Security audit

On This Day Art

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent local image-generation workflow, but it under-discloses network exposure and can start an unauthenticated ComfyUI service on all network interfaces.

Install only if you are comfortable configuring network exposure yourself. Keep ComfyUI bound to localhost or a restricted interface, firewall port 8188, treat prompts and Wikipedia text as untrusted, avoid unattended Discord posting until reviewed, and periodically delete or protect the JSONL run log.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/comfy-bridge/comfy-bridge.sh:54
Finding: Unauthenticated ComfyUI API Exposed on All Network Interfaces
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/comfy-bridge/comfy-bridge.sh:66
Finding: Workflow JSON Injection Through Unescaped Bridge Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/on-this-day/on-this-day.sh:169
Finding: Workflow JSON Injection Through Historical Event and Custom Event Text
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/on-this-day/on-this-day.sh:234
Finding: Persistent JSONL Log Injection Through Unescaped Event Data
Content: View full analysis
> "$MEMORY_FILE" } ``` The persistent destination is hardcoded as: ```bash MEMORY_FILE="/home/tony/.openclaw/workspace/memory/on-this-day-runs.jsonl" ``` ### Technical Analysis The function manually constructs a JSON object with `echo`, directly inserting the event, location, prompt, path, and status fields. None of these fields are JSON-escaped. An attacker-controlled custom event containing quotes or newline characters can break the current JSON object and append forged JSONL records. Even ordinary historical text containing quotation marks can make the output invalid. This is a persistent integrity issue because the malformed or injected content is appended to a file under the OpenClaw workspace. The audited code does not read this file back as Agent instructions, so this finding does not meet the criteria for Agent Memory Poisoning. However, other log processors or future automation may incorrectly trust the forged records. ### Attack Path 1. An attacker supplies a custom event containing quotes, newlines, or a complete forged JSON object. 2. The event is retained in `event_text` and passed to `log_run` after successful generation. 3. The function interpolates the value into an `echo` command without JSON serialization. 4. Newline characters create additional JSONL records, while quotes alter the current record's structure. 5. A human or ...[truncated 726 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (22)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README claims the workflow is local-only and implies no external transmission, but the documented behavior includes fetching data from Wikipedia and posting generated images to Discord. This is dangerous because it can mislead users about network exposure, privacy implications, and the fact that generated content is automatically sent to third-party services.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The security section directly states the workflow runs entirely locally and does not send data to external servers, which contradicts other sections describing Wikipedia API access and Discord posting. False security claims in a dedicated security section are especially risky because users and reviewers may rely on them when deciding whether to install or authorize the skill.
Content: No source excerpt is available for this finding.

Exfiltration Commands

High

Category: Prompt Injection
Confidence: 90% confidence
Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.
Content: Scanner excerpt · README.md (reported line 487)May include surrounding context.
md
### What This Skill Does NOT Do - ❌ Upload images to cloud services - ❌ Send data to external servers - ❌ Use paid APIs - ❌ Generate videos (SD 3.5 unstable) - ❌ Access private data

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior does not align with the declared purpose: the skill claims a narrow local 'On This Day' workflow but also describes generic prompt generation, alternate models, SD 3.5 usage, Discord posting, and external data retrieval. This mismatch undermines trust and can cause agents or users to approve actions under false assumptions about what the skill does.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script makes an outbound request to Wikipedia's public REST API even though the skill metadata says it does not use cloud APIs. This is a real security and trust issue because it expands the data boundary, exposes usage metadata to a third party, and can violate operator expectations or policy in environments that require fully local-only execution.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/on-this-day/on-this-day.sh (reported line 37)May include surrounding context.
sh
log_info "Fetching events for ${date_param}..." curl -s -L "$url" | python3 << 'PYEOF' import json, sys, random data = json.load(sys.stdin) events = data.get('events', [])

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README describes Discord integration and Wikipedia-backed automation, but it does not provide a clear, up-front warning that content and metadata will be transmitted to external services. In context, this omission increases the chance that a user enables the skill assuming it is fully local or private.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation emphasizes automation and scheduled cron execution but does not clearly warn that the system can generate and publish content automatically without human confirmation. That creates operational and reputational risk, especially if the selected event or generated image is inaccurate, sensitive, or inappropriate for the target Discord server.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 487)May include surrounding context.
md
### What This Skill Does NOT Do - ❌ Upload images to cloud services - ❌ Send data to external servers - ❌ Use paid APIs - ❌ Generate videos (SD 3.5 unstable) - ❌ Access private data

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents shell-based scripts and operational commands but does not declare any explicit tool scope or permission boundaries. In an agent environment, this can cause the skill to be executed with broader shell access than users expect, increasing the chance of unintended command execution or misuse of local resources.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest says the skill does not use cloud APIs, yet the workflow explicitly depends on Wikipedia data retrieval and may send results to Discord. This is dangerous because users may rely on the local-only claim when deciding whether sensitive prompts, metadata, or generated content are safe to process.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The documentation says the skill does not handle SD 3.5, but later recommends or supports SD 3.5 as an experimental option. While not directly an exploit primitive, contradictory capability claims can mislead users and agents into invoking unsupported or unstable workflows, potentially causing crashes, resource exhaustion, or unsafe fallback behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description omits an upfront warning that generated images and related metadata may be sent to Discord. This creates a privacy and data-handling risk because users may provide prompts or generate content assuming a local-only workflow, when output distribution to a third-party platform is possible.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The setup guide states the workflow 'runs automatically' and 'posts to Discord', which conflicts with the skill metadata claiming local-only image generation and no cloud API use. This creates an undeclared outbound data flow and behavior expansion that could cause users to expose generated content and associated metadata to a third-party service without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Automatic daily posting to Discord introduces recurring network transmission without prominent warning or explicit opt-in, and the guide notes posts include date and location. Even if the data seems low sensitivity, silent scheduled disclosure to an external platform increases privacy and operational risk, especially because users may believe the skill is local-only.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The bridge is hardcoded to communicate with a fixed LAN IP and launches ComfyUI with --listen 0.0.0.0, so the workflow is not truly local-only and may expose prompts, generated content, and service control to the network. In the context of a skill described as local image generation, this mismatch increases risk because users may trust it as local while it actually depends on reachable network services.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/comfy-bridge/comfy-bridge.sh (reported line 35)May include surrounding context.
sh
mkdir -p "$SHARED_INPUT" "$SHARED_OUTPUT" check_comfy() { curl -s "http://${COMFY_HOST}:${COMFY_PORT}" > /dev/null 2>&1 } wait_for_comfy() {

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The manifest frames this skill as generating daily historical images using a local ComfyUI workflow. In addition to generation, the script starts the ComfyUI server process itself via Windows cmd.exe and exposes it with '--listen 0.0.0.0', which is an operational/service-management capability not clearly justified by the stated purpose.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/on-this-day/on-this-day.sh (reported line 193)May include surrounding context.
sh
WFEOF ) local response=$(curl -s -X POST "http://${API_HOST}:${API_PORT}/prompt" \ -H "Content-Type: application/json" \ -d "$workflow")

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script persistently logs run metadata including date, event text, inferred location, prompt, image path, and timestamp to a JSONL memory file. This creates a privacy and data-retention risk beyond the stated purpose of one-off image generation, especially because prompts and event selections may reveal user interests or sensitive usage patterns over time.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Appending run metadata to a persistent memory file without clear disclosure is a genuine privacy/security weakness. Users may not expect their prompts, locations, and output paths to be retained indefinitely, and such accumulated records can be exposed to other local users, backups, or later tooling.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The module comment presents the script as a Wikipedia-driven historical-event generator, yet run_on_this_day bypasses Wikipedia entirely when a test event argument is provided and then generates an image from that arbitrary input. This is a real intent mismatch between the file-level documentation and implemented behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.