Security audit

Daily Tongjian

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent daily-history lecture assistant that stores local reading progress and generated replay media, with no evidence of deception, exfiltration, or destructive behavior.

Before installing, know that this skill keeps a local reading-history file and, by default, may create text, image, and audio copies in a shared OpenClaw outbound media folder for replay. Use its status/reset controls or delete those files if you do not want long-term local history or replay artifacts.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code implements only progress persistence and simple state management for a 'daily-tongjian' workflow. It reads/writes a local JSON file under ~/.openclaw/workspace/daily-tongjian/progress.json and supports status, advance, set, reset, and set-language operations. The declared description promises a much broader skill: daily reading of Zizhi Tongjian with automatic progression plus default generation of complete lecture text, images, and audio narration. None of those content-generation or delivery capabilities appear in the supplied code. Auto-tracked progress is represented, but the primary behavior of this code chunk is narrower than the declared purpose, making the description materially inaccurate for the supplied code.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README says image and voice generation are default features but omits any warning that these may rely on external generation or TTS services. Users may unknowingly cause lecture content or prompts to be transmitted to third parties, creating privacy, retention, and compliance risks depending on the platform configuration.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The README advertises automatic progress tracking and advancement without warning users that the skill persists reading state. Silent state changes can surprise users, create unwanted behavioral profiles, and make it harder to distinguish previewing content from intentionally updating long-term progress.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger `通鉴` is a short, generic term relative to the skill domain and the README does not provide context limits or exclusion conditions for when it should activate. This creates ambiguity about whether ordinary mentions of the term should invoke the skill.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger `tongjian` is a bare keyword without surrounding context, making activation conditions unclear and increasing the chance of unintended invocation when the term appears in normal discussion. The README does not narrow usage to a command format or specific interaction context.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 81% confidence
Finding: The skill instructs reading from local reference files and writing persistent progress state, but it does not declare any explicit tool scope or permissions boundary. That increases the chance the runtime grants broader-than-necessary file access or that users cannot clearly assess what local resources the skill may touch.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: Broad triggers such as generic mentions of '通鉴' or 'tongjian' can cause accidental activation during ordinary conversation. Unintended invocation matters here because the skill performs persistent state updates and may generate or store outputs without the user meaning to start the workflow.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill persistently writes progress data to a local file but does not present a user-facing notice or consent mechanism about local storage. Even if the data seems low sensitivity, silent persistence can surprise users, create profiling/history records, and normalize hidden state changes across sessions.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The skill directs copying generated text, audio, and images into a shared outbound media library for consumption by another skill. Cross-skill storage in a shared directory expands the trust boundary and can expose outputs to unintended indexing, replay, or access by other automations without a clear user consent step.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs saving lecture text, audio, and copied images into a replay library without a clear privacy or retention warning. Storing generated media in a shared replay location can preserve user-associated content longer than expected and make it discoverable by other features or skills.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The manifest description states in Chinese that the skill '默认交付完整讲稿、配图与语音' ('by default delivers full lecture text, images, and voice narration'), and the overall skill framing is explicitly Chinese-language. This indicates a default language/locale behavior without offering a user choice or documenting opt-in, which can violate language/locale policy requirements.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: The instruction says the default should be a long-form Chinese script unless the user asks for something shorter. This imposes a language default without indicating user choice or opt-in, which matches the policy concern for forced language or locale behavior.

Static analysis

No suspicious patterns detected.