Security audit
Security checks for vulnerabilities and agentic risk
This skill appears to do what it says: fetch Weibo trends, summarize them locally, and write them to Obsidian, with scheduled runs only as an explicit option.
Install only if you want a Windows-specific Weibo-to-Obsidian automation that writes under C:\Users\Intel and appends to your Obsidian vault. Review env.ps1 and any SUMMARIZE_BIN, NOTESMD_BIN, or OPENCLAW_BIN values before running, because those settings control local programs the skill executes. Enable install-crons only if you want recurring background runs every 5 and 10 minutes.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
last_err = None
for attempt in range(MAX_RETRIES):
try:
response = requests.get(API_URL, headers=headers, timeout=10)
response.raise_for_status()
data = response.json()
The skill description claims behavior such as local summarization, Obsidian note updates, and optional recurring automation, but the analysis indicates those behaviors are absent while other fixed local state handling exists. This kind of mismatch is security-relevant because users and reviewers may approve the skill based on inaccurate expectations, allowing hidden or undocumented behavior to evade scrutiny.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
if VAULT_NAME: cmd.extend(["--vault", VAULT_NAME])
# Build env with APPDATA set for notesmd-cli
env = os.environ.copy()
env["APPDATA"] = r"C:\Users\Intel\AppData\Roaming"
env["USERPROFILE"] = r"C:\Users\Intel"
env["HOME"] = r"C:\Users\Intel"
The skill declares no explicit tool scope even though its documented behavior includes shell execution, network access, environment loading, and local file writes. This weakens least-privilege controls and makes it harder for a caller or platform to constrain the skill if the runner script is modified, compromised, or behaves unexpectedly.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
env["HOME"] = r"C:\Users\Intel"
try:
r = subprocess.run(cmd, capture_output=True, text=True, timeout=30,
encoding="utf-8", errors="replace", env=env)
if r.returncode != 0:
print(f"[notesmd] CLI error (code {r.returncode}): {(r.stderr or '')[:500]}", file=sys.stderr)
The executable path comes from NOTESMD_BIN, which is sourced from environment variables and then executed via subprocess.run. If an attacker can influence the environment in which this skill runs, they can point NOTESMD_BIN to an arbitrary binary and gain code execution under the agent's privileges.
env["HOME"] = r"C:\Users\Intel"
try:
r = subprocess.run(cmd, capture_output=True, text=True, timeout=30,
encoding="utf-8", errors="replace", env=env)
if r.returncode != 0:
print(f"[notesmd] CLI error (code {r.returncode}): {(r.stderr or '')[:500]}", file=sys.stderr)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
script_path = Path(__file__).resolve().parent / script_name
cmd = [python_executable(), str(script_path), *args]
print(f"[runner] exec: {' '.join(cmd)}")
completed = subprocess.run(cmd)
return completed.returncode
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def openclaw_run(*args: str) -> subprocess.CompletedProcess:
cmd = [resolve_openclaw_bin(), *args]
print(f"[runner] exec: {' '.join(cmd)}")
return subprocess.run(cmd)
def install_crons() -> int:
The skill can install persistent scheduled tasks that repeatedly execute local scripts, which expands its capability from a one-time utility into ongoing autonomous execution. Even if intended for convenience, persistence increases risk because a user may not fully understand that the skill will continue running and can repeatedly process or write data after the initial invocation.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
"weibo-trendnote-aipc-obsidian-flush-10m",
]
for name in stale_names:
subprocess.run([oc, "cron", "remove", "--name", name], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
result1 = openclaw_run(
"cron", "add",
The subprocess command hard-codes --lang zh, which imposes a specific language on the generated summary. The file does not offer a user-selectable language option or explain a justified region-specific constraint, so this appears to violate the language/locale policy criteria.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
print(f"[summarize] Running: {' '.join(cmd)}")
print(f"[summarize] SUMMARIZE_BIN = {SUMMARIZE_BIN}")
try:
r = subprocess.run(cmd, capture_output=True, text=True,
timeout=SUMMARIZE_TIMEOUT, encoding="utf-8", errors="replace")
if r.returncode == 0 and r.stdout.strip():
return r.stdout.strip()
The executable path comes from the SUMMARIZE_BIN environment variable and is passed directly to subprocess.run. Any attacker who can influence the environment or the env.ps1 loaded by the runner can replace the summarizer with an arbitrary program, leading to code execution under the privileges of this skill.
print(f"[summarize] Running: {' '.join(cmd)}")
print(f"[summarize] SUMMARIZE_BIN = {SUMMARIZE_BIN}")
try:
r = subprocess.run(cmd, capture_output=True, text=True,
timeout=SUMMARIZE_TIMEOUT, encoding="utf-8", errors="replace")
if r.returncode == 0 and r.stdout.strip():
return r.stdout.strip()
No suspicious patterns detected.