Security audit

OpenClaw Soul Weaver

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it sends user profile details to a remote service and returns agent configuration files that can shape future agent behavior, with broad triggers and inconsistent file permissions.

Install only if you are comfortable sending the provided name, profession, use case, style, persona, and avatar prompt data to the configured external service. Review every generated SOUL.md, MEMORY.md, TOOLS.md, and AGENTS.md file before applying it, and avoid granting file-read/file-write permissions unless the package is updated to clearly scope and implement those operations.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: index.js:128
Finding: Unrestricted Fetch of a Server-Controlled Image URL
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: index.js:48
Finding: Automatic Transmission of User Profile and Context to an External Service
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: index.js:70
Finding: Unvalidated Remote Agent Configuration Can Inject Persistent Behavioral Instructions
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: clawhub.yaml:17
Finding: Filesystem Permissions Exceed the Current Implementation's Requirements
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (36)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 12)May include surrounding context.
text
build/ # Environment variables .env .env.local .env.development.local .env.test.local

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · .gitignore (reported line 13)May include surrounding context.
text
# Environment variables .env .env.local .env.development.local .env.test.local .env.production.local

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The changelog states permissions of network, file-write, and file-read, while the provided manifest metadata declares only network. Permission inconsistencies are dangerous because they can conceal the skill's true access requirements and undermine trust, review accuracy, and user understanding of what the skill may do.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The automatic trigger phrases are broad, generic, and overlap with normal conversation such as 'create ai agent' or 'generate soul'. In an agent ecosystem, this can cause the skill to activate unexpectedly, leading to unintended network submission of user prompts and possible generation or replacement of configuration artifacts without meaningful user intent verification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill advertises itself primarily as a conversational configuration generator, but the documentation reveals materially different behavior: sending user data to a remote backend, generating images, and saving files locally. This mismatch undermines informed consent and makes it easier for users or orchestrators to invoke the skill without realizing it performs external data transfer and local persistence.
Content: No source excerpt is available for this finding.

Scope Creep

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation states that avatar images are downloaded and saved to the local filesystem, but the manifest only declares network permission. Undeclared local-write behavior is a security issue because it bypasses permission transparency and could lead to unexpected persistence of generated or remote content on disk.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description explicitly says it can replace system files to 'instantly professionalize' OpenClaw, but the manifest does not present a clear user warning, scope limitation, or safety control around that behavior. In context, this is especially dangerous because the skill also has file-write permission, making system-impacting modifications sound routine and low-friction.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill reads process.env.API_BASE_URL even though only network permission is declared, creating a capability/permission mismatch. This is dangerous because undeclared environment access can hide configuration-based behavior changes, including redirection to attacker-controlled endpoints, and reduces transparency for users and reviewers.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code claims the avatar is saved locally and returns a local path, but it never writes the file and only logs a hypothetical destination. This is dangerous because it misrepresents what the skill actually did, which can mislead downstream components or users into trusting nonexistent local artifacts and conceal the real network-only behavior.
Content: No source excerpt is available for this finding.

Scope Creep

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The package metadata requests an additional file-write permission that is not declared in the top-level skill metadata presented for review, creating a permission mismatch. This is dangerous because it can mislead reviewers or users about the skill's effective capabilities and, if the runtime trusts the in-package manifest, enable local file modification beyond the expected network-only scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The changelog describes capabilities beyond the user-facing metadata, including generating multiple files, ZIP export, and avatar/image API integration. This mismatch can mislead users and reviewers about the skill's real behavior, reducing informed consent and making it easier for risky file and network actions to occur unexpectedly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documented generation of six configuration files and ZIP export implies modification of the user's workspace and creation of packaged artifacts, but the changelog does not warn about these side effects. That omission can lead to unexpected file creation, overwrites, or persistence of sensitive generated content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The changelog advertises API integration and image generation features but does not warn users that prompts or related data may be sent to an external service. Without clear disclosure, users may unknowingly expose sensitive content to third parties, especially in a skill centered on generating personalized configurations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The phrase 'Multiple pattern-based auto-triggers' is overly broad and does not explain what inputs activate the skill or what actions will follow. In a skill with network and documented file-generation behavior, vague triggering increases the chance of unintended activation and actions occurring without clear user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README describes use of an external API endpoint and file-writing behavior but does not clearly disclose that user inputs and generated configuration content may be transmitted to a third-party service and written into local configuration files. Because this skill creates identity, memory, and tool configuration artifacts, the data involved may be sensitive, and hidden transmission or writes could expose private information or alter agent behavior in ways the user does not expect.
Content: No source excerpt is available for this finding.

Scope Creep

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README claims the skill needs file-read and file-write capabilities even though the metadata declares only network permission. This permission/documentation mismatch is dangerous because users may be misled about what the skill can do, and the skill’s stated purpose explicitly includes replacing or saving system/configuration files, which raises the risk of unauthorized file modification or a later manifest escalation slipping past users.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill is presented as a configuration generator, yet it also documents a separate avatar-generation workflow with image generation and local download. This expansion of scope increases attack surface and user surprise, especially where image generation may call distinct endpoints and create persistent artifacts not implied by the primary description.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The auto-invocation rule is broad enough to match normal user requests about creating an AI assistant, which could cause the skill to trigger unexpectedly. In context, that matters because the skill can send user-provided profile data to an external service and may produce files or configurations without the user intentionally selecting this skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The API usage section documents transmitting user information such as names, profession, use case, and communication style to an external domain, but it does not clearly warn users that their data leaves the local environment. This creates a privacy and consent risk, especially because the skill frames itself as a natural conversational generator rather than an external data-processing service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Defaulting the API language to Chinese without explicit user selection is primarily a policy and user-expectation issue rather than a direct exploit path, but it can still lead to unintended processing choices and confusing outputs. In a skill that transmits data externally, silent defaults reduce user control over how requests are represented and handled.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation says avatar images will be downloaded and permanently saved locally, but it does not present a clear warning or consent flow for local persistence. Unexpected file writes can create privacy, storage, and trust issues, particularly when generated content may be retained beyond the user’s intent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger patterns are broad enough to match many generic requests about creating AI agents or assistants, including multilingual phrases, which can cause the skill to activate outside its intended scope. Overbroad activation is risky here because the skill also has network and file-write permissions, so accidental invocation could lead to unexpected data transmission or file generation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest declares external API endpoints for text and image generation but provides no user-facing notice that prompts, configuration content, or related data may be sent to third-party services. This is problematic because users may provide sensitive professional or personal details while 'natural conversation' generation occurs, creating undisclosed privacy and confidentiality risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill’s stated purpose is generating OpenClaw configurations, but it also requires find-skills, autoclaw, and brave-search, which expand its capabilities beyond simple local templating. That mismatch increases the attack surface and could enable unnecessary external discovery or automated follow-on actions that users would not reasonably expect from a config generator.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The config sets "language": "ZH", which imposes a specific language preference as a default policy choice. Under the policy criteria, forcing a specific language without offering user choice or documenting a justified region-specific constraint is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: index.js:7