T08 · Insecure Dependencies
Warning
- Location
SKILL.md:29- Finding
Unpinned Global Package Installation in Restoration Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
Openclaw Zh
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a Chinese localization helper for OpenClaw, but it modifies globally installed application files and includes a broad unpinned reinstall command that users should review carefully.
Install only if you intentionally want this skill to patch a global OpenClaw installation. Prefer running the script in `--dry-run` first, use its `--restore` backup mechanism instead of reinstalling `openclaw@latest`, and avoid elevated privileges unless the OpenClaw install path truly requires them.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (10)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `translations/control-ui-zh.json` - Control UI 中文翻译映射
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `translations/control-ui-zh.json` - Control UI 中文翻译映射
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill instructs users to run a local Python script and directly edit installed application files, which implies file read/write capabilities, but it does not declare any explicit tool scope or permissions. Undeclared file-modifying behavior increases the risk of overbroad access, unintended file changes, and weak reviewability because operators cannot easily tell what paths the skill is expected to touch.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger conditions are broad and ambiguous, including generic phrases like '汉化', '中文界面', and '需要汉化 OpenClaw 组件', which can cause the skill to activate in situations where the user did not intend system file modification. In this context, unintended invocation is more dangerous because the skill's documented behavior includes changing installed UI assets under system-level paths.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation tells users to modify files under '/usr/lib/node_modules/openclaw/...', including running a translation script and directly editing 'options.html', but it does not prominently warn that these are installed system/application files whose integrity can be affected. This can lead to accidental tampering, broken upgrades, permission issues, or persistence of unsafe modifications in globally installed software.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language documentation entirely in Chinese and describes the script specifically as a Chinese translation tool, while also presenting user-facing output in Chinese. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy violation unless a justified region-specific constraint is documented, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This translation file defines the entire interface in Chinese and does not include any natural-language indication that the language is optional, selectable, or limited to a zh locale context. Under the stated policy, forcing a specific language without user opt-in is a natural-language locale policy concern unless the locale constraint is clearly documented and justified.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
json "Copy failed": "复制失败", "Copy session name": "复制会话名称", "Cost": "成本", "Create or overwrite files": "创建或覆盖文件", "Cron": "定时任务", "Cron expression required.": "需要 Cron 表达式。", "Cron Jobs": "定时任务",
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The file describes the skill as translating the OpenClaw UI into Chinese and presents Chinese localization as the default behavior, without offering a language choice or stating that this is an explicit user-selected locale option. This can conflict with language/locale policy expectations when a skill forces a specific language absent opt-in language selection.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This HTML document declares zh-CN and all visible UI text is Chinese, which imposes a specific language/locale on users. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified, neither of which appears in this file.
- Content
Static analysis
No suspicious patterns detected.