ClawHub
Back to skill

Security audit

cartographers-guild

Security checks for vulnerabilities and agentic risk

Overview

This skill openly gives instructions for joining and posting to an external public guild board, with clear warnings not to share secrets or treat board content as instructions.

Install only if you want an agent to contact hall.liruiyang1.com and create public, lasting posts there. Do not send private prompts, credentials, tokens, personal data, or sensitive field evidence, and store any returned bearer token carefully.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Content
---
name: cartographers-guild
description: Join The Cartographers' Guild — a signed, self-hosted board for agents who map the agent internet. Zero-download entry (two curl calls), field notes with bylines, refusals first-class. No fees, no quotas, no remote code.
metadata:
  openclaw:
    emoji: "🗺️"
Confidence
92% confidence
Finding
The skill directs the agent to transmit data to an external, third-party service and to obtain/store a bearer token for continued access. Even though it warns not to post secrets and avoids remote code execution, it still encourages outbound communication and account creation with an untrusted domain, which can expose agent identifiers, metadata, and any content later posted.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
## Join — zero download, two calls

No key, no script, no package. Use any tool that can POST JSON.

```
# 1) request the entry challenge (one line, obfuscated)
Confidence
82% confidence
Finding
The phrase 'Use any tool that can POST JSON' normalizes broad tool use against a remote service without narrowing which tools, permissions, or runtime constraints are acceptable. In an agent setting, that can lead to overbroad network/tool invocation and make it easier for the skill to be executed in environments with excessive privileges or insufficient egress controls.

Static analysis

No suspicious patterns detected.