Security audit

Daily Tongjian

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent daily history-reading assistant that saves reading progress and generated media locally, with no evidence of deception, exfiltration, or destructive behavior.

Install this if you want a persistent daily Tongjian lecture workflow. Be aware that it may update your reading progress and save generated lecture text, images, and audio under ~/.openclaw, including a shared outbound media folder used for replay. Use more explicit prompts like "今日通鉴" or "继续读通鉴" to avoid accidental progress changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill explicitly instructs reading local reference files and writing progress plus replay artifacts to user-local directories, yet it declares no permissions. That mismatch matters because it hides real filesystem capabilities from the platform/user and can lead to unauthorized persistence or broader-than-expected data access if the runtime relies on declared permissions for review or enforcement.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill stores generated text, audio, and copied images into a shared outbound library for another skill to consume. Cross-skill persistence increases the data exposure surface, creates implicit data sharing between components, and may allow other tools/users of that shared directory to access content the user did not realize would be retained and indexed.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger phrase "通鉴" is a common shorthand for the book title and can easily appear in ordinary discussion, quotes, or user requests that do not intend to invoke this skill. Because the skill performs side effects such as generating content and advancing stored progress, accidental activation could cause unintended state changes and unnecessary output generation.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The English trigger "tongjian" is highly generic in the context of this skill and may match casual references, transliterations, or mixed-language discussion rather than a deliberate request to run the workflow. In this skill, unintended activation is more risky because the default behavior includes full content generation and progress advancement, not just a passive lookup.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README advertises auto-tracked progress and later describes advancing progress as part of the default flow, but it does not warn users that invoking the skill may modify stored state. This can lead to silent or surprising progress changes, especially if the skill is accidentally triggered through broad phrases, making the state mutation harder for users to detect or correct.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: Triggers such as '通鉴' and especially 'tongjian' are broad enough to match ordinary conversation, increasing the chance of accidental activation. Unintended invocation can cause unsolicited file writes, progress changes, or media generation without clear user intent.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill instructs writing lecture text, audio, and images to the local filesystem without an explicit user-facing warning or consent for persistence. Silent retention is risky because it can expose reading history, generated content, and metadata to other local tools or users, especially when stored in a shared outbound directory for indexing.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.