ClawHub
Back to skill

Security audit

OpenClaw Beautify Github Readme

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed README design helper that can edit repository files and run local visual checks, with clear user-control rules and no evidence of hidden or destructive behavior.

Install this only for repositories where you are comfortable letting the agent read project files, edit README-related files after confirmation, and run local rendering tools such as Chrome/Edge or ffmpeg. Review previews and diffs before approving commits, pushes, PRs, or publication.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/readme/en/hero.svg (reported line 16)May include surrounding context.

text
<text x="56" y="184" fill="#B9C0CF" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', 'PingFang SC', 'Microsoft YaHei', sans-serif" font-size="24" font-weight="500">Turn a repository homepage into a project-native visual story.</text>

  <!-- left pills -->
  <g font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', 'PingFang SC', 'Microsoft YaHei', sans-serif" font-size="18" font-weight="600">
    <rect x="56" y="236" width="116" height="46" rx="23" fill="#1A2130" stroke="#2A3346" stroke-width="1"/>
    <text x="114" y="265" text-anchor="middle" fill="#F4F6FA">Pure SVG</text>

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/readme/hero.svg (reported line 16)May include surrounding context.

text
<text x="56" y="184" fill="#B9C0CF" font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', 'PingFang SC', 'Microsoft YaHei', sans-serif" font-size="24" font-weight="500">把仓库主页，变成项目的门面 —— 先让人看懂，再谈视觉。</text>

  <!-- left pills -->
  <g font-family="-apple-system, BlinkMacSystemFont, 'Segoe UI', 'PingFang SC', 'Microsoft YaHei', sans-serif" font-size="18" font-weight="600">
    <rect x="56" y="236" width="150" height="46" rx="23" fill="#1A2130" stroke="#2A3346" stroke-width="1"/>
    <text x="131" y="265" text-anchor="middle" fill="#F4F6FA">纯 SVG</text>

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/svg_safety.py (reported line 206)May include surrounding context.

python
raise SystemExit(f"ERROR: {label}: invalid argument list")

    try:
        return subprocess.run(
            command,
            check=check,
            shell=False,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This line states that SKILL.md was updated to add '语言中立' (language neutrality), which strongly implies the skill documentation previously lacked neutral language handling or imposed a language/locale expectation. That matches the policy category for language or locale policy violations in natural-language content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The English README includes a full Chinese sentence in the introductory block, which imposes a specific language on readers of the English document. The file does provide a separate Chinese README link, but this line itself does not offer opt-in or justify the locale mixing.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The README prominently sets Chinese as the default presentation (中文 | English), and the rest of the usage instructions are primarily in Chinese. This can be a language/locale policy concern because the skill experience appears to assume a specific language rather than explicitly asking the user for their preferred language when using the skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The image description and visible text include Chinese-language messaging, but there is no accompanying indication that the skill is intentionally region-specific or that users can choose another language. Under the policy, language constraints without opt-in or justification can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This SVG contains prominent user-facing text in Chinese across the title, description, and card captions, with no indication that language selection is optional or that the asset is intentionally region-specific. Under the policy check for language or locale constraints, this is a natural-language issue because the file presents a fixed language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

该 markdown 文件以中文标题和中文执行指令开篇，整体内容也默认采用中文表达，没有向用户提供语言/locale 选择或说明这是可选的。根据规则，强制或默认限定单一语言且无用户 opt-in 的自然语言表述可构成语言/locale 政策问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

Line L33 states 'ja 版删除', which is a natural-language indication that Japanese-language support/content was removed. This can conflict with language/locale policy expectations because it narrows language availability without documenting user choice or a clear region-specific justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.