OpenClaw Skills Weekly

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:56 AM UTC
• Version: 1.1.0

Overview

The skill mostly performs the advertised weekly reporting workflow, but it needs Review because default execution can install mutable dependencies, run an unverified local helper, and access Docker/container data without clear opt-in.

Install only if you are comfortable with a reporting skill that can make multiple external API calls, persist local history, use API keys from the environment, install Python packages, and by default attempt Docker/container database access and run a separate x-search script. Prefer running with --skip-x and --no-bridge unless you explicitly need those features, and use an isolated environment with limited API tokens.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: script_generator.py:92

Finding

Indirect Prompt Injection Through Untrusted Skill Documentation

Content

View full analysis

str: track = skill.get("_track", "mover") track_label = "NEW THIS WEEK" if track == "rocket" else "TOP MOVER" cold = skill.get("_cold_start", False) template = USER_TEMPLATE_COLD if cold else USER_TEMPLATE_VELOCITY return template.format( display_name=skill.get("display_name", "Unknown"), author=skill.get("author", "Unknown"), summary=skill.get("summary") or "No description.", content=(skill.get("content") or "No documentation available.")[:3000], track=track_label, ) ``` The resulting prompt is submitted directly to Anthropic: ```python message = client.messages.create( model=model, max_tokens=150, system=SYSTEM_PROMPT, messages=[{"role": "user", "content": _build_prompt(skill)}], ) ``` ### Technical Analysis The `content` and `summary` fields originate from externally controlled ClawHub metadata or GitHub repository documentation. They are interpolated directly into an LLM user message without a strong trust-boundary marker or an instruction requiring the model to treat the documentation exclusively as quoted data. An attacker can publish documentation containing instructions such as asking the model to ignore the requ ...[truncated 1721 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: run_weekly.py:34

Finding

Default Weekly Pipeline Crosses the Docker Container Trust Boundary

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Runtime Installation of Unpinned and Unverified Python Dependencies

Content

View full analysis

=0.27.0 python-dotenv>=1.0.0 anthropic>=0.49.0 beautifulsoup4>=4.12.0 ``` The Skill instructs the agent to install these dependencies during use: ```bash cd "${SKILL_ROOT}" && pip install -r requirements.txt --quiet 2>/dev/null || pip3 install -r requirements.txt --quiet ``` ### Technical Analysis Every dependency uses only a lower-bound version constraint. Consequently, any future version satisfying the constraint may be selected and installed. No lock file, package hash, signature verification policy, or reviewed upper bound is provided. Python packages can execute installation or build-backend code during installation. Therefore, a compromised future release or a malicious artifact accepted by the package resolver would execute with the privileges of the user running the Skill. The command also suppresses standard error for the first installation attempt, reducing visibility into repository, certificate, resolver, or package-build warnings. `beautifulsoup4` was not observed in the audited Python imports, so it appears to add unnecessary dependency surface. The package names are legitimate-looking and no current package compromise was established. The vulnerability is the unrestricted and non-reproducible dependency trust policy. ### Attack Path 1. A user or agent follows the setup instructions in `SKILL.md`. 2. `pip` resolves the newest available versions satisfying the `>=` constraints. 3. A future compromised release, malicious distribution artifact, or compromised package index supplies dependency code. 4. `pip` downloads and installs that code without hash verification. 5. Installation or import-time code executes with the invoking user's privileges. 6. The compromised dependency can access environment variables available t ...[truncated 613 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: x_capture.py:33

Finding

Execution of an Unverified External X-Search Helper Script

Content

View full analysis

str: """Run the x-search script and return stdout.""" cmd = [ sys.executable, X_SEARCH_SCRIPT, query, "--from", date_from, "--to", date_to, "--max-tokens", "4096", ] print(f"[X-CAPTURE] Running: {query} ({date_from} to {date_to})") try: result = subprocess.run(cmd, capture_output=True, text=True, timeout=90, encoding="utf-8", errors="replace") if result.returncode != 0: print(f" [WARN] x-search returned code {result.returncode}") if result.stderr: print(f" stderr: {result.stderr[:200]}") return result.stdout except subprocess.TimeoutExpired: print(f" [WARN] x-search timed out for query: {query}") return "" except FileNotFoundError: print(f" [ERROR] x-search script not found at {X_SEARCH_SCRIPT}") return "" ``` The helper is invoked by the default full pipeline unless X capture is explicitly skipped: ```python if not args.skip_x and not args.snapshot_only: print("\n" + "=" * 40) print(" PHASE 1: X/Twitter Signal Capture") print("=" * 40) try: import x_capture date_from = (now - timedelta(days=args.days)).strftime("%Y-%m-%d") date_to = now.strftime("%Y-%m-%d") x_capture.capture(date_from=date_from, date_to=date_to, append=True) except Exception as e: print(f"[WARN] X capture failed (non-fatal): {e}") print(" Continuing with exi ...[truncated 2012 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence

Findings (52)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared purpose centers on trending ClawHub skill tracking and scripted video generation with specific ranking modes. This code chunk does something materially different: it reads a local weekly_signals.json file, filters entries by age, groups them by category, and formats them into a 'Community Buzz' markdown section. There is no code for discovering or tracking ClawHub skills, no ranking calculations, and no YouTube script generation. The accessed resource pattern is also different from the description: instead of operating on skill trend data, it consumes curated community links and summaries from local storage. This is a substantive description-to-behavior mismatch, not merely a supporting subcomponent of the declared functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The supplied code chunk is a content harvester, not a tracker or script generator. Its primary function is to retrieve skill descriptions/changelogs from the ClawHub detail API, fetch README files from GitHub repositories, and enrich skill records with harvested content and author information. The declared description emphasizes weekly trend tracking and generation of ranked YouTube scripts ('Movers + Rockets'), but none of that logic appears here. While this file could be a supporting component of a larger system, the description does not accurately represent what this specific code chunk actually does, especially because it performs external HTTP fetching from ClawHub and GitHub that is not mentioned.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The core tracking/trending portion of the description is represented: the script fetches ClawHub skills, stores historical metrics, and ranks trends over time. However, the declared purpose prominently claims generation of GitHubAwesome-style YouTube video scripts with a two-track ranking model (Movers + Rockets). The supplied code does neither. Its output is a single ranked markdown report plus CLI views, not a script and not dual ranking categories. Additionally, the code persists data in SQLite and writes reports to disk/host mount; while this supports tracking, the primary described content-generation behavior is missing, making this a material description/behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The core declared purpose is broadly accurate: the code does track ClawHub/OpenClaw skills, performs two-track ranking (movers + rockets), and generates YouTube-oriented script outputs. However, the implementation includes additional material capabilities not reflected in the description or permissions: it performs X/Twitter signal capture, bridges a database out of a Docker container onto the host, and persists historical snapshots in a local SQLite database. These are not merely incidental helpers; they are explicit pipeline phases involving external/social data access, container interaction, and local data storage. Therefore the description does not fully and accurately represent the skill's behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description emphasizes a weekly trend-tracking and script-generation workflow for ClawHub/OpenClaw skills, specifically mentioning GitHubAwesome-style YouTube scripts and a two-track ranking system (Movers + Rockets). The actual code chunk does something materially different: it invokes an external x-search script, collects OpenClaw-related tweets from X/Twitter, extracts URLs, categorizes and summarizes them, and saves them as structured signal records in weekly_signals.json. This may be a supporting component in a larger pipeline, but taken on its own it does not perform the declared primary functions of ranking skills or generating video scripts. The code also depends on external search and LLM APIs and persists captured signals, which are not represented in the description.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description promotes a self-modifying agent that writes corrections into its own system prompt without human intervention, but gives no warning about prompt drift, persistence of sensitive data, or loss of control. In context, the file is a promotional roundup, which makes the unsafe capability easier to normalize without communicating the associated risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description explicitly advertises unsupervised execution, autonomous scheduled tasks, and self-auditing without warning about runaway actions, privilege misuse, or persistence. In context, autonomous execution materially increases risk because actions can continue without immediate human review.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · storage.py (reported line 70)May include surrounding context.

python

def upsert_skills(skills: list[dict]) -> None:
    """Insert or update skill metadata (does not touch metrics_history)."""
    with _connect() as conn:
        conn.executemany(
            """

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · x_capture.py (reported line 16)May include surrounding context.

python

Requires:
    - x-search skill at ~/.claude/skills/x-search/scripts/x_search.py
    - XAI_API_KEY in env or .env file
    - ANTHROPIC_API_KEY in .env (for LLM structuring step)
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · x_capture.py (reported line 17)May include surrounding context.

python

Requires:
    - x-search skill at ~/.claude/skills/x-search/scripts/x_search.py
    - XAI_API_KEY in env or .env file
    - ANTHROPIC_API_KEY in .env (for LLM structuring step)
"""

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares executable behavior that includes shell, network, file read/write, and environment variable use, but it does not declare any tool scope such as permissions or allowed-tools. That creates an authorization and transparency gap: a user may invoke a seemingly simple reporting skill without an explicit policy boundary around package installation, network access, and local persistence.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Several trigger phrases are broad, such as 'generate report', 'video script', or 'openclaw skills', which increases the chance of accidental invocation during unrelated conversations. In this skill, accidental activation is more concerning because invocation can lead to dependency installation, network calls, and local file/database writes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documentation does not prominently warn users that the main workflow installs Python dependencies and makes external API calls before executing the pipeline. That weakens informed consent and can surprise users with network egress, package supply-chain exposure, and persistent writes to the local environment.

Content

No source excerpt is available for this finding.

Tainted flow: 'url' from httpx.get (line 81, network input) → httpx.get (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · harvester.py (reported line 27)May include surrounding context.

python

return {"content": "", "author": ""}
    url = f"{CLAWHUB_BASE}/api/v1/skills/{slug}"
    try:
        resp = httpx.get(url, timeout=REQUEST_TIMEOUT, follow_redirects=True,
                         headers={"Accept": "application/json"})
        if resp.status_code != 200:
            return {"content": "", "author": ""}

Tainted flow: 'owner' from httpx.get (line 34, network input) → httpx.get (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · harvester.py (reported line 71)May include surrounding context.

python

# Get default branch
    try:
        api_resp = httpx.get(
            f"https://api.github.com/repos/{owner}/{repo}",
            headers={**headers, "Accept": "application/vnd.github+json"},
            timeout=REQUEST_TIMEOUT,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · harvester.py (reported line 72)May include surrounding context.

python

# Get default branch
    try:
        api_resp = httpx.get(
            f"https://api.github.com/repos/{owner}/{repo}",
            headers={**headers, "Accept": "application/vnd.github+json"},
            timeout=REQUEST_TIMEOUT,
        )

Tainted flow: 'url' from httpx.get (line 81, network input) → httpx.get (network output)

Medium

• Category: Data Flow
• Confidence: 81% confidence

Finding

The code derives owner/repo from source_url using a loose substring check and then sends an authenticated request to raw.githubusercontent.com with the same Authorization header used for api.github.com. If an attacker can supply a crafted source_url or malicious repo metadata, the skill may transmit a GitHub bearer token to a raw content host unnecessarily, increasing credential exposure risk and enabling unintended external requests tied to attacker-chosen repositories.

Content

Scanner excerpt · harvester.py (reported line 83)May include surrounding context.

python

for filename in README_CANDIDATES:
        url = f"{GITHUB_RAW}/{owner}/{repo}/{branch}/{filename}"
        try:
            resp = httpx.get(url, headers=headers, timeout=REQUEST_TIMEOUT)
            if resp.status_code == 200:
                return resp.text[:MAX_CONTENT_CHARS]
        except Exception:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list includes broad phrases such as "trending skills," "weekly report," and "skill metrics," which can plausibly match ordinary user requests outside the intended security boundary. Because this skill performs network access and writes persistent data, overly broad auto-invocation increases the chance of the skill activating unexpectedly and collecting or storing data without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly describes pulling external data from ClawHub, searching Reddit/X/Web, and saving results to SQLite and JSON, but it does not present an explicit warning that using the skill causes network activity and persistent local storage. In a user-invocable skill, this can lead to silent data collection, retention, and unexpected outbound access, especially if triggered automatically or by ambiguous requests.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest says the skill generates YouTube video scripts with a two-track ranking model, but this file's report generation only renders a single Markdown leaderboard of trending skills. There is no code here for script generation, narration structure, or separate Movers and Rockets outputs, indicating a substantive gap between the claimed skill behavior and the implemented behavior.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Logging failures and writing corrections back into a system prompt creates a semantic retention channel where sensitive user content, unsafe instructions, or prompt-injection artifacts can become persistent. The promotional framing makes the behavior sound beneficial without addressing the security consequences of storing and reusing interaction-derived data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description advertises broad Gmail, Drive, Calendar, and Sheets access and file operations without warning about least-privilege scoping, consent, or exposure of sensitive workspace data. Even though this is descriptive content, it encourages adoption of a capability with meaningful access to private communications and documents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The text promotes ingesting local files and external URLs, including PDFs, images, audio, and YouTube content, without warning about sensitive local data, untrusted content, or accidental exfiltration to external services. This is risky because users may interpret the roundup as an endorsement without understanding the privacy implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description highlights automated issue, PR, and merge actions via the GitHub CLI without warning about repository write access, token scope, or unintended workflow changes. In context, omission of guardrails around merge and triage automation increases the risk of unsafe administrative actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This JSON manifest contains natural-language trigger descriptions, so SQP-1 applies. The phrase "Find Skills listens for capability gaps" and the example user utterance "is there a skill for that" are underspecified and could overlap with ordinary conversation, without negative examples or clear limits on when the skill should activate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.