ClawHub
Back to skill

Security audit

CNKI Watch

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent CNKI lookup purpose, but it needs Review because it includes under-disclosed automated verification bypass, unsafe credential/session handling, and recurring chat injection behavior.

Install only if you are comfortable giving the skill CNKI session credentials and allowing it to create recurring OpenClaw cron jobs that inject CNKI metadata into chat. Review the CAPTCHA-solving code, disabled TLS validation, gateway-token handling, and unpinned npx guidance before using it with real credentials or persistent sessions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
scripts/cnki-watch.mjs:1331
Finding

Untrusted CNKI Metadata Is Injected into the Main Agent Session

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/cnki-watch.mjs:963
Finding

Gateway Authentication Token Is Exposed Through Process Arguments and Error Messages

Content
View full analysis
{ const child = spawn(command, args, { cwd: options.cwd || process.cwd(), env: options.env || process.env, stdio: ["ignore", "pipe", "pipe"], }); let stdout = ""; let stderr = ""; child.stdout.on("data", (chunk) => { stdout += chunk.toString(); }); child.stderr.on("data", (chunk) => { stderr += chunk.toString(); }); child.on("error", reject); child.on("close", (code) => { if (code === 0) { resolve({ stdout, stderr }); return; } reject(new Error(`${command} ${args.join(" ")} failed (${code}): ${stderr || stdout}`)); }); }); } async function openClawCall(args) { return runCommand("openclaw", args); } async function injectMessage(message, sessionKey = "main", label = "CNKI Watch") { const settings = await loadSettings(); const gatewayArgs = [ "gateway", "call", "--json", "--url", `ws://127.0.0.1:${settings.gateway.port || 18789}`, ]; if (settings.gateway.token) { gatewayArgs.push("--token", settings.gateway.token); } gatewayArgs.push( "--params", JSON.stringify({ sessionKey, message, label }, null, 0), "chat.inject", ); await openClawCall(gatewayArgs); } ``` ### Technical Analysis The OpenClaw gateway token is passed to the `openclaw` child process as a command-line argument. Command-line arguments may be observable through process inspection facilities, monitoring agents, crash reports, or audit logs. The exposure is made more direct by `runCommand`: if the child exits unsuccessfully, the generated exception contains every argument joined into a string, including the value following `--token`. The top-level err ...[truncated 1290 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/cnki-watch.mjs:449
Finding

Browser Disables TLS Certificate Validation for Authenticated CNKI Requests

Content
View full analysis
Remediation
View remediation

other

Warning
Location
scripts/cnki-watch.mjs:660
Finding

Embedded CAPTCHA Solver Circumvents Human-Verification Controls and Contradicts the Skill Contract

Content
View full analysis
Math.round(delta * value), ); for (const step of steps) { await page.mouse.move(startX + step, startY + (Math.random() * 1.6 - 0.8), { steps: 4 }); await page.waitForTimeout(90 + Math.floor(Math.random() * 90)); } await page.mouse.up(); await page.waitForTimeout(2500); if (!page.url().includes("/verify/home")) { return true; } } return false; } ``` ### Technical Analysis The script analyzes CAPTCHA images, estimates the slider gap, and generates randomized mouse movements to imitate a human. This is deliberate circumvention of an access-control and anti-automation mechanism. It also conflicts with the declared behavior in `SKILL.md:28` and `SKILL.md:108`, which says that the skill must stop and request a fresh cookie or manually refreshed session when CAPTCHA or slider verification appears. The implementation instead attempts automated solving up to five times during login, initial navigation, and pagination. This discrepancy prevents operators from relyi ...[truncated 922 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (19)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
node scripts/cnki-watch.mjs --help

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/commands.md (reported line 65)May include surrounding context.

md
Topic lookups must include the paper title and source. Journal lookups should keep the requested journal name visible in either `source` or `matched_query`.

## Authentication and CNKI access

Credential precedence:

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script automates CNKI login and actively attempts to solve slider CAPTCHAs by analyzing page images and simulating mouse movement. That is a deliberate bypass of anti-automation controls, which can violate access restrictions and enables unauthorized scripted use of an authenticated session.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares environment-variable usage for CNKI authentication but does not declare an explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and makes it harder for reviewers and runtime policy to constrain what the skill can access, especially since it handles sensitive cookies and credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The top-level skill description does not clearly warn that subscriptions will periodically push content into the main OpenClaw chat. That can lead to user surprise, inadvertent data propagation, and consent issues because a one-time setup causes ongoing background delivery into a shared or persistent context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill instructs users to provide CNKI_COOKIE or username/password credentials but does not include a privacy and handling warning for these secrets. Because cookies may represent active sessions and credentials can grant account access, insufficient warning increases the chance of insecure storage, oversharing, or accidental disclosure through logs or chat context.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

Canonical entrypoint

Always use the bundled script instead of ad hoc CNKI browsing:

bash
node {baseDir}/scripts/cnki-watch.mjs <command> [flags]

Rp1

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The documentation tells users to run npx cnki-watch without pinning a version, which can fetch and execute whatever package version is current at runtime. This creates a supply-chain execution risk: a compromised, typosquatted, or newly malicious package release could run arbitrary code in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The documentation instructs users to run npx cnki-watch without a pinned version, which can fetch and execute the latest package from the registry at runtime. That creates a supply-chain risk: if the package is compromised, typosquatted, or updated maliciously, arbitrary code could run in the user's environment.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill automatically runs npm install/npm ci with inherited environment variables when playwright-core is missing. Installing dependencies at runtime can execute arbitrary lifecycle scripts from the package tree and introduces supply-chain risk unrelated to a simple CNKI lookup workflow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This is the same underlying issue as the earlier auto-install finding: the script executes npm automatically without an explicit user warning or approval. Silent package installation expands the trust boundary and can trigger unreviewed install scripts, making the skill dangerous in environments that expect passive data retrieval only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The browser context is created with a hard-coded locale: "zh-CN", which forces a specific language/locale regardless of user preference. The policy for this audit flags language or locale constraints unless the skill offers choice or clearly documents a justified region-specific limitation in the file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

This code persists subscription state to runtime/subscriptions.json via fs.writeFile, storing user query subscriptions and run metadata. In this file there is no confirmation prompt or clear disclosure comment/docstring warning that the skill writes persistent local state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The skill reads sensitive authentication material such as CNKI_COOKIE, CNKI_USERNAME, CNKI_PASSWORD, and a gateway token from environment or config values. This file lacks a clear inline warning or explanatory comment notifying users that credentials will be consumed for browser login and gateway access.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/cnki-watch.mjs (reported line 793)May include surrounding context.

js
maxPages = 1,
  exactSource = false,
  preferDateSort = false,
  strictAuth = false,
}) {
  const settings = await loadSettings();
  const cookie = resolveCredential(settings, "CNKI_COOKIE");

Ssd 4

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The cron prompt instructs another agent to run a command exactly once, not ask follow-up questions, and not modify the command. This is prompt-level control designed to suppress safety checks and operator clarification, which becomes risky because it bridges scheduled automation into privileged command execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

Recurring CNKI monitoring can justify scheduling, but this code also directly administers platform cron jobs and includes a manual trigger path for immediate execution. Those host scheduling control capabilities are broader than the manifest's user-facing description of creating subscriptions that periodically push updates into chat.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The defaults hard-code "Asia/Shanghai" and pair it with China-specific schedule handling, which imposes a locale assumption in natural-language-facing behavior. In this file there is no visible user choice, opt-in, or policy justification for forcing that locale as the default.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/cnki-watch.mjs:79

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/cnki-watch.mjs:798