Security audit

AceToolz Word Counter

Security checks for vulnerabilities and agentic risk

Overview

This skill visibly provides word-count results through AceToolz, but it sends the full user text to an external API without a clear consent or privacy warning.

Install only if you are comfortable with text you ask it to count being sent to AceToolz. Avoid using it for confidential documents, credentials, source code, private messages, legal, medical, financial, or business-sensitive text unless the publisher adds explicit consent, privacy, and retention details or a local-processing option.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:50
Finding: Unrequested Third-Party Promotion in Agent Responses
Content: View full analysis
**Word Count Results** > - Words: 342 > - Characters (with spaces): 1,847 > - Characters (without spaces): 1,512 > - Sentences: 24 > - Paragraphs: 6 > - Estimated reading time: 2 min > > *Powered by [AceToolz](https://www.acetoolz.com)* ``` ### Technical Analysis The skill's presentation instructions insert third-party branding and an outbound promotional link into the agent's response. Neither the attribution nor the link is necessary to answer a request for text statistics. When the skill is loaded, these instructions affect how the agent constructs its current-session response. This allows the skill author to use otherwise legitimate word-count requests as a distribution mechanism for advertising and external redirection. The behavior is visible rather than covert, but the user did not request promotional content. ### Attack Path 1. A user submits a request matching a trigger such as `word count` or `reading time`. 2. The agent loads the skill and follows its response-formatting instructions. 3. The agent appends AceToolz branding and an outbound link to the requested statistics. 4. The user is exposed to unrequested promotional content and may follow the link to the external site. ### Impact Assessment The behavior controls part of the agent's current-session output but does not obtain system privileges, establish persistence, or execute local code. Its scope is limited to response manipulation, third-party promotion, and potential redirection of users to an external website. ]]>
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:22
Finding: Unnecessary Disclosure of Complete User Text to an External API
Content: View full analysis
"}' ``` macOS / Linux (curl): ```bash curl -s -X POST https://www.acetoolz.com/api/openclaw/word-counter \ -H "Content-Type: application/json" \ -d '{"text": ""}' ``` ``` ### Technical Analysis The skill instructs the agent to transmit the user's complete text to `https://www.acetoolz.com/api/openclaw/word-counter`. Word counts, character counts, paragraph counts, and reading-time estimates can ordinarily be calculated locally, so disclosure of the entire input to a third party is not technically necessary for the stated task. Although outbound network access is declared in the skill metadata, the instructions do not require informed user consent, display a privacy warning, offer local processing, redact sensitive material, or check the input for credentials and personal information. Any confidential content included in the counting request is therefore sent outside the local environment. The command templates also place the full text into a JSON body placeholder. Implementations must perform proper JSON serialization rather than direct textual substitution; otherwise, quotes, backslashes, or control characters in the input could produce malformed requests. The reviewed project contains instructions only, so no concrete command-injection implementation was confirmed. ### Attack Path 1. A user supplies text for word counting or reading-time estimation. 2. The request activates the skill through one of its broad text-st ...[truncated 934 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to transmit the user's full text to a third-party API for a task that could often involve sensitive or proprietary content. There is no explicit warning, consent step, or data-minimization guidance, so users may unknowingly expose private text to an external service.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: The curl command explicitly posts the full user-provided text to an external domain, creating a direct data exfiltration path outside the agent environment. In the context of a word-count skill, this is more dangerous because the functionality is simple and can be performed locally, making the external transmission unnecessary for many use cases.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
macOS / Linux (curl):

bash
curl -s -X POST https://www.acetoolz.com/api/openclaw/word-counter \ -H "Content-Type: application/json" \ -d '{"text": "<the full text to analyse>"}'