Weekly Content Brief: Free OpenClaw Skill

• Outcome: Review
• Latest audit: Aug 2, 2026 · 1:30 AM UTC
• Version: 1.0.0

Overview

This skill is openly meant to send WhatsApp content briefs, but it combines scheduled autonomous messaging with session-log reading and an inaccurate read-only permission claim.

Review this before installing if your OpenClaw session logs may contain private prompts, customer data, credentials, or sensitive business notes. The safer setup would send only calendar-derived content, or require preview/approval before any WhatsApp message that uses session-log information.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The skill claims to be read-only and to perform no writes, but it explicitly sends WhatsApp messages and error alerts, which are outbound side effects. This mismatch can mislead users and policy engines into granting autonomous execution under a lower-risk classification than the behavior actually deserves.

Scope Creep

Medium

• Confidence: 96% confidence
• Finding: The declared permission model says read-only/no writes, but the workflow includes sending a WhatsApp brief, which is an external action. Misstating the scope lowers operator awareness and can bypass safeguards that would normally apply to data leaving the system.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The description says the skill reads the content calendar and recent session logs, but it does not clearly warn that information derived from those sources will be sent to WhatsApp. Users may reasonably interpret the skill as an internal summarizer rather than an external data-sharing workflow.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Reading recent session logs and using them to compose a WhatsApp brief creates a natural language exfiltration path for sensitive information present in logs. Even if only 'shipped last week' is intended, logs may contain prompts, internal notes, credentials, customer data, or other sensitive context that could be summarized or inferred.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The step-by-step workflow explicitly instructs the agent to read the five most recent session logs and include findings in a WhatsApp message, which is direct external disclosure. Because session logs often contain broad conversational history, this expands the leak surface beyond the narrow business purpose of a content brief.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**safety_constraints:**
- permissions: read-only
- writes: none
- approval_tier: 1 (autonomous) - read-only query, no approval needed
- scope: ~/content-calendar.md, ~/.openclaw/agents/main/sessions/ only
- cannot_access: email, social accounts, platform APIs, any write operation
- on_error: send WhatsApp alert, do not retry automatically

• Confidence: 84% confidence
• Finding: no approval

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.