Security audit

Git Repo to Book

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real book-generation workflow, but it can keep running later, expose API keys to child processes, and broadly commit or push repository changes.

Install only after reviewing the workflow carefully. Run it in a dedicated repository or branch, disable the cron safety-net behavior, avoid private source material with DeepWiki unless you explicitly approve the disclosure, do not export global API keys to all subagents, pin any optional dependencies, and review git status and diffs before any commit or push.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (5)

T06 · System Persistence

Error

Location: SKILL.md:205
Finding: Unattended Pipeline Resumption Through a Persistent Scheduled Task
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Note

Location: SKILL.md:532
Finding: Mandatory Promotional Link Injection Into Generated Chapters
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:612
Finding: Global OpenClaw Credentials Are Exported to the Shared Process Environment
Content: View full analysis
/dev/null) export GLM_API_KEY=$(python3 -c "import json; c=json.load(open('$HOME/.openclaw/config.json')); print(c.get('glm_api_key',''))" 2>/dev/null) export OPENROUTER_API_KEY=$(python3 -c "import json; c=json.load(open('$HOME/.openclaw/config.json')); print(c.get('openrouter_api_key',''))" 2>/dev/null) ``` ### Technical Analysis The workflow reads credentials from the user's global OpenClaw configuration and exports three provider keys into the process environment. Exported variables are normally inherited by subsequently launched child processes. The skill later invokes subagents, external skills, Python scripts, Node.js tools, and conversion utilities. Exporting all discovered provider keys therefore exposes them to a broader execution graph than necessary. In particular, illustration credentials are optional and are not needed for the core manuscript workflow. No direct credential transmission to an attacker-controlled endpoint was found in the audited files. The weakness is the violation of least privilege and the resulting enlargement of the credential exposure boundary. ### Attack Path 1. The user has one or more provider keys in `~/.openclaw/config.json`. 2. The skill reads those keys and exports them as environment variables. 3. The workflow launches subagents, third-party skills, or child processes. 4. Those processes inherit the exported credentials. 5. A compromised, malicious, or simply verbose dependency can read the environment. 6. The process may use the credentials for unauthorized API calls or expose them through logs, diagnostics, generated artifacts, or error reports. ### Im ...[truncated 482 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:903
Finding: Unpinned Third-Party Skill Installation Creates a Supply-Chain Execution Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:956
Finding: Overbroad Git Staging Can Publish Unrelated or Sensitive Repository Files
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The code does not implement any AI orchestration, content generation, chapter revision, or book-writing workflow. Its sole purpose is post-processing an existing markdown file into HTML, with metadata handling and optional CSS generation. This is materially different from the declared purpose of producing or revising technical books via multi-agent AI. The behavior is narrower and unrelated to the listed triggers except in a very indirect manuscript-processing sense.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description promises an end-to-end AI book creation workflow with parallel research/writing/review agents and support for revising chapters. The actual code does not perform any AI orchestration, content generation, revision, or review. It simply locates existing chapter markdown files and concatenates them into one manuscript with metadata and a table of contents. While manuscript assembly could be a supporting component of a book-writing system, this specific code chunk’s primary behavior is materially narrower and different from the declared purpose, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description emphasizes end-to-end AI-driven book creation and chapter revision using multiple coordinated agents. In contrast, this code only performs document polishing and packaging on an already-written manuscript file. It adds formatting elements like title page, TOC, and copyright, then emits metadata. While this could be a supporting utility within a broader book-writing workflow, the supplied code chunk itself does not implement the core advertised capabilities, so the description does not accurately represent the actual behavior shown.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description promises a content-generation workflow: spawning parallel agents to research, write, review, and revise book chapters. The actual code does none of that. It performs project maintenance/QA by checking markdown link targets, image paths, and orphaned diagram directories within a book repository. While link validation could be a supporting tool in a broader book-production pipeline, this code chunk’s primary purpose is materially different from the declared skill purpose, and the listed triggers about writing or revising books do not match this behavior. Therefore this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 94% confidence
Finding: The skill explicitly directs overwriting existing chapter files and replacing diagram directories in place, while discouraging backups. That creates a strong integrity risk because a mistaken invocation, poor model output, or adversarial prompt can irreversibly alter project content and then propagate those changes via commit/push workflows.
Content: Scanner excerpt · SKILL.md (reported line 449)May include surrounding context.
md
**Best practice: Replace in-place, never create `-new` or `-v2` suffixes.** - `chapters/chapter-NN.md` ← always overwrite the current file - `diagrams/chapter-NN/` ← always replace diagrams in the same directory - **No backups** (`-pre-revision`, `-old`, `-v2`) — git history IS the backup - **No new directories** (`chapter-02-new/`) — the PR diff shows what changed

Credential Access

High

Category: Privilege Escalation
Confidence: 98% confidence
Finding: The skill instructs checking config and .env-style locations for API keys, which is direct credential discovery behavior. In combination with subsequent export instructions, this can unnecessarily expose secrets to logs, shell history, subagents, and child processes, making credential compromise substantially more likely.
Content: Scanner excerpt · SKILL.md (reported line 586)May include surrounding context.
md
# === OPTIONAL: Image Generation === echo "=== Image Generation (for scrapbook illustrations) ===" # Check all possible locations: env vars, config.json, .env files ZAI=$(grep -o '"zai_api_key"' ~/.openclaw/config.json 2>/dev/null) GLM=$(grep -o '"glm_api_key"' ~/.openclaw/config.json 2>/dev/null) OR=$(grep -o '"openrouter_api_key"' ~/.openclaw/config.json 2>/dev/null)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 74% confidence
Finding: The skill clearly instructs file reads, file writes, git operations, and shell execution, but it does not declare a scoped permission boundary in the manifest. That increases the chance the runtime grants broader capabilities than a user would reasonably expect from a 'book writing' skill, especially because later steps include repository mutation and external calls.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases are broad and likely to match common writing-related requests, which can cause accidental activation of a high-impact skill that reads/writes files, clones repos, and may push changes. Over-broad invocation is more dangerous here because the skill is not read-only and includes autonomous orchestration and publishing actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs cloning repositories, replacing chapter files, regenerating manuscripts, committing, and pushing changes, but it does not present an up-front warning that repository contents will be modified. This creates a real integrity risk: a user may invoke what sounds like a writing assistant and unexpectedly have local or remote repos altered.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill directs use of external network services such as DeepWiki and remote review/publishing flows, but this behavior is not made explicit in the top-level manifest description. Hidden or under-disclosed network transmission is risky because repository content, chapter drafts, and metadata may be sent to third parties without clear informed consent.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: The revision workflow explicitly instructs querying DeepWiki and performing web search for updated information, which can transmit repo-related context off-box. In a book-writing skill this can be legitimate, but it is still a real data-exposure concern if the repo or draft content is sensitive or private.
Content: Scanner excerpt · SKILL.md (reported line 347)May include surrounding context.
md
If the revision requires new information (updated APIs, new features, recent events): Spawn a **research agent** to: - **Query DeepWiki MCP** (`curl https://api.deepwiki.com/v1/chat`) for current repo architecture and features - Analyze the source repo (if provided) for changes since the chapter was written - Web search for updated information and external context - Produce `research/revision-research-chapter-NN.md`

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The environment discovery section explicitly probes for API keys in local config and exports them as environment variables for downstream tools and subagents. Credential discovery and propagation materially increase the blast radius of any later prompt injection, subprocess compromise, or overly broad subagent behavior because secrets become more widely accessible than necessary.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The environment discovery workflow reads configuration files for API keys and exports them without any explicit privacy warning to the user. This is dangerous because a content-generation skill has no obvious need to inspect local secret storage, and users may not realize sensitive credentials are being surfaced to subagents and subprocesses.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 601)May include surrounding context.
md
# === OPTIONAL: DeepWiki === echo "=== DeepWiki MCP (for repo research) ===" curl -s --max-time 3 https://api.deepwiki.com/v1/health >/dev/null 2>&1 && echo "✅ DeepWiki API reachable" || echo "⬜ DeepWiki unreachable (will use direct repo analysis)" # === OPTIONAL: GitHub CLI === echo "=== GitHub CLI (for PR workflow) ==="

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The skill sends repository identifiers and user prompts to an external API (api.deepwiki.com) for analysis. External transmission is contextually related to research, but it still creates a confidentiality risk because repository structure, topic details, or unpublished manuscript context may be disclosed to a third party.
Content: Scanner excerpt · SKILL.md (reported line 695)May include surrounding context.
bash
# Query DeepWiki for detailed repo analysis curl -s https://api.deepwiki.com/v1/chat \ -H "Content-Type: application/json" \ -d '{ "repo": "owner/repo",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: The skill sends repository identifiers and user prompts to an external API (api.deepwiki.com) for analysis. External transmission is contextually related to research, but it still creates a confidentiality risk because repository structure, topic details, or unpublished manuscript context may be disclosed to a third party.
Content: Scanner excerpt · SKILL.md (reported line 695)May include surrounding context.
bash
# Query DeepWiki for detailed repo analysis curl -s https://api.deepwiki.com/v1/chat \ -H "Content-Type: application/json" \ -d '{ "repo": "owner/repo",

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/convert_to_html.py (reported line 70)May include surrounding context.
python
] if css_path and os.path.exists(css_path): cmd += [f"--css={css_path}"] result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0: print(f"pandoc error: {result.stderr}", file=sys.stderr) return False

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough to match many ordinary writing-related requests, which can cause this high-privilege skill to activate outside the user's clear intent. Because the skill requests exec, file read/write, and session spawning, accidental activation expands the attack surface and may lead to unnecessary code execution or repository access in unrelated contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The regex-style trigger patterns are underspecified and can match vague or partial requests such as any request to 'write ... book' or 'book about ...', without confirming that the task actually requires this specific privileged workflow. In a skill that can execute commands and spawn sessions, ambiguous auto-activation increases the risk of misrouting user prompts into a powerful agent pipeline with broader system access than necessary.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger example on line 10, "Help me write a book project", uses a vague everyday phrase rather than a distinctive invocation. Broad trigger phrases can cause the skill to activate in contexts where a user is only discussing planning or asking for lightweight help, which is especially risky here because the skill launches multi-agent orchestration for large-scale book generation and revision workflows.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The README describes a workflow that sets up a repo, generates chapters, research, reviews, logs, and final outputs, but it does not clearly warn users that running the skill will create and modify many files across the workspace/repository. In a multi-agent workflow, this omission can lead to unintended local changes, repository pollution, or accidental overwrites, especially when users invoke it on an existing project rather than an isolated directory.
Content: No source excerpt is available for this finding.

Overly Broad Trigger

Low

Category: Trigger Abuse
Confidence: 70% confidence
Finding: The very short trigger 写书 is prone to accidental matches in ordinary conversation. This matters because accidental invocation can launch a skill with file, shell, network, and repository-modification behavior rather than a harmless drafting assistant.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The PR workflow explicitly copies the original chapter to chapters/chapter-NN-pre-revision.md, while the later integration guidance says 'No backups' and states that git history is the backup. This is a direct contradiction between the skill's own procedural guidance and its stated revision policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The image-generation command passes --language en, forcing English output regardless of the user's preferred language. This is a natural-language locale constraint documented in the skill, but the file does not present it as an option or justify it as region-specific behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The trigger list mixes English and Chinese phrases, but the manifest does not explain whether the skill will operate in the user's language, switch languages automatically, or impose any locale-specific behavior. This can create ambiguity around language handling without explicit user choice or documentation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.