T06 · System Persistence
Warning
- Location
SKILL.md:38- Finding
Persistent Scheduled and Boot-Time Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Feishu Cache Guardian
Security checks for vulnerabilities and agentic risk
Overview
This skill is purpose-aligned, but it deserves review because it can persistently modify an installed OpenClaw plugin and restart the Gateway automatically.
Install only if you intentionally want this skill to patch your local OpenClaw Feishu installation. Review the script first, run it manually before adding cron, be prepared for Gateway restarts, and avoid scheduled use unless the skill directory is protected and you have a recovery plan for the modified probe.ts file.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/check-and-fix.js:16- Finding
Unverified In-Place Modification of Installed OpenClaw Source
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Importing and using execSync to restart a service gives the script a broader operational capability than its stated purpose of checking and fixing cache configuration. Even though the command string is static and not obviously injectable here, this still increases the blast radius of running the skill and can enable unintended service interruption when users expect only file inspection or modification.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script performs an operationally significant side effect—restarting the OpenClaw Gateway—while presenting itself primarily as a cache-checking and repair tool. Hidden or underdocumented service restarts can cause unexpected downtime, disrupt active workloads, and make reviewers underestimate the privileges and impact of executing the skill.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The package description is written entirely in Chinese, which imposes a specific language choice in user-facing metadata without indicating any opt-in, alternative locale, or region-specific justification. This can violate language/locale policy when skills are expected to be accessible without forcing one language by default.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The header comment describes only checking and repairing probe.ts cache configuration, omitting that the script also restarts the Gateway. This kind of mismatch is dangerous because operators and code reviewers may approve or run the tool without realizing it can affect service availability, especially in automation contexts.
- Content