Psd Automator

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:17 AM UTC
• Version: 1.0.2

Overview

This PSD automation skill is mostly purpose-aligned, but needs review because its dry-run can still write or copy files and its local index can persist a broad inventory of design files.

Review before installing on a workstation with sensitive design assets. Use explicit --root values for indexing, avoid the Desktop/Documents default, review or delete ~/.openclaw index and audit files, do not rely on dry-run as zero-write behavior, set styleLockSoftRetry to false when style integrity matters, and constrain task output paths and sender allowlists.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/run-task.js:367

Finding

Dry-run mode performs unintended filesystem writes

Content

View full analysis

{} }; const edits = normalizedTask.input.edits || []; const plannedExports = Array.isArray(normalizedTask.output?.exports) ? normalizedTask.output.exports : []; const matchImagePath = normalizedTask.options?.matchImagePath ? path.resolve(expandHome(normalizedTask.options.matchImagePath)) : ""; const enableBundleZip = normalizedTask.options?.bundleZip === true; const plannedPngPaths = plannedExports .filter((item) => item.format === "png") .map((item) => item.mode === "layer_sets" ? resolvePngOutputDir(item, workingInfo.workingPath) : resolvePngOutputPath(item, workingInfo.workingPath), ); if (dryRun) { ``` ### Technical Analysis A dry-run is expected to calcula ...[truncated 2170 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/run-task.js:500

Finding

Style-lock integrity control is silently disabled after a mismatch

Content

View full analysis

{ if (platform === "darwin") { return runMacModify( pathBridge.executionPath, edit.layerName, edit.newText, pathBridge.executionPath, timeoutMs, false, ); } return runWinModify( workingInfo.workingPath, edit.layerName, edit.newText, workingInfo.workingPath, timeoutMs, false, ); }, }); if (relaxedResult && relaxedResult.status === 0) { styleLockFallbackUsed = true; result = relaxedResult; } } } ``` ### Technical Analysis The style-lock mechanism verifies that changing text does not unexpectedly alter the Photoshop text layer's font or size. This is an output-integrity safeguard and is described by the Skill documentation as part of its safety baseline. However, `styleLockSoftRetryEnabled` defaults to `true` because it is disabled only when the caller explicitly supplies `styleLockSoftRetry: false`. When an edit fails with `E_STYLE_MISMATCH`, the runner automatically repeats the edit with the ...[truncated 1754 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code chunk does not implement the declared Photoshop PSD text-replacement behavior. It only provides a helper function for expanding home-directory shortcuts in file paths. While such a utility could support file handling in a larger system, this chunk by itself has a materially different and much narrower purpose than the declared description. Therefore, the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The code chunk does not implement the declared end-to-end PSD automation behavior. Instead, it handles task file loading and task schema validation/normalization. That by itself could be a supporting component, but it also exposes capabilities beyond the description: notably image placement and text deletion in addition to text replacement. More importantly, many prominent declared features—dry-run safety, style-lock checks, rollback, local PSD index cache, and Photoshop/dialog behavior—are not reflected in this code. Since the description is specifically about a Photoshop PSD text-replacement skill, while this chunk is a generic task parser/normalizer with broader edit types, the description does not accurately represent what this code actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose centers on automating text replacement inside PSD files via Photoshop workflows. This code chunk does not interact with PSDs, Photoshop, text layers, chat channels, rollback logic, or safety/style checks. Its actual purpose is unrelated image analysis: loading raster images with sharp, comparing them visually, hashing image pixel content in directories, and identifying changed image files. While filesystem access could be a supporting detail in some skills, here the primary behavior is materially different from the declared Photoshop text-replacement functionality, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The code substantially includes the declared PSD text-replacement workflow features: Mac/Windows execution, dry-run mode, style-lock checks, backup creation (a form of rollback support), and local PSD path resolution via an index. However, it also implements several materially broader capabilities not disclosed in the description. Most notably, it can export PNGs and layer/artboard image sets, compare exported images using visual similarity against a reference image, package exports into ZIP files, and place external images into PSDs on Mac. These are not just internal implementation details; they are user-facing capabilities that extend the skill beyond 'PSD text replacement.' Therefore the description does not accurately represent the full behavior of the code.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md

4. Subagent runs `run-task.js` locally.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill instructs users to build and refresh a local PSD index stored under a persistent path such as ~/.openclaw/psd-index.json. Persistent indexing of project roots can expose sensitive file names, directory structures, and asset locations across sessions or to other local processes/users if permissions and retention are not tightly controlled.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

Build and Refresh PSD Index

Create or refresh local cache:

bash

node skills/psd-automator/scripts/build-index.js \

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script defaults to recursively scanning the user's Desktop and Documents folders when no explicit root is provided, which collects metadata about PSD/PSB files unrelated to the immediate task. In this skill context, that behavior expands access far beyond a specific requested file and can silently inventory sensitive design assets and associated sidecar text/layer metadata.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script performs broad recursive indexing and persists the results to ~/.openclaw/psd-index.json without any upfront notice, confirmation, or data minimization. Because the index includes file paths, project names, modification times, sizes, and sidecar-derived layer/text metadata, it creates a durable local inventory of potentially sensitive design content that users may not expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code creates backups and later copies, writes, and overwrites PSD, PNG, and ZIP files, but the script only emits structured results after execution and does not provide any user-facing warning or confirmation before modifying files. For a code file, safety-relevant file writes should have at least some visible disclosure in code comments, prompts, or logging unless clearly documented elsewhere in markdown, which is not present in this file.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill accepts an external reference image path and performs visual similarity analysis against generated outputs, which is not necessary for basic text replacement. This broadens the skill into processing arbitrary local images and can expose additional sensitive files or metadata through side-channel selection logic, especially when file paths are supplied from chat-driven tasks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script goes beyond simple PSD text replacement by supporting image placement, PNG export, and ZIP bundling. Those capabilities materially expand data access and modification scope, which increases the chance of unintended file writes, exfiltration via packaged outputs, or use outside the declared skill purpose; the risk is amplified because paths and export targets are task-controlled.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The file contains prescriptive natural-language response requirements specifically for DingTalk, and the only natural-language dispatch example is in Chinese. While the marker format itself is language-neutral, the skill does not offer any user opt-in or alternative locale behavior for this chat-channel-specific response pattern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The inline comment and returned error make clear that place_image is unsupported on Windows, while the broader skill positioning emphasizes Mac and Windows automation. This creates an intent/documentation gap for at least one supported operation, since the code contradicts an implied uniformly cross-platform capability.

Content

No source excerpt is available for this finding.