Security audit

Creator Skill V2

Security checks for vulnerabilities and agentic risk

Overview

This skill appears aimed at OpenClaw account onboarding, but it automates real payment and long-lived credential setup without enough explicit user consent or secret-handling boundaries.

Review before installing. Only use this skill if you are comfortable with it helping create or configure an OpenClaw account, start a real Stripe subscription flow, create a live long-lived API token, and store that token for MCP use. Require the agent to ask for explicit confirmation before checkout, payment, token creation, order polling, or MCP configuration, and store any token only as a secret that can be revoked or rotated.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill explicitly instructs the agent/user to use a live production token (`sk_live_`) but does not include any warning not to expose, log, paste into prompts, or store the credential insecurely. In an agent ecosystem, documentation that normalizes handling live secrets without safety guidance increases the chance of accidental credential leakage through chat history, tool logs, screenshots, or shared configs.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The onboarding flow explicitly instructs the agent to proceed through subscription checkout and payment automation, including real production Stripe flows, without requiring a clear, affirmative user confirmation immediately before incurring charges. In an agentic context, this creates a real risk of unauthorized purchases or confusing users about when money will be charged, especially because the document says not to wait for the user to say they paid and emphasizes automation.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document directs the agent to create a long-lived `sk_live_` API token with `expires_in_days: 365` and then store/use it in MCP configuration headers, but it does not warn about the sensitivity, persistence, or handling requirements for such credentials. Long-lived bearer tokens increase the blast radius of leakage, reuse, logging exposure, or accidental persistence in agent/tool state.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The prompt is written as a broadly applicable operational playbook and does not define clear trigger conditions, user-intent checks, or exclusion criteria for when the skill should activate. In a payment-enabled account workflow that performs registration, subscription checkout, token creation, and MCP/API calls, overly broad invocation can cause the agent to enter sensitive flows in unrelated conversations, increasing the chance of unintended account actions or exposure of live-payment/token operations.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: The skill opens with a Chinese-only operational instruction set and does not provide a language-selection or fallback mechanism, which can lead to user misunderstanding during sensitive payment and credential/token handling steps. In this context, confusion about real Stripe charges, account registration, password disclosure, or token usage can cause accidental consent, misconfiguration, or unsafe handling of secrets.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The document instructs the agent to provide a checkout URL, poll order status, then perform direct MCP search and an asynchronous `openclaw mcp set`, but it does not explicitly require informed user consent for the polling, data transmission, or post-payment account-side configuration changes. In a payment and account-provisioning context, silent automation can cause unauthorized state changes or surprise users about what actions the agent will take on their behalf.

Static analysis

Detected: suspicious.secret_argv_exposure

Instructions pass high-value credentials through process argv.

Critical

Code: suspicious.secret_argv_exposure
Location: references/install.md:132