安全决策报告
news-briefing
Undeclared shell execution and command injection risk with user-supplied topics flowing into execSync, despite transparent documentation in skill-card.md that acknowledges these risks.
最直接的威胁证据
高危 代码执行
Command injection via user-supplied --topic The --topic argument (user-controlled) is interpolated directly into a shell command string passed to execSync. An attacker controlling the topic could inject arbitrary shell commands. This is partially mitigated by the tool being a personal briefing tool rather than a multi-tenant service, but the risk is real.
scripts/fetch-news.mjs:55 为什么得出这个结论
2/4 个维度触发 阻止
声明与实际能力
发现 2 项声明之外的能力或越权行为。
复核
隐藏执行与外联
提取到 9 个一般风险产物，需要结合上下文判断。
阻止
攻击链与高危发现
报告包含 0 步攻击链，另有 3 项高危或严重发现。
复核
依赖与供应链卫生
没有完整依赖信息，供应链判断需要保留弹性。
风险分是怎么被拉高的
Command injection +25
User-supplied --topic flows into execSync shell string in fetch-news.mjs
Undeclared shell:WRITE +15
SKILL.md declares network:READ only, but execSync used in 3 of 4 scripts without mention
API keys in process args +10
Bearer tokens and secrets appear in curl command lines, visible in process listings
Temp file writes with hardcoded paths +5
gen-cover.mjs writes to /tmp/gen-cover.js and references internal OpenClaw paths
Positive: documented risks +-10
skill-card.md explicitly lists all three risk categories and recommends mitigations
Positive: native fetch used +-5
send-card.mjs correctly uses native fetch for Feishu API
最关键的证据
高危 代码执行
Command injection via user-supplied --topic
The --topic argument (user-controlled) is interpolated directly into a shell command string passed to execSync. An attacker controlling the topic could inject arbitrary shell commands. This is partially mitigated by the tool being a personal briefing tool rather than a multi-tenant service, but the risk is real.
scripts/fetch-news.mjs:55 Replace execSync+curl with native fetch() or use execFile with array arguments to avoid shell interpretation.
高危 文档欺骗
Undeclared shell:WRITE capability
SKILL.md declares only network:READ (via WebFetch) but all scripts use execSync for shell execution. Shell:WRITE is a significantly more powerful and dangerous permission than declared.
scripts/fetch-news.mjs, scripts/news-digest.mjs:55 Document shell execution explicitly in SKILL.md or migrate to native fetch/execFile.
高危 凭证窃取
API keys visible in process argument list
Bearer tokens (PERPLEXITY_API_KEY, PPIO_API_KEY, FEISHU_APP_SECRET) are passed as curl command-line arguments, making them visible to anyone who can read /proc/<pid>/cmdline. This enables credential theft via local privilege escalation.
scripts/fetch-news.mjs:55 Use native fetch() with Authorization header set programmatically, not via CLI args.
中危 代码执行
Dynamic code execution via execSync
gen-cover.mjs constructs a JS code string and executes it via execSync with hardcoded internal paths, plus writes to /tmp/gen-cover.js.
scripts/gen-cover.mjs:10 Prefer direct Node.js module imports or spawn with script files rather than eval-style execution.
低危 敏感访问
Hardcoded internal OpenClaw paths
gen-cover.mjs references absolute internal paths like /root/.openclaw/workspace/skills/news-briefing/ and pnpm global store paths. This leaks internal infrastructure topology.
scripts/gen-cover.mjs:6 Use environment-aware or relative paths instead of hardcoded absolute paths.
声明能力 vs 实际能力
命令执行 阻止
声明 NONE
→ 推断 WRITE
fetch-news.mjs:55 curl via execSync; news-digest.mjs:72 node via execSync; send-card uses native fetch (compliant) 网络访问 通过
声明 READ
→ 推断 READ
Perplexity API, PPIO API, Feishu API all declared in SKILL.md environment variables 文件系统 阻止
声明 NONE
→ 推断 WRITE
gen-cover.mjs:10 writeFileSync('/tmp/gen-cover.js'); fetch-news.mjs:10 writeFileSync for optional output-file 环境变量 通过
声明 NONE
→ 推断 READ
API keys read from process.env for shell injection 可疑产物与外联
中危 外部 URL
https://openclaw.ai SKILL.md:138
中危 外部 URL
https://clawhub.com/u/derekhsu529 SKILL.md:138
中危 外部 URL
https://api.perplexity.ai/chat/completions scripts/fetch-news.mjs:65
中危 外部 URL
https://api.ppinfra.com/v3/openai/chat/completions scripts/fetch-news.mjs:122
中危 外部 URL
https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal scripts/send-card.mjs:35
中危 外部 URL
https://www.google.com/search?q=$ scripts/send-card.mjs:84
中危 外部 URL
https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id scripts/send-card.mjs:140
中危 外部 URL
https://clawhub.ai/user/derekhsu529 skill-card.md:7
中危 外部 URL
https://clawhub.ai/derekhsu529/news-briefing skill-card.md:28
依赖与供应链
没有结构化依赖告警。
文件构成
7 个文件 · 912 行
JavaScript 4 个文件 · 723 行Markdown 2 个文件 · 184 行JSON 1 个文件 · 5 行
需关注文件 · 5
scripts/fetch-news.mjs Command injection via user-supplied --topic · API keys visible in process argument list · https://api.perplexity.ai/chat/completions · https://api.ppinfra.com/v3/openai/chat/completions
scripts/gen-cover.mjs Dynamic code execution via execSync · Hardcoded internal OpenClaw paths
scripts/send-card.mjs https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal · https://www.google.com/search?q=$ · https://open.feishu.cn/open-apis/im/v1/messages?receive_id_type=open_id
SKILL.md https://openclaw.ai · https://clawhub.com/u/derekhsu529
skill-card.md https://clawhub.ai/user/derekhsu529 · https://clawhub.ai/derekhsu529/news-briefing
其他文件 · news-digest.mjs · _meta.json
安全亮点
skill-card.md explicitly documents all three risk categories (command injection, credential exposure, third-party API) with mitigations — highest-quality transparency signal
send-card.mjs correctly uses native fetch() for Feishu API, showing the skill author knows how to avoid shell execution
No base64-encoded payloads, no reverse shells, no C2 infrastructure, no exfiltration endpoints
No access to ~/.ssh, ~/.aws, .env or other sensitive credential paths beyond declared API keys
Credential usage is scoped to legitimate news delivery APIs (Perplexity, PPIO, Feishu) with no data exfiltration to unknown endpoints