive admin actions affecting user data, the skill description should include a clear warning so operators understand the impact before running the command.
The troubleshooting guidance tells the operator to verify SOUL.md contains the Chinese phrase "不要填 target 字段," indicating a fixed-language requirement embedded in the skill's behavior or prompts. Because the file does not offer a language choice or explain why Chinese is required, this appears to be a locale/language policy violation.
The skill declares significant capabilities and operational behavior involving shell execution, filesystem access, network access, and environment/config usage, but does not define an explicit tool/permission scope. In an agent framework, missing least-privilege boundaries increases the chance that the runtime grants broader access than required, enabling accidental or unauthorized file reads, writes, command execution, or outbound communication.
Triggering on any attachment is overly broad for a skill that can ingest files, invoke external parsers, and create persistent session artifacts. This can cause unintended processing of sensitive or malicious files, accidental activation in unrelated conversations, and unnecessary exposure to risky file formats or URLs.
The rule that any non-exit reply in an active session should invoke the skill is ambiguous and can capture unrelated user messages. In channels without per-peer isolation, this increases the risk of cross-context processing, accidental disclosure within the wrong session, or unauthorized progression of a workflow based on stray messages.
Earlier guidance says each finding must be a question or a gap-filling instruction and not written as doing the work for the requester. The later Q&A mappings prescribe direct imperative rewrites such as changing the ask to a specific phrasing and adding fixed background content, which conflicts with the stated questioning-only discipline.
The workflow allows the agent to directly edit Lark or Google Drive documents, which materially expands its write capability beyond advisory review. In channels where the skill may run without strict per-peer isolation, a mis-scoped session, prompt confusion, or authorization mistake could cause unauthorized modification of third-party documents or corruption of business records.
This markdown file contains natural-language policy-relevant guidance showing a required delivery style example in Chinese ("前 3 行没说要什么。建议改成 X。") while the rest of the document is in English. Because no user opt-in, language selection mechanism, or justification for a Chinese-only locale is provided, this can force a specific language unexpectedly.
The documentation defines automatic delivery of review outputs to third parties such as a boss, email recipients, and local archives, which materially expands the skill from private coaching into data exfiltration and surveillance of user-submitted drafts and conversations. In this skill context, the risk is elevated because users may reasonably expect confidential pre-meeting coaching, while summaries, finals, conversations, annotations, and dissent can be routed externally on close.
No suspicious patterns detected.