Security audit

OpenClaw Lobster Soul Forge

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed OpenClaw persona generator with limited local scripts and optional, user-visible file outputs.

Install only if you want an OpenClaw persona-generation workflow. Use the manual avatar prompt fallback unless you have separately reviewed baoyu-image-gen, and choose a dedicated output directory so SOUL.md and IDENTITY.md do not overwrite files you care about.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:42
Finding: Unpinned External Skill Recommendation and Invocation
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:42-60, SKILL.md:155-174, references/avatar-style.md:83-105, references/error-handling.md:17-20
Vulnerability Type: Unpinned third-party Skill dependency
Risk Level: Medium

Vulnerable Code

From SKILL.md:42-60:

markdown
## Optional Dependency ### Avatar Auto-Generation: baoyu-image-gen skill The core output of this Skill is **text** (SOUL.md + IDENTITY.md + avatar prompt). Image generation is an **optional enhancement** provided by `baoyu-image-gen`. **Decision logic**: - If `baoyu-image-gen` is installed → call it in Step 5 to auto-generate - If not installed → output the full prompt text; user copies it to Gemini / ChatGPT / Midjourney **How to call** (only when installed): 1. Write prompt to `/tmp/openclaw-[lobster-name]-prompt.md` 2. Invoke `baoyu-image-gen` skill with the prompt file and output path > Install baoyu-image-gen: [https://github.com/JimLiu/baoyu-skills](https://github.com/JimLiu/baoyu-skills)

From references/avatar-style.md:83-105:

markdown
## Image Generation Flow Once the prompt is assembled: ### Path A: baoyu-image-gen skill is installed 1. Write to file using the Write tool: `/tmp/openclaw-[lobster-name]-prompt.md` 2. Call the `baoyu-image-gen` skill to generate the image 3. Use the Read tool to display the generated image to the user 4. Ask if the user is satisfied; if not, adjust variables and regenerate ### Path B: baoyu-image-gen skill is not installed Output the complete prompt text with manual generation instructions: ```markdown **Avatar Prompt** (copy and paste into any of these platforms): - Google Gemini: paste directly - ChatGPT (DALL-E): paste directly - Midjourney: paste then add `--ar 1:1 --style raw` > [Full English prompt] Install the baoyu-image-gen skill for automatic image generation: https://github.com/JimLiu/baoyu-skills

text
### Techni ...[truncated 1922 chars]
Remediation: View remediation
Remediation Suggestions

Pin the external dependency to a reviewed commit hash or immutable, signed release rather than referencing a mutable repository head.

Publish the expected source revision and cryptographic checksum in SKILL.md.

Require signature or checksum verification before allowing the dependency to run.

Require explicit user confirmation before delegating work to the external Skill, even when it is already installed.

Document the dependency's required file, network, and tool permissions and enforce least privilege.

Run image generation in a sandbox with access limited to the prompt file and a designated output directory.

Preserve the existing prompt-only fallback so users can complete the workflow without installing or executing the external component.

Re-audit and update the pinned revision through a controlled dependency-review process.

SkillSpector

Vulnerability Patterns

System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description overstates the implemented functionality. The code only does random combination selection from text pools and outputs a brief persona sketch. It does not create the full set of artifacts the description promises, such as SOUL.md, identity positioning, boundary rules, name, or avatar prompt/image generation. In fact, the output explicitly tells the user to take the combo and ask an AI to derive those missing pieces, confirming those capabilities are not implemented here. The random/gacha aspect is consistent with the description, but the primary declared purpose of complete soul creation is not accurately represented by this code chunk.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.
md
| Failure | Degraded Behavior | |---------|------------------| | Python unavailable | Skip gacha.py; randomly select from 10 preset categories | | baoyu-image-gen not installed | Output prompt text for manual use | | baoyu-image-gen generation fails | Retry once; if still failing, output prompt text | | Any unexpected error | Log error, skip that step, continue main flow |

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · references/error-handling.md (reported line 19)May include surrounding context.
md
| Error Scenario | Detection | Degradation | User Message | |----------------|-----------|-------------|--------------| | baoyu-image-gen skill not installed | Check if skill exists | Output full prompt text + manual platform instructions | "baoyu-image-gen skill not found — outputting the prompt for manual use" | | baoyu-image-gen call fails | Skill returns error | Retry once; if still failing, output prompt text | "Image generation failed — outputting the prompt for manual use" | ### Type C: Runtime Exception

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.
md
| Error Scenario | Detection | Degradation | User Message | |----------------|-----------|-------------|--------------| | baoyu-image-gen skill not installed | Check if skill exists | Output full prompt text + manual platform instructions | "baoyu-image-gen skill not found — outputting the prompt for manual use" | | baoyu-image-gen call fails | Skill returns error | Retry once; if still failing, output prompt text | "Image generation failed — outputting the prompt for manual use" | ### Type C: Runtime Exception

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · references/error-handling.md (reported line 20)May include surrounding context.
md
| Error Scenario | Detection | Degradation | User Message | |----------------|-----------|-------------|--------------| | baoyu-image-gen skill not installed | Check if skill exists | Output full prompt text + manual platform instructions | "baoyu-image-gen skill not found — outputting the prompt for manual use" | | baoyu-image-gen call fails | Skill returns error | Retry once; if still failing, output prompt text | "Image generation failed — outputting the prompt for manual use" | ### Type C: Runtime Exception

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest says the skill is 'Not for: tweaking an existing SOUL.md' at L008-L010, but the workflow explicitly defines a 'Polish Mode' for users who say 'Refine this soul' or attach an existing SOUL.md. This is an active contradiction between the skill's own documentation and the behavior it instructs the agent to perform.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The template instructs the agent to ask for a target directory and then generate SOUL.md and IDENTITY.md, but it does not require a clear user-facing disclosure that this will create or overwrite files on disk. In an agent context, that omission can cause users to authorize actions without understanding the persistence side effect, increasing the risk of unintended file writes or overwrites in sensitive locations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The avatar-generation instructions explicitly require a "full English prompt" for downstream use on image platforms. This is a language constraint presented as default behavior, and the skill does not offer any user opt-in or alternative locale choice nearby, which conflicts with the language-choice policy.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The compatibility section states 'This Skill contains no network requests or file-sending code,' but earlier instructions direct the agent to write an avatar prompt to /tmp and invoke another skill with that prompt file and an output path. While this may not be network transfer, the wording 'no file-sending code' conflicts with the documented behavior of passing a file to another component.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file explicitly directs the skill to write assembled prompt content to /tmp/openclaw-[lobster-name]-prompt.md, which is a file-write operation affecting the local system. The surrounding instructions do not warn the user that a file will be created or that prompt contents may be stored on disk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Remediation Suggestions

SkillSpector

Tp4

Direct Prompt Extraction

Direct Prompt Extraction

Direct Prompt Extraction

Direct Prompt Extraction

Intent-Code Divergence

Missing User Warnings

Natural-Language Policy Violations

Intent-Code Divergence

Missing User Warnings

Static analysis