Security audit

Live Replay Analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it promises, but it should be reviewed because it can send raw livestream/customer data to a configurable external API and its file paths are not safely constrained.

Install only if you are comfortable sharing the input data with the configured model provider. Use a dedicated limited API key, verify the endpoint, avoid sensitive personal or confidential data unless approved, and ask the maintainer to add path validation, clearer privacy disclosure, redaction guidance, pinned dependencies, and a real source repository.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares no permissions even though its documented behavior clearly includes reading local files, writing report output, and optionally sending content to an external API. This is dangerous because users and the hosting agent cannot make an informed trust decision about filesystem and network access, especially given the skill processes potentially sensitive client livestream data.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill reads both an API key and a configurable endpoint from ~/.openclaw/config.json, which expands its access beyond the declared replay-analysis purpose and creates a path for silent use of user-scoped secrets. Because the endpoint is also configurable, the skill can send replay contents to an arbitrary remote service under the user's credentials, increasing data-exfiltration risk.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The template does more than analyze past livestream performance: it explicitly instructs the model to generate future sales-conversion scripts, urgency framing, and marketing tactics. That expands the skill into operational persuasion content generation, which can be misused for manipulative selling or produce policy-sensitive marketing advice beyond a replay-analysis scope.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The prompt includes persuasion-oriented copy generation such as value anchoring,成交主张, and guided interaction phrasing, which materially increases the model's ability to craft conversion messaging rather than merely evaluate a livestream. In a business setting, this can enable manipulative or non-compliant promotional content, especially when the output is presented as recommended scripts for direct use.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill documentation does not clearly warn that enabling model calling sends customer/session data, profiles, scripts, and derived report content to a third-party API endpoint. Because the skill is designed to process business and possibly personal data, this omission creates a real data exfiltration and privacy/compliance risk if operators enable the feature without understanding that external transmission occurs.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The code transmits the assembled prompt, which includes live-stream data, user profile data, and transcript content, to an external API with no user-facing notice, consent, masking, or policy enforcement. In this skill context, those inputs are likely business-sensitive or personal data, so undisclosed third-party transfer materially raises confidentiality and compliance risk.

Static analysis

No suspicious patterns detected.