Security audit

Creator Skill V2

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its paid influencer-search purpose, but it asks agents to handle real subscription onboarding and persistent API-token setup in ways users should review carefully.

Install only if you intend to use a paid skill.deinai.ai influencer-search account. Do not let an agent complete any billing step unless you personally review the Stripe Checkout page, amount, and subscription terms. Treat sk_live_ tokens as secrets: avoid pasting them into shared logs or screenshots, prefer the shortest practical lifetime, and revoke/rotate the token if it appears in shell history, transcripts, or exported MCP configuration.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: references/install.md:99
Finding: Long-Lived Bearer Token Exposed Through CLI Arguments and Persistent MCP Configuration
Content: View full analysis
" }, "connectionTimeoutMs": 180000, "timeoutMs": 180000 }' ``` From `references/onboarding.md:155-167`: ```bash openclaw mcp set creator-skill-v2 '{ "url": "{SKILL_API_BASE_URL}/mcp", "transport": "streamable-http", "headers": { "Authorization": "Bearer " }, "connectionTimeoutMs": 180000, "timeoutMs": 180000 }' ``` From `references/openclaw-tui-prompt.txt:119-135`: ```text 9. `POST /api/v1/tokens`, body: `{"name":"openclaw-onboarding"}` → save `sk_live_` 10. Immediately search through MCP: - Header: `Authorization: Bearer ` 12. Asynchronously run `openclaw mcp set creator-skill-v2` with Bearer `sk_live_`. ``` ### Technical Analysis The documented workflow creates an `sk_live_` bearer token and places the literal credential inside an `openclaw mcp set` command. The installation documentation also permits tokens with an expiration period of 365 days. Supplying a secret directly in a command argument can expose it through: - Interactive shell history. - Process-command-line inspection while the command is running. - Terminal session recordings. - Debug or audit logs that capture executed commands. - Automation logs or error reports. - Copy-and-paste records and command transcripts. The command also appears to persist the authorization header as part of the MCP server configuration. Unless OpenClaw encrypts or externally references this value, the bearer token may remain as plaintext in a local configuration file. The ...[truncated 1694 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document explicitly instructs the agent to complete Stripe checkout automatically, including a fully automated path using an automation key and a rule forbidding waiting for user confirmation of payment. That creates a clear risk of unauthorized financial transactions and bypasses an important human approval checkpoint for a real-money action.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The prompt usage section points users to a production flow involving real Stripe payment but does not present a prominent warning that charges may occur or require an explicit consent gate before the agent proceeds. In the context of an agent skill, this omission is especially dangerous because users may paste the prompt and unintentionally authorize a workflow that performs billable actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The primary descriptive instruction at L16 is written in Chinese and the onboarding prompt reference at L42 is also presented in Chinese, with no indication that users can choose another language. This creates a locale/language policy concern because the skill appears to impose a specific language without user opt-in or a documented region-specific reason.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file presents all operational guidance, error handling, and debugging instructions exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or documented justification is a reportable issue.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The onboarding expands a search skill into a tightly coupled account creation, subscription purchase, token issuance, and MCP configuration flow, which materially increases the scope of actions an agent is instructed to take. This is dangerous because it normalizes autonomous execution of financially and security-sensitive steps that are not inherent to merely searching influencers, increasing the chance of unauthorized purchases, unnecessary data disclosure, and credential creation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document instructs creation of a long-lived sk_live_ token with a 365-day lifetime and immediate placement into MCP configuration headers, without warning about credential sensitivity, storage risks, or rotation practices. Long-lived bearer tokens substantially increase blast radius if logs, prompts, local config, or agent memory are exposed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instruction text begins entirely in Chinese and establishes the assistant role without any indication that the user may choose another language. This creates a natural-language locale policy issue because the skill appears to enforce a specific language by default rather than offering opt-in or fallback behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The document is entirely written as operative skill instructions in Chinese and does not indicate that language choice is optional or limited to a China-specific/regional workflow. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The entire skill documentation is written in Chinese, including headings, parameter explanations, and agent instructions, with no indication that users may choose another language or that the tool is intended only for a Chinese-speaking or China-specific context. Under the stated policy, imposing a specific language without opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: references/install.md:132