The skill is vulnerable to prompt injection, bypass
Claims to do
文旅素材搜索(API): > **输出格式规范** > > 智能体应先判断客户端类型,再选择对应的输出格式: > > | 客户端类型 | 判定依据 | 输出格式 | > |-----------|---------|---------| > | **桌面端 / Web**(ArkClaw、OpenClaw、浏览器等) | 默认 | HTML 表格(`<table>`、`<img>`、`<video>` 等,仅限 `index.json` 中 `html_output.tags` 声明的标签) | > | **IM 手机应用**(飞书、微信、钉钉、企业微信等) | 用户提到在飞书/微信/钉钉中使用,或上下文/系统信息表明客户端为 IM 应用 | Markdown 表格(`| col |` 语法,图片用 ``,链接用 `[text](url)`) | > > **桌面端 HTML 模式注意事项**: > - 不要将 HTML 放在代码围栏内(围栏内的标签不会被渲染,只会显示源码) > - 不要使用 `<input type="checkbox">`(静态 HTML 环境中无法交互) > - 不要使用 `<button>`(无 JS 运行环境,无法绑定事件) > - 所有媒体 URL(`<img src>`、`<video src>`)须通过下文「安全:媒体来源校验」 > > **IM 手机端 Markdown 模式注意事项**: > - 使用 Markdown 表格语法(`| col |`) > - 缩略图用 `` 或省略(手机屏幕窄时可不显示缩略图列) > - 视频预览无法内嵌,统一用 `[▶ 预览](preview_url)` 链接 > - 不要输出 HTML 标签(手机 IM 不渲染 HTML,会直接显示标签源码) > > **通用规则**: > - 选择操作通过**用户发送文本指令**完成(如「选 1,3」「购买」),智能体重新渲染带状态标记的表格 > - 注:本文档内的 HTML 模板用代码块展示以防文档渲染器误执行;智能体输出给用户时应去掉代码围栏。 > 详见下文「搜索结果展示」。
Actually does
This skill makes POST requests to a configurable API endpoint (defaulting to `https://www.data0086.com/ms-base/home/getList`) to search for cultural tourism materials, sending search parameters in the request body. It processes the JSON response, validates media URLs against a trusted list from `config.json`, and formats the results as an HTML or Markdown table for display. While it handles selection logic and prepares a JSON structure for purchase confirmation, it explicitly states it does not currently call any external trade APIs.
openclaw skills install fengyily/culturetour-skillDeBERTa classifier detected prompt injection (confidence: 0.99)
The agent is instructed to directly embed API response data (e.g., `{title}`, `{id}`, `{resolution}`) into raw HTML templates for display. Without explicit HTML escaping instructions, malicious content within these fields could lead to HTML injection, potentially causing defacement, phishing, or XSS in vulnerable client environments.
智能体输出搜索结果时,**按照以下模板逐行输出 HTML**,将 `{变量}` 替换为真实值.The skill explicitly instructs the agent to proceed with purchase actions and generate transaction requests without requiring any secondary confirmation from the user. This bypasses a critical human-in-the-loop safety mechanism, allowing direct financial actions based solely on a text command.
用户可「购买 1,2」直接下单,无需二次确认。
Upon a purchase command, the agent directly outputs a structured JSON object containing sensitive transaction details (e.g., `commodity_code`, `business_code`, `price`, `video_url`). This data, if logged or intercepted, could expose sensitive financial or product information.
用户发出购买指令后**直接**输出一段**批量交易请求 JSON**
The explicit instruction for the agent to perform purchase actions without secondary confirmation can lead to user approval fatigue. Users may become accustomed to direct actions, increasing the risk of accidental or malicious purchases if they misinterpret a command or are socially engineered.
用户可「购买 1,2」直接下单,无需二次确认。
The skill's stated purpose claims to 'complete' the 'select/purchase' flow. However, the detailed implementation explicitly states that the 'trade API' is 'reserved' and 'currently not called'. The skill only outputs a structured JSON representing a purchase request for debugging/integration, rather than executing an actual purchase.
Skill header: '走通「搜索 → 列表 → 预览(HLS/MP4) → 选择/购买」'. '流程总览' section: '不在此阶段调用交易接口;购买后输出 结构化「批量交易请求」'. '交易 API(预留,暂不调用)' section: '当前默认不执行。'
[](https://mondoo.com/ai-agent-security/skills/clawhub/fengyily/culturetour-skill)<a href="https://mondoo.com/ai-agent-security/skills/clawhub/fengyily/culturetour-skill"><img src="https://mondoo.com/ai-agent-security/api/badge/clawhub/fengyily/culturetour-skill.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/clawhub/fengyily/culturetour-skill.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.