Security audit

huo15-openclaw-office-doc

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a document generator, but it also includes under-disclosed credential, network, and persistent agent-configuration behavior that should be reviewed before installation.

Review this skill before installing. Use explicit --company-name and --logo-path or --no-odoo if you do not want it reading OpenClaw Odoo credentials or making network calls. Do not run generate-config.sh unless you intentionally want it to create OpenClaw profile, workspace, and memory files. Treat the bundled contracts and deployment docs as drafts only: replace real-looking company details, remove default credentials, and get legal/security review before using them externally.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises document generation but declares no permissions while describing capabilities that imply filesystem access, shell execution, environment access, and network use. This creates a transparency and consent problem: users or orchestrators may invoke it expecting a narrow formatting tool, while it can read/write local state and contact remote services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented purpose is document generation, but the described behavior extends to Odoo network access, remote logo retrieval, persistent local metadata storage, and even creation of unrelated agent workspace/config files. This mismatch is dangerous because it expands the attack surface far beyond user expectations, enabling data exfiltration, persistence, and unauthorized workspace modification under the cover of a benign document tool.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The script is presented as a local company info tool, but it silently reads separate OpenClaw/Odoo credential files and contacts an external Odoo service to populate data. That expands trust boundaries, may surprise users, and can disclose internal usage patterns or fetch untrusted remote content without clear user consent.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The script generates broad agent persona, workspace behavior, memory, and operational policy files far beyond the advertised scope of office document generation. This expands the skill into general-purpose assistant reconfiguration, increasing the chance of unintended autonomy, policy drift, and persistence of sensitive context in environments that only expected document output.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script provisions persistent memory directories and files and instructs the agent to use them, which is unjustified for a document-generation skill. In this context, persistent memory creates a standing repository of user and conversation data that can later be accessed, leaked, or misused by the agent or other skills.

Description-Behavior Mismatch

Low

Confidence: 92% confidence
Finding: This template hard-codes a real company name, representative name, address, and phone number inside what is marketed as a reusable enterprise document generator. In a copyable template, embedded real-world identifiers can cause accidental disclosure, misuse, or propagation of inaccurate legal/contact information when users reuse the contract without fully sanitizing it.

Vague Triggers

High

Confidence: 93% confidence
Finding: The trigger phrases are extremely broad common-language requests like writing documents, PDFs, reports, or contracts. In an agent ecosystem, this can cause unintended invocation on ordinary user requests, giving this skill opportunities to perform broader filesystem or network actions than the user intended.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: Generic aliases such as '文档生成', 'Word生成', and 'PDF生成' are likely to collide with many benign user requests and with other document tools. This increases the chance that the wrong skill is selected and that users unknowingly authorize broader behavior than expected.

Vague Triggers

High

Confidence: 94% confidence
Finding: The dedicated trigger list enumerates many ambiguous phrases covering common enterprise writing tasks without requiring explicit opt-in. Because the skill also includes nontrivial local-state and network-related behavior, accidental activation materially increases the risk of unintended file changes, external requests, or persistence actions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The helper can silently make outbound network requests and download a logo file without user-facing notice, even though it appears to be a local metadata tool. In a skill/agent context, undisclosed network access is risky because it can leak environment-specific behavior, create audit gaps, and import remote content into local workflows unexpectedly.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script begins ingesting questionnaire data and then writes multiple identity, profile, and memory files without any clear upfront notice that personal data will be persisted. That creates a privacy and consent problem because users may supply name, company, role, projects, and tools without realizing this information will be stored in long-lived local files.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The clause allows Party A to use Party B's business data for product evolution after 'desensitization,' but it does not define anonymization standards, legal basis for processing, scope limitations, security controls, retention, or whether affected users/customers must be notified or consent obtained where required. In the context of an education AI product handling learner and institutional data, this ambiguity can lead to unlawful secondary use of data, privacy violations, and regulatory or contractual exposure.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The deployment guide instructs operators to create a database user with a hardcoded placeholder password and later validates the deployment using a default application credential (`admin/admin`) without any explicit warning to change or disable it. In a deployment document, normalizing default or weak credentials materially increases the chance that a real system is brought up with guessable access, enabling unauthorized administrative access or database compromise.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The generated SOUL.md instructs the agent to write important conversation information into persistent memory after every chat. This creates a natural-language data retention risk because sensitive personal, business, or project information may be copied into durable files automatically, increasing exposure and making later exfiltration or accidental disclosure more likely.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.insecure_tls_verification

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/doc_core.py:1611

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/company-info.py:94