Security audit

speech-coach

Security checks for vulnerabilities and agentic risk

Overview

This is a public-speaking coaching skill that stores local training progress; I found no hidden network, credential, or destructive behavior.

Install only if you are comfortable with a local profile and training history being saved under the OpenClaw workspace. Avoid entering sensitive workplace details if you do not want them retained, and review or delete the speech-coach workspace files if you want to clear progress.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The README advertises very broad trigger phrases such as wanting to practice public speaking, prepare for a presentation, or feeling nervous speaking in front of people. In agent ecosystems that auto-route based on user phrasing, these generic prompts can cause the skill to activate unexpectedly in ordinary conversations, creating scope confusion and increasing the chance that users are steered into this skill when they did not explicitly request it.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill instructs the agent to read and write files in the user's workspace, but it does not declare any explicit tool scope or permissions boundary. That creates a mismatch between what the skill can do and what users or the platform can review up front, increasing the risk of unintended file access or persistence beyond the user's expectation.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger description includes broad phrases like public speaking, speech coaching, and related common-language terms, which can cause the skill to activate for a wide range of ordinary conversations. Over-broad routing can expose users to file-backed persistence and scripted workflow behavior in contexts where they did not explicitly ask for this skill.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill collects personal information such as job, speaking challenges, and self-rating, then writes it to disk without any user-facing notice or consent flow about persistence. This is dangerous because users may disclose sensitive professional or personal information believing the interaction is ephemeral, while the skill silently stores it for future sessions.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: This markdown file presents all instructions, exercises, and user-facing guidance exclusively in Chinese. Under the policy rule for language or locale constraints, forcing a specific language without user opt-in can exclude users and constitutes a natural-language policy violation unless the restriction is explicitly justified.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The module docstring and user-facing descriptions are entirely in Chinese, and the file consistently presents the tool as a Chinese-language experience. Because the skill does not offer an opt-in language choice or explain that it is intentionally region- or locale-specific, this appears to impose a language/locale constraint on users.

Natural-Language Policy Violations

Medium

Confidence: 83% confidence
Finding: The manifest description is written entirely in Chinese and presents the skill as a Chinese public-speaking coach, with no indication that users may choose another language or locale. This can be interpreted as a language/locale constraint that is not explicitly documented as optional or region-specific.

Static analysis

No suspicious patterns detected.