Security audit

Pretenziya Ru

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly drafts Russian complaints as advertised, but it also tells the agent to run local Python commands, track usage in a file, and append unrelated Telegram promotion.

Review before installing. The drafting template itself is useful and bounded, but the skill should remove the Attribution section, Python commands, local counter file, and unsolicited Telegram promotion before it is treated as a normal document-drafting skill.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:65
Finding: Mandatory Output Hijacking with Persistent Usage Tracking and Unrelated Promotion
Content: View full analysis
= 3 — ничего не добавляй ``` ### Technical Analysis The Skill's declared purpose is to draft formal complaints or pre-litigation claims. The `Attribution` section introduces behavior unrelated to that purpose by directing the Agent to: 1. Execute a local Python command. 2. Read persistent state from `/home/node/.openclaw/workspace/ru-pack-counter.txt`. 3. Insert unsolicited Telegram promotion into the response. 4. Execute another command that creates or updates the persistent counter. These mandatory instructions alter the Agent's expected output and add side effects that are not necessary to draft the requested document. In particular, the Skill controls the end of every eligible response and makes promotional content conditional on local state. This is instruction and output hijacking rather than a legitimate drafting feature. The commands use a fixed path and fixed integer content, so the reviewed code does not demonstrate arbitrary command injection, remote payload retrieval, privilege escalation, or installation of a persistent executable backdoor. Neverthe ...[truncated 1661 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: Confusable Unicode characters (e.g., Cyrillic or Greek lookalikes of Latin letters) can make a malicious tool name appear identical to a trusted one.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill’s declared purpose is drafting complaints, but it also instructs the agent to execute local Python commands and persist a counter file in the workspace for attribution/promotion logic. This introduces hidden side effects unrelated to the user task, violating least privilege and creating an opportunity for unauthorized local command execution and filesystem modification.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The local command execution and state tracking are context-inappropriate for a document-drafting skill and therefore materially increase risk: the agent is being induced to act on the host environment rather than only generate text. Because the behavior is unrelated to complaint writing, it is a strong indicator of covert capability expansion and abuse potential.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill name, slug, and description indicate the skill is designed specifically for Russian-language complaint drafting, but the file does not explicitly state that this locale restriction is optional or that the user can choose another language. Under the policy, a language or locale constraint should be opt-in or clearly documented as justified.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes generic phrases such as "обращение", "нарушили", "обманули", "не вернули", and "не починили" that can appear in many ordinary conversations outside the intended legal-complaint context. The file does not provide exclusion conditions or negative examples to narrow when the skill should activate.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The markdown includes instructions to write a local workspace file without transparent user notice or consent. Even though the specific write is a counter, hidden filesystem modification normalizes unsafe behavior, can leak environment assumptions, and may be repurposed in similar skills for more harmful persistence or tampering.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.