T01 · Skill Instruction Hijacking
Error
- Location
prompts/merger.md:25- Finding
Generated Skills Contain Persistent Identity-Hijacking Instructions
- Content
View full analysis
- Remediation
View remediation
Security audit
XB
Security checks for vulnerabilities and agentic risk
Overview
This skill needs review because it handles intimate third-party data, can upload screenshots despite local-only claims, generates deceptive impersonation skills, and includes unsafe profile file operations.
Install only after reviewing the privacy and impersonation behavior. Treat all generated crush profiles as untrusted drafts, avoid uploading non-consenting people's private chats/photos, use offline OCR only, remove precise GPS/routine analysis, validate profile slugs, and replace the generated persona language with clear AI-simulation disclosure before enabling generated skills.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
other
Error
- Location
tools/screenshot_parser.py:69- Finding
Default Vision Mode Transmits Private Screenshots and API Credentials to a Configurable Endpoint
- Content
View full analysis
list: """Call Claude/GPT Vision API to extract chat messages from a screenshot.""" api_key = os.environ.get("OPENAI_API_KEY", "") if not api_key: raise RuntimeError( "OPENAI_API_KEY not set. " "Set it with: export OPENAI_API_KEY=your_key\n" "Or use --mode ocr for offline extraction." ) try: import urllib.request import urllib.error # Read and encode image with open(image_path, "rb") as f: img_data = base64.b64encode(f.read()).decode("utf-8") ext = Path(image_path).suffix.lower().lstrip(".") mime_map = {"jpg": "jpeg", "heic": "jpeg", "heif": "jpeg"} mime = f"image/{mime_map.get(ext, ext)}" payload = json.dumps({ "model": "gpt-4o-mini", "messages": [ { "role": "user", "content": [ {"type": "text", "text": VISION_PROMPT}, { "type": "image_url", "image_url": { "url": f"data:{mime};base64,{img_data}", "detail": "high", }, }, ], } ], "max_tokens": 2000, }).encode("utf-8") base_url = os.environ.get("OPENAI_BASE_URL", "https://api.openai.com/v1") req = urllib.request.Request( f"{base_url}/chat/completions", data=payload, headers={ "Authorization": f"Bearer {api_key} ...[truncated 3161 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
tools/skill_writer.py:66- Finding
Unsanitized Profile Slugs Permit Filesystem Path Traversal and Arbitrary File Writes
- Content
View full analysis
None: profile_dir = Path(base_dir) / slug if profile_dir.exists(): print(f"Profile already exists: {profile_dir}") sys.exit(1) profile_dir.mkdir(parents=True, exist_ok=True) meta = { "slug": slug, "name": display_name or slug, "created_at": datetime.now().strftime("%Y-%m-%d %H:%M:%S"), "updated_at": datetime.now().strftime("%Y-%m-%d %H:%M:%S"), "version": "1.0.0", } with open(profile_dir / META_FILE, "w", encoding="utf-8") as f: json.dump(meta, f, ensure_ascii=False, indent=2) skill_content = f"""--- name: {slug} description: Crush profile for {display_name or slug} version: 1.0.0 --- # {display_name or slug} > Profile created on {meta['created_at']}. ## Persona *(Not yet generated. Run the intake flow to build the persona.)* ## Memory *(Not yet generated.)* """ with open(profile_dir / "SKILL.md", "w", encoding="utf-8") as f: f.write(skill_content) for fname in ("persona.md", "memory.md"): with open(profile_dir / fname, "w", encoding="utf-8") as f: f.write(f"# {fname.replace('.md', '').title()}\n\n*(Not yet generated.)*\n") def save_file(slug: str, filename: str, content_file: str, base_dir: str) -> None: profile_dir = Path(base_dir) / slug profile_dir.mkdir(parents=True, exist_ok=True) safe_name = Path(filename).name if safe_name != filename: print(f"Error: filename must not contain path separators: {filename}", file=sys.stderr) sys.exit(1) if not os.path.exists(content_file): print(f"Error: content file not found: {content_file}", file=sys.stderr) ...[truncated 3369 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:190- Finding
Unquoted User-Controlled Slug in Destructive Shell Command Enables Command Injection and Unsafe Deletion
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (73)
Tainted flow: 'req' from os.environ.get (line 112, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 95% confidence
- Finding
The request sent via urllib includes a base URL taken from OPENAI_BASE_URL and sensitive image data plus API credentials. Because the code transmits private chat screenshots to a network endpoint influenced by environment configuration, it can exfiltrate highly sensitive personal data to an unexpected or attacker-controlled service.
- Content
python }, ) with urllib.request.urlopen(req, timeout=30) as resp: result = json.loads(resp.read().decode("utf-8")) text = result["choices"][0]["message"]["content"].strip()
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README introduces screenshot analysis via Vision APIs without a clear, upfront privacy warning, while later asserting all data remains local. This combination can mislead users into exposing private conversation screenshots, including data about uninvolved third parties, to external processors without informed consent.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The example workflow analyzes photo metadata to infer another person's date, place, and routine patterns. In this skill's context, that functionality is particularly dangerous because it transforms personal photos into a stalking aid, making real-world tracking easier and more actionable.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README claims all data stays local and is never uploaded, yet earlier sections state screenshot text may be extracted via external Vision APIs. This is a material privacy misrepresentation that could cause users to submit intimate chats and images under false assumptions, resulting in unintended disclosure to third-party services.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The example demonstrates extracting exact GPS points, timestamps, cities, and recurring routines from someone's photos, effectively producing location intelligence about a private individual. In a 'crush' analysis tool, that capability is especially dangerous because it normalizes surveillance-like use and could facilitate stalking, coercion, or physical safety risks.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
If the skill uses external vision/OCR processing while claiming local-only processing, that is a serious privacy and disclosure problem because third-party chat screenshots and intimate relationship data could be transmitted off-device unexpectedly. In this context, the skill solicits highly sensitive personal data, so any undeclared external processing materially elevates harm.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
If the skill uses external vision/OCR processing while claiming local-only processing, that is a serious privacy and disclosure problem because third-party chat screenshots and intimate relationship data could be transmitted off-device unexpectedly. In this context, the skill solicits highly sensitive personal data, so any undeclared external processing materially elevates harm.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the skill uses external vision/OCR processing while claiming local-only processing, that is a serious privacy and disclosure problem because third-party chat screenshots and intimate relationship data could be transmitted off-device unexpectedly. In this context, the skill solicits highly sensitive personal data, so any undeclared external processing materially elevates harm.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the skill uses external vision/OCR processing while claiming local-only processing, that is a serious privacy and disclosure problem because third-party chat screenshots and intimate relationship data could be transmitted off-device unexpectedly. In this context, the skill solicits highly sensitive personal data, so any undeclared external processing materially elevates harm.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
If the skill uses external vision/OCR processing while claiming local-only processing, that is a serious privacy and disclosure problem because third-party chat screenshots and intimate relationship data could be transmitted off-device unexpectedly. In this context, the skill solicits highly sensitive personal data, so any undeclared external processing materially elevates harm.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the skill uses external vision/OCR processing while claiming local-only processing, that is a serious privacy and disclosure problem because third-party chat screenshots and intimate relationship data could be transmitted off-device unexpectedly. In this context, the skill solicits highly sensitive personal data, so any undeclared external processing materially elevates harm.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
If the skill uses external vision/OCR processing while claiming local-only processing, that is a serious privacy and disclosure problem because third-party chat screenshots and intimate relationship data could be transmitted off-device unexpectedly. In this context, the skill solicits highly sensitive personal data, so any undeclared external processing materially elevates harm.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the skill uses external vision/OCR processing while claiming local-only processing, that is a serious privacy and disclosure problem because third-party chat screenshots and intimate relationship data could be transmitted off-device unexpectedly. In this context, the skill solicits highly sensitive personal data, so any undeclared external processing materially elevates harm.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill invites ingestion of third-party chat logs, photos, social posts, and EXIF/GPS data for psychological and conversational modeling, yet it does not foreground the privacy sensitivity and consent requirements for that material. This is dangerous because users may process intimate data about another person without understanding the legal, ethical, and safety implications of storing, analyzing, and simulating them.
- Content
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill is designed to write and update generated SKILL.md files, effectively creating or modifying agent-executable artifacts based on untrusted personal input. This self-modification pattern is dangerous because analyzed data, prompts, or adversarial content embedded in chat logs could be propagated into new skills that later influence agent behavior or bypass expected review.
- Content
md | Analyze photo EXIF / GPS | `Bash` → `python3 ${CLAUDE_SKILL_DIR}/tools/photo_analyzer.py` | | Bayesian message tagging | `Bash` → `python3 ${CLAUDE_SKILL_DIR}/tools/bayesian_tagger.py` | | Version snapshots | `Bash` → `python3 ${CLAUDE_SKILL_DIR}/tools/version_manager.py` | | Write / update skill files | `Write` / `Edit` | | List existing profiles | `Bash` → `python3 ${CLAUDE_SKILL_DIR}/tools/skill_writer.py --action list` | **OpenClaw note**: Replace `${CLAUDE_SKILL_DIR}` with `{baseDir}` in all Bash commands.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 5. **Merge**: Follow `prompts/merger.md` to combine everything into the final `SKILL.md`.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 5. **Merge**: Follow `prompts/merger.md` to combine everything into the final `SKILL.md`.
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The command
rm -rf crushes/{slug}uses an unsanitized parameter in a destructive shell operation. Ifslugcontains path traversal, shell metacharacters, or unexpected values, it could delete arbitrary directories or files beyond the intended profile path, causing severe local data loss.- Content
/delete-crush {slug}— Delete a profile permanently:bash rm -rf crushes/{slug}/wake-up {slug}— Alias for delete. Outputs: "You are awake now."
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly solicits highly sensitive third-party materials including private chat logs, social media text, photos with EXIF metadata, and subjective relationship history, but provides no privacy notice, consent guidance, minimization rules, or warning about risks to the subject or uploader. In this context, the skill is specifically designed to reconstruct and simulate a real person, which increases the danger of non-consensual profiling, exposure of intimate data, and misuse of location and relationship information.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The hard rule 'You are {name}, not an AI, not an assistant, not a robot' explicitly instructs the agent to conceal its nature and impersonate a real person. In a relationship-simulation skill based on a user's crush, this is especially dangerous because it enables deceptive emotional engagement, can manipulate vulnerable users, and erodes informed consent by making the user interact with a system pretending to be someone they know.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The file performs outbound network communication to a remote API, but that capability is not declared. In a skill handling intimate private chats and screenshots, undeclared network access is especially risky because users may not expect their data to leave the device.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The file performs outbound network communication to a remote API, but that capability is not declared. In a skill handling intimate private chats and screenshots, undeclared network access is especially risky because users may not expect their data to leave the device.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The vision mode base64-encodes full screenshots and sends them to a remote model API for extraction. These screenshots can contain highly sensitive relationship communications, names, timestamps, and other personal details, creating a substantial privacy and data-exposure risk.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The tool sends private screenshots to a remote Vision API without an explicit warning at the point of use about data sharing, third-party processing, or privacy consequences. Given the skill's stated purpose of modeling a romantic target from chats and social media, the missing warning materially increases the risk of non-consensual or poorly informed disclosure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file presents all installation and usage instructions in Chinese and does not indicate that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy concern.
- Content
Static analysis
No suspicious patterns detected.