Security audit

Topical

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Topical/OpenClaw integration, but its webhook path can automatically wake and direct an agent with externally supplied content without enough verification or confirmation.

Review before installing. Use a least-privileged OpenClaw agent for Topical webhooks, keep the hook bearer token strong, consider setting deliver=false until you trust the flow, and do not rely on this transform alone for Topical signature verification unless gateway-level verification is separately enforced.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: assets/topical-inbound.mjs:219
Finding: Untrusted webhook content is embedded directly into agent instructions
Content: View full analysis
line !== "") .join("\n"); } const eventFooter = [ "", "Share this development with the user. Offer the source links so they can read more.", "Take any follow-up actions you think they might want based on this news.", telegramFooter, ].join("\n"); ``` ### Technical Analysis The transform concatenates externally supplied webhook fields, including `event.mar ...[truncated 2360 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: assets/topical-inbound.mjs:165
Finding: Documented webhook signatures and timestamps are not verified by the transform
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:20
Finding: Installation instructions use unpinned third-party global skill dependencies
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description says the skill queries Topical intelligence data via MCP for news, signals, trends, and links. However, the actual code does not query any external service, fetch intelligence, or interact with MCP. Its sole behavior is local setup: creating a destination directory, copying a transform module, and initializing a config file if one does not already exist. That is a materially different primary purpose from the declared runtime querying behavior, so this is a clear description/behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description says the skill is for querying Topical topic intelligence content through MCP. However, the supplied code does not query Topical data, news, trends, or source links at all. Instead, it performs post-installation/local-environment validation: it checks for presence of transform/config files, verifies openclaw.json exists, and optionally runs openclaw mcp list to confirm the Topical MCP server is registered. That is a materially different primary purpose from the declared intelligence-querying functionality, so this is a description-behavior mismatch.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code explicitly instructs the agent to relay Topical content directly to the user and states that replies are delivered automatically when deliver=true, with no approval, confirmation, or visible disclosure step. Because the content originates from an external webhook and is wrapped as agent instructions, a compromised or erroneous upstream source could cause unsolicited messages or manipulative content to be sent to the user automatically.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This function takes external webhook payload data, transforms it into a natural-language agent message, and forwards it into an agent session without any runtime labeling, sanitization for prompt-injection semantics, or provenance disclosure to the downstream agent/user. Even though allowUnsafeExternalContent is set to false, the external content is still embedded in the agent message body, which can enable indirect prompt injection, misleading instructions, or silent propagation of untrusted content.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.