Security audit

Openclaw Podcast

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with podcast briefing generation, but it has review-worthy risks around undisclosed data sent to a remote API, plaintext credential persistence, scheduled task setup, and unsafe command construction.

Review this skill carefully before installing. Use a temporary or manually managed API key rather than letting the wizard write it to your shell profile, inspect dry-run output with the understanding that cover-image context is not shown there, avoid scheduling custom style names containing shell metacharacters, and only enable cron jobs if you accept recurring transmission of workspace-derived briefing data to Superlore.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup-crons.js:939
Finding: Stored Command Injection Through Custom Podcast Style Names
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup-crons.js:257
Finding: Shell Startup Injection and Plaintext API Key Persistence
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/generate-episode.js:925
Finding: Undeclared Identity File Collection and Remote Disclosure
Content: View full analysis
0) break; } catch {} } } catch {} // Distill to a short project flavor (max 30 chars) const projectFlavor = projectKeywords.length > 0 ? projectKeywords.slice(0, 2).join(', ').substring(0, 60) : ''; ``` The extracted value is incorporated into the remote request: ```javascript const body = JSON.stringify({ topic, title, style: 'documentary', tone: 'documentary', voice: config.voice, voiceProvider: 'local', voiceSpeed: config.speed, ttsModel: 'kokoro', targetMinutes: config.targetMinutes, language: 'en', visibility: 'private', // HARDCODED — briefings contain personal workspace data. NEVER public. webSearch: false, altScript: false, coverImagePrompt, }); ...[truncated 3178 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill performs higher-risk operations beyond its headline purpose, including email-based OTP login/API key creation with an external service, writing secrets to shell rc files, and optionally installing cron jobs. These actions affect authentication, secret persistence, and long-lived execution; if users are not clearly informed, they may unintentionally create durable access or background tasks that continue sending summarized workspace data off-host.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill performs higher-risk operations beyond its headline purpose, including email-based OTP login/API key creation with an external service, writing secrets to shell rc files, and optionally installing cron jobs. These actions affect authentication, secret persistence, and long-lived execution; if users are not clearly informed, they may unintentionally create durable access or background tasks that continue sending summarized workspace data off-host.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.
md
node scripts/setup-crons.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.
md
node scripts/setup-crons.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.
md
node scripts/setup-crons.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.
md
node scripts/generate-episode.js # Your first episode in 2 minutes

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.
md
node scripts/generate-episode.js # Your first episode in 2 minutes

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 228)May include surrounding context.
md
node scripts/generate-episode.js # Your first episode in 2 minutes

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.
md
node scripts/generate-episode.js # Your first episode in 2 minutes

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.
md
node scripts/generate-episode.js # Your first episode in 2 minutes

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.
md
node scripts/generate-episode.js # Your first episode in 2 minutes

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 258)May include surrounding context.
md
node scripts/generate-episode.js # Your first episode in 2 minutes

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.
md
node scripts/generate-episode.js # Your first episode in 2 minutes

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.
md
node scripts/generate-episode.js # Your first episode in 2 minutes

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.
md
node scripts/generate-episode.js # Your first episode in 2 minutes

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The privacy comments claim sensitive data never leaves the machine and raw files are never transmitted, but generateCoverImagePrompt reads identity files directly and includes extracted project descriptors in coverImagePrompt sent to the remote API. Because that path is unsanitized and contradicts the privacy guarantee, users may unknowingly exfiltrate personal or proprietary context under a false assurance of safety.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation explicitly encourages putting detailed personal briefing data into the topic field and sending it to a third-party API, while also suggesting an analytics identifier header, but it does not clearly warn users about privacy, retention, or third-party access implications. In the context of an agent skill that connects to workspace memory and files, this materially increases the risk of unintentional exfiltration of sensitive internal data to an external service.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script reads ~/.openclaw/workspace/IDENTITY.md, USER.md, and SOUL.md outside the discovered workspace and uses extracted text to build coverImagePrompt, which is then sent to the external Superlore API. This bypasses the file-scoping users would reasonably expect and expands data collection to global identity files that are not passed through the documented sanitization pipeline.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The request body explicitly sets language: 'en', which forces English output regardless of user preference. The file does not present this as an opt-in choice or document a justified region-specific constraint, so it conflicts with the language/locale policy requirement.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 95% confidence
Finding: This is a credential session-persistence issue: the script stores an API key in shell profile files so every future shell session exports the secret automatically. Persisting secrets this way broadens exposure across the system and increases the blast radius if another tool, process, or user account can read the profile or inherited environment.
Content: Scanner excerpt · scripts/setup-crons.js (reported line 255)May include surrounding context.
js
// ───────────────────────────────────────────────────────────────────────────── /** * Write an API key export line to the user's shell profile (~/.zshrc or ~/.bashrc). */ function saveToShellProfile(apiKey) { const shell = process.env.SHELL || '';

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The wizard offers to append SUPERLORE_API_KEY directly into ~/.zshrc or ~/.bashrc, creating long-lived credential persistence in plaintext. This expands the skill's reach from one-time podcast setup into modifying the user's login environment, and exposes the key to local compromise, accidental disclosure, shell-history/debug output, backups, and unrelated processes inheriting the environment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The manifest says the skill can schedule morning, midday, or evening briefings, and outputting commands would fit that purpose. However, actually executing openclaw cron add through a subprocess crosses into direct system/task configuration, which is a stronger capability than the user-facing description of transforming a workspace into briefings.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/setup-crons.js:875