热点检索输出报文

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:24 AM UTC
• Version: 1.0.0

Overview

This scheduled news-push skill is not clearly malicious, but it needs review because it can send recurring messages, expose local credentials during diagnostics, use a hardcoded recipient fallback, and delete bot account state during reset steps.

Review and edit the skill before installing. Require an explicit recipient and schedule, remove the concrete WeChat fallback, avoid printing API keys, avoid manual bearer-token curl diagnostics unless run by an administrator with redaction, and keep bot reset commands out of normal agent instructions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:97

Finding

Search-provider API keys are exposed in command output

Content

View full analysis

Remediation

View remediation

/dev/null ``` A stronger implementation should parse configuration locally and report only whether each required key is present: ```bash if grep -Eq "^TAVILY_API_KEY=.+$" ~/.openclaw/secrets/*.env 2>/dev/null; then printf '%s\n' "Tavily API key is configured" else printf '%s\n' "Tavily API key is not configured" fi ``` Additional hardening measures: - Never print secret values during setup or diagnostics. - Redact existing Agent transcripts and logs that may contain key values. - Rotate any API keys previously displayed through this command. - Restrict secret-file permissions to the owning account. - Ensure shell tracing and verbose diagnostic logging are disabled around secret checks. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:177

Finding

WeChat bot bearer token is exposed through process arguments

Content

View full analysis

.json | python3 -c "import json,sys;print(json.load(sys.stdin)['token'])") # Test: sendMessage curl -s -w "\n[HTTP %{http_code}]" -X POST \ -H "Content-Type: application/json" \ -H "AuthorizationType: ilink_bot_token" \ -H "X-WECHAT-UIN: dGVzdA==" \ -H "Authorization: Bearer $TOKEN" \ -d '{"msg":{"to_user_id":"@im.wechat","client_id":"cli_test","message_type":1,"message_state":2,"item_list":[{"type":1,"text_item":{"text":"test"}}]},"base_info":{"channel_version":"0.6.0","bot_agent":"openclaw/0.6.0"}}' \ https://ilinkai.weixin.qq.com/ilink/bot/sendmessage ``` ### Technical Analysis The diagnostic legitimately sends the bot token to the expected WeChat iLink endpoint; the reviewed material does not establish malicious exfiltration. However, the shell expands `$TOKEN` into the `curl` authorization-header argument. Expanded command-line arguments may be visible to local process inspection, shell tracing, audit frameworks, endpoint-monitoring products, crash diagnostics, or wrappers that log invoked commands. The token also remains in the shell variable after the request unless it is explicitly removed. The token is extracted from a local account credential file. Exposing it through a command argument weakens the protection provided by that file and exceeds the minimum disclosure required to test the endpoint. ### Attack Path 1. The operator runs the documented iLink diagnostic. 2. The command reads the token from the paired bot’s local account file. 3. The shell stores the token in `TOKEN`. 4. The shell expands the complete token into the `curl` command-line arguments. 5. A local process observer, audit logger, tracing facility, or diagnostic collector captures the argument. 6. The ob ...[truncated 555 chars]

Remediation

View remediation

.json" >"$token_file" <<'PY' import json import sys with open(sys.argv[1], encoding="utf-8") as source: print(json.load(source)["token"]) PY curl_config="$(mktemp)" chmod 600 "$curl_config" { printf 'header = "Content-Type: application/json"\n' printf 'header = "AuthorizationType: ilink_bot_token"\n' printf 'header = "X-WECHAT-UIN: dGVzdA=="\n' printf 'header = "Authorization: Bearer %s"\n' "$(cat "$token_file")" } >"$curl_config" curl --config "$curl_config" [remaining request options] rm -f "$curl_config" "$token_file" ``` Where supported, prefer a dedicated client that reads credentials directly from a protected file descriptor or operating-system credential store. Additional hardening measures: - Disable shell tracing before credential operations. - Do not log expanded commands or HTTP authorization headers. - Clear shell variables with `unset TOKEN` immediately after use. - Apply restrictive permissions to account credential files. - Rotate the bot token if it may previously have appeared in process or audit logs. - Limit diagnostics to an explicitly requested troubleshooting mode. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/prompt.md:51

Finding

Concrete WeChat recipient identifier is embedded as a documented fallback

Content

View full analysis

Remediation

View remediation

` | ``` Require an explicit recipient value before prompt rendering or cron creation. For example: ```bash : "${RECIPIENT:?RECIPIENT must be explicitly configured}" ``` Before creating the scheduled task: - Display the selected channel and masked recipient for confirmation. - Require affirmative user approval for the final destination. - Reject unresolved placeholders and empty recipient values. - Do not provide any real account identifier as an example or fallback. - Run a one-time test message and require confirmation before enabling recurring delivery. - Provide instructions for immediately disabling the cron job if the destination is incorrect. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (21)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The skill instructs checking local secret-bearing files and .env locations for API keys as part of normal setup validation. Even without printing values, this normalizes secret discovery and encourages workflows that touch sensitive material unnecessarily, which is risky in agent-accessible or shared environments.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

openclaw channels list

# 搜索工具已配（${SEARCH_PROVIDER} 对应的 API key 已设置）
grep -E "TAVILY_API_KEY|BRAVE_API_KEY" ~/.openclaw/openclaw.json ~/.openclaw/secrets/*.env

# 模型已在 agents.defaults.models 列出
grep "models" ~/.openclaw/openclaw.json

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The skill includes instructions to perform direct scripted network interactions with an external service using credentials sourced from local files. Even though the purpose is diagnostics rather than code download, this is still risky because it bypasses safer abstractions, promotes secret handling in shell commands, and expands the skill’s operational reach beyond news generation.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

根因：iLink AI 后端对 sandbox/test bot 限制严格，配对后约 14 分钟内可正常投递，之后 sendMessage 端点进入"兼容式 stub"模式。

诊断命令（直接 curl 打 iLink AI）：

bash

# 获取 token

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The skill includes instructions to perform direct scripted network interactions with an external service using credentials sourced from local files. Even though the purpose is diagnostics rather than code download, this is still risky because it bypasses safer abstractions, promotes secret handling in shell commands, and expands the skill’s operational reach beyond news generation.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

根因:iLink AI 后端对 sandbox/test bot 限制严格,配对后约 14 分钟内可正常投递,之后 sendMessage 端点进入"兼容式 stub"模式。

诊断命令(直接 curl 打 iLink AI):

bash

# 获取 token

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The skill documents deletion of local account and token files with rm commands. In an agent or semi-automated environment, this is a destructive filesystem action that can revoke access, erase state, or be repurposed if parameters are altered, making it unsafe and outside the expected scope of a content-push skill.

Content

Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.

md

nohup systemctl --user stop openclaw-gateway > /dev/null 2>&1 &

# 2. 删旧 token 文件
rm ~/.openclaw/openclaw-weixin/accounts/<old-bot-id>.json
rm ~/.openclaw/openclaw-weixin/accounts/<old-bot-id>.sync.json
rm ~/.openclaw/openclaw-weixin/accounts/<old-bot-id>.context-tokens.json
echo '[]' > ~/.openclaw/openclaw-weixin/accounts.json

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

This command deletes synchronization/account state files associated with the messaging bot. Such destructive actions are dangerous in skill documentation because they can cause denial of service, data loss, or accidental broader deletion if identifiers are mishandled.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

md

# 2. 删旧 token 文件
rm ~/.openclaw/openclaw-weixin/accounts/<old-bot-id>.json
rm ~/.openclaw/openclaw-weixin/accounts/<old-bot-id>.sync.json
rm ~/.openclaw/openclaw-weixin/accounts/<old-bot-id>.context-tokens.json
echo '[]' > ~/.openclaw/openclaw-weixin/accounts.json

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The command deletes context-token state files for the bot, which is a destructive host action unrelated to the core news workflow. Including repeated raw deletion steps increases the chance of accidental or automated misuse and can disrupt service continuity or erase operational state.

Content

Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.

md

# 2. 删旧 token 文件
rm ~/.openclaw/openclaw-weixin/accounts/<old-bot-id>.json
rm ~/.openclaw/openclaw-weixin/accounts/<old-bot-id>.sync.json
rm ~/.openclaw/openclaw-weixin/accounts/<old-bot-id>.context-tokens.json
echo '[]' > ~/.openclaw/openclaw-weixin/accounts.json

# 3. 启 gateway

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description explicitly states the tool will write Chinese short articles by default, and the operational steps later require Chinese output as well. The file does not present this as a user-selectable language option or justify it as a region-specific constraint, which makes it a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The skill is designed to send scheduled outbound messages using configured recipient and account identifiers, but the description does not foreground this external transmission behavior as a user warning. That can lead to unintended data egress or surprise automated messaging if a user enables the skill without appreciating the delivery side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The step-by-step instructions mandate writing each article as a Chinese short essay. Because no language-selection mechanism or opt-in is provided in the file, this appears to impose a fixed locale on users.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill’s primary purpose is scheduled news retrieval and message delivery, but the documentation additionally instructs operators to extract bot tokens from local account files and invoke the provider API directly with curl. That expands the skill into credential handling and out-of-band channel control, creating unnecessary exposure of secrets and enabling actions outside the intended tool boundary.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The documented curl request sends authenticated requests to an external API using a locally extracted bearer token. In the context of a news-push skill, encouraging direct outbound authenticated traffic outside the normal tool path increases the risk of credential misuse, account abuse, and unintended disclosure through logs, shell history, or copied commands.

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

md

TOKEN=$(cat ~/.openclaw/openclaw-weixin/accounts/<bot-id>.json | python3 -c "import json,sys;print(json.load(sys.stdin)['token'])")

# Test: sendMessage
curl -s -w "\n[HTTP %{http_code}]" -X POST \
  -H "Content-Type: application/json" \
  -H "AuthorizationType: ilink_bot_token" \
  -H "X-WECHAT-UIN: dGVzdA==" \

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documentation goes beyond content generation and delivery into local bot lifecycle administration, including stopping services, deleting account/token files, and re-pairing bots. Embedding host-administration steps inside a content skill increases the chance that an agent or operator performs destructive local actions unrelated to the business function.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 86% confidence

Finding

Using nohup to stop services in a detached manner introduces persistent execution semantics and reduces operator visibility into what is running or has been modified. In a skill context, this is dangerous because it normalizes backgrounded host-level service control unrelated to the skill’s narrow content-delivery purpose.

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

重新配对微信 bot

bash

# 1. 停 gateway（用 nohup 脱钩避免杀掉 exec session）
nohup systemctl --user stop openclaw-gateway > /dev/null 2>&1 &

# 2. 删旧 token 文件

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.

bash

# 1. 停 gateway（用 nohup 脱钩避免杀掉 exec session）
nohup systemctl --user stop openclaw-gateway > /dev/null 2>&1 &

# 2. 删旧 token 文件
rm ~/.openclaw/openclaw-weixin/accounts/<old-bot-id>.json

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The configuration explicitly enables proactive outbound delivery to external recipients and includes recipient/account identifiers, but provides no built-in user warning, consent checkpoint, or privacy guidance about what content may be transmitted. In the context of a scheduled news-push skill, this increases the risk of unintended data disclosure, misdelivery, or silent exfiltration of generated content to third-party channels.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The prompt defines an automated recurring news-push task but does not clearly constrain when it may execute, under what authorization, or what conditions should suppress delivery. In an agent setting, ambiguous triggering can cause unintended autonomous actions, including unsolicited outbound messaging and repeated execution beyond user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instruction explicitly requires writing each article as a Chinese short text, but the file does not provide an option for the user to choose another language or indicate that Chinese is optional. Forcing a specific language without opt-in is a natural-language policy issue under the stated rules.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The template instructs the agent to send content directly to a configured external recipient, including a concrete messaging identifier, without any user confirmation, destination validation, or warning that data leaves the system. This creates a real risk of unauthorized exfiltration, accidental disclosure, or spam if the recipient is misconfigured, stale, or attacker-controlled.

Content

No source excerpt is available for this finding.

Ssd 2

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The prompt explicitly tells the agent to avoid triggering content filters by swapping out topics containing sensitive terms, which is an instruction to route around safety controls rather than comply with them. Even though it does not ask for harmful content generation directly, it normalizes evasion behavior and can be repurposed to suppress important policy checks or hide risky subject matter from downstream review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The markdown sets Asia/Shanghai as the default timezone and repeats that default in the shell setup, which imposes a locale-specific behavior. The file does not explain that this is merely an example, offer an explicit user choice, or justify why a China-specific timezone is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

该文件的标题、说明和示例均以中文呈现，没有提供用户可选择其他语言的选项，也没有说明该技能仅面向中文用户或特定区域。按照语言/locale 政策，强制单一语言且无用户 opt-in 可能构成自然语言层面的策略违规。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.