Sales Content Gen Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:18 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent marketing-content generator, but it has broad activation triggers, under-disclosed third-party AI data flows, and an unpinned npm install step that users should review before installing.

Review this skill before installing. Avoid sending confidential launch plans, customer data, unpublished product details, or regulated content unless you are comfortable with the named AI providers and their data handling. Prefer a version that narrows activation phrases and pins or verifies the npm dependency.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:7

Finding

Unpinned npm Dependency Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 7-10
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

yaml

openclaw: {
  requires: { bins: ["curl"] },
  install: [
    { id: "node", kind: "node", package: "clawhub", bins: ["clawhub"] }
  ]
}

Technical Analysis

The installation configuration specifies the npm package clawhub without an exact version, lockfile, or integrity hash. Consequently, the package content installed at deployment time can differ from the content that was available during review.

npm packages can define lifecycle scripts that execute during installation. If the registry package, a maintainer account, or the dependency chain is compromised, malicious code could therefore run under the privileges of the process installing the Skill. The project contains no vendored dependency source or integrity metadata that would allow the resolved artifact to be independently verified.

Attack Path

1. An attacker compromises the package publisher, registry entry, or a transitive dependency associated with clawhub.
2. The attacker publishes a malicious version under the same package name.
3. A user installs or deploys the Skill after the malicious release becomes the version selected by npm.
4. The package manager downloads the mutable package and its dependency tree.
5. Malicious package code or an npm lifecycle script executes with the privileges of the installer.

Impact Assessment

Successful exploitation could permit arbitrary code execution in the installation environment. The attainable privileges are limited by the account or container performing installation; if installation is performed by a privileged user, the impact could include access to sensitive files, environment variables, credentials, and other projects available to that account. An attacker could also modify local files, install additional payloads, or initiate ou ...[truncated 103 chars]

Remediation

View remediation

Remediation Suggestions

• Pin clawhub to a reviewed, exact version rather than allowing mutable version resolution.
• Maintain and verify a lockfile containing package integrity metadata.
• Obtain packages only from an explicitly trusted registry and configure registry scope rules where applicable.
• Review the selected package and its transitive dependency tree before deployment.
• Disable npm lifecycle scripts during installation when they are not required, such as by using --ignore-scripts.
• Run dependency installation in an isolated, least-privileged container or account without access to production credentials.
• Use automated dependency monitoring and require manual security review before updating the pinned version.
• Where supported by the Skill packaging system, verify the package against an approved checksum, signature, or provenance attestation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger phrases include very broad, common language such as "generate image," "create video," "make music," and especially "write content," which can match many normal user requests and cause unintended invocation. Because this skill can route prompts and business materials to external generation services, accidental activation increases the chance of unexpected data disclosure, unwanted actions, and user confusion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises use of external AI services such as ComfyUI, Suno, and RunPod but does not warn users that their prompts, marketing copy, brand materials, or other business-sensitive content may be transmitted to third-party providers. In a sales and marketing context, this omission is significant because users may submit confidential campaign plans, unpublished product information, or proprietary branding assets without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.