ClawHub
Back to skill

Security audit

OpenClaw RD Pipeline

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Feishu R&D workflow guide with a small local status validator; it asks for meaningful repo and Feishu authority, but that authority fits its stated purpose.

Install only if you intend to let the agent act across your Feishu project and repository workflow. Use scoped Feishu and git credentials, confirm the owner and project mapping first, review what historical/wiki context is copied into PRs or notifications, and clean up tmux sessions/worktrees after the run if your environment requires it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The skill claims to orchestrate end-to-end Feishu R&D delivery, including subagents, code changes, PR flow, review, testing, and owner notification, but the actual file only provides procedural instructions plus references to local files/scripts. This mismatch is dangerous because users may trust the skill with sensitive workflow decisions under false assumptions about what is implemented, audited, and enforced, causing security gates to be skipped or performed manually without visibility.

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill describes repository access, loading local reference files, and running a local validation script, but it does not declare an explicit tool scope such as allowed-tools or permissions. That creates an authorization and review gap: operators and policy layers cannot clearly constrain file access to the minimum required set, increasing the chance of unintended repository or local-file access during execution.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill instructs the agent to query Feishu history/wiki and to propagate message, task, and repository context into prompts, tasks, PR descriptions, and notifications, but the description lacks a clear user warning about that data collection and onward sharing. In a collaboration environment, this can expose sensitive internal discussions, identifiers, or repository metadata more broadly than the requester expects.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The final notification template is written entirely in Chinese, which implicitly directs subagents to produce owner-facing output in a specific language. The file does not indicate that this is optional, user-selected, or justified as a region-specific requirement, so it conflicts with the language/locale policy for natural-language content.

Natural-Language Policy Violations

Low
Confidence
92% confidence
Finding
The instructions require specific Chinese statuses and labels such as `待开始`, `进行中`, `已完成`, `编码`, `评审`, and `测试`, but the document does not say the skill is limited to a Chinese-language Feishu workspace or provide an opt-in locale choice. This is a natural-language locale constraint that may violate organizational language/locale policy when used in other environments.

Natural-Language Policy Violations

Low
Confidence
89% confidence
Finding
The mapping rule explicitly requires normalization to the Chinese status set `待开始/进行中/已完成/已阻塞`. Because this markdown file applies that locale-specific terminology as a requirement and does not mention user opt-in or alternative locales, it creates a language/locale policy concern.

Static analysis

No suspicious patterns detected.