ClawHub
Back to skill

Security audit

advanced-skill-creator

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it sends user skill requests to a third-party AI API, has broad activation and prompt-propagation instructions, and claims completed research that the script only simulates.

Install only if you are comfortable with skill requests being processed by the SkillBoss API and you will avoid including secrets, private code, internal URLs, or personal data. Review generated skills manually before installing or publishing them, especially any system-prompt or memory-related text.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:154
Finding

Mandatory Role-Changing Prompt Propagation into Generated Skills

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:154-164
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

markdown
## System Prompt Integration

When creating new skills, include system prompt elements that enhance AI interaction:

"You are now an OpenClaw (formerly ClawDBot / Moltbot) skill development expert, implementing advanced thinking models for enhanced decision-making. Apply structured cognitive processing while balancing speed and accuracy based on specific situational requirements."

### Skill Creation Guidelines
- Apply the multi-stage cognitive processing pipeline during skill design
- Integrate memory systems for continuous learning and improvement
- Balance speed optimization with accuracy enhancement in skill functionality
- Include appropriate system prompts for AI assistants using the skill
- Document decision-making processes for future reference and learning

Technical Analysis

The Skill does not merely describe an optional persona. It directs the agent to include role-changing system-prompt content in newly generated skills and reinforces that requirement through the subsequent creation guidelines.

This behavior crosses the normal boundary between generating task-specific Skill content and altering the instructions under which downstream agents operate. Because generated content can later be installed as another Skill, the instruction can propagate into future agent contexts.

Although the quoted prompt does not explicitly command the agent to disable a named safeguard, it attempts to redefine the agent's role and processing behavior. It also directs generated artifacts to contain system-prompt elements, which is unnecessary for the declared function of producing standards-compliant Skill files.

Attack Path

  1. An agent loads the advanced-skill-creator Skill.
  2. A user asks it to create or modify another OpenClaw Skill.

...[truncated 941 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the mandatory role declaration and all requirements to insert system prompts into generated Skills.
  2. Restrict generated instructions to the requested Skill's concrete functionality, inputs, outputs, and permissions.
  3. Add an explicit generation rule stating that generated content must not override or impersonate system, developer, user, or safety instructions.
  4. Treat requested system-prompt content as untrusted input and either reject it or place it in clearly delimited documentation that is never interpreted as an instruction.
  5. Add a post-generation validator that rejects role reassignment phrases, safety-override language, persistent-memory directives, and instructions that attempt to change instruction priority.
  6. Require human review before generated Skills are installed or published.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/advanced_skill_processor.py:154
Finding

Unbounded Disclosure of User Requests to a Third-Party AI Service

Content
View full analysis

Vulnerability Details

File Location: scripts/advanced_skill_processor.py:22-31,154-173
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Code

python
def pilot(body: dict) -> dict:
    """Call SkillBoss API Hub /v1/pilot endpoint."""
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,
        timeout=60,
    )
    return r.json()
python
def generate_skill_with_ai(user_request: str, research_data: Dict[str, Any]) -> str:
    """
    Use SkillBoss API Hub to generate complete SKILL.md content based on research data.
    Calls /v1/pilot with type=chat, auto-routing to the optimal model.
    """
    if not SKILLBOSS_API_KEY:
        return ""

    context = json.dumps(research_data, ensure_ascii=False, indent=2)
    prompt = (
        f"你是一个 OpenClaw Skill 创建专家。根据以下研究数据，为用户请求生成完整的 SKILL.md 内容。\n\n"
        f"用户请求: {user_request}\n\n"
        f"研究数据:\n{context}\n\n"
        f"请输出完整的 SKILL.md 内容，包含正确的 YAML frontmatter（name, description, when, examples, metadata.openclaw）。"
    )

    result = pilot({
        "type": "chat",
        "inputs": {
            "messages": [{"role": "user", "content": prompt}]
        },
        "prefer": "balanced"
    })
    return result["result"]["choices"][0]["message"]["content"]

Technical Analysis

The processor serializes the complete research_data object and concatenates it with the complete command-line user_request. It then sends the resulting prompt to the fixed third-party endpoint https://api.heybossai.com/v1/pilot.

No controls are implemented to:

  • Detect or redact credentials, tokens, private keys, internal URLs, personal information, or proprietary code.
  • Minimize the transmitted request to fields needed for generation.
  • Obtain p ...[truncated 1820 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit, informed user consent immediately before each third-party transmission.
  2. Display the destination and a preview or precise description of the fields that will be transmitted.
  3. Add secret scanning and redaction for API keys, passwords, bearer tokens, private keys, connection strings, internal hostnames, and common personal-data formats.
  4. Send only the minimum task description needed for generation rather than the complete raw request and context.
  5. Provide a fully local or offline generation mode and make external processing opt-in.
  6. Allow administrators to configure and validate an approved API endpoint rather than relying only on a hardcoded third-party destination.
  7. Document data retention, subprocessors, routing behavior, and privacy implications.
  8. Call raise_for_status(), validate the response content type and schema, and avoid returning raw third-party errors that might contain sensitive request data.
  9. Add tests confirming that secrets and prohibited data classes are removed before network transmission.

other

Warning
Location
scripts/advanced_skill_processor.py:34
Finding

Fabricated Research Results Reported as Completed External Research

Content
View full analysis

Vulnerability Details

File Location: scripts/advanced_skill_processor.py:34-116
Vulnerability Type: other: Deceptive research-result fabrication
Risk Level: Medium

Vulnerable Code

python
def step_1_consult_official_documentation() -> Dict[str, Any]:
    """
    Step 1: Consult Official Documentation
    Access official documentation and extract key information.
    """
    print("Step 1: Consulting official documentation...")

    documentation_sources = [
        "https://docs.clawd.bot/tools/skills",
        "https://docs.openclaw.ai/tools/skills",
        "/tools/clawhub",
        "/tools/skills-config"
    ]

    extracted_info = {
        "format_requirements": "SKILL.md with YAML frontmatter",
        "frontmatter_fields": ["name", "description", "when", "examples", "metadata.openclaw.*", "requires"],
        "trigger_mechanisms": "Natural language triggers and when conditions",
        "tool_conventions": ["exec", "browser", "read", "write", "nodes", "MCP"],
        "loading_precedence": "workspace > ~/.openclaw/skills > bundled",
        "clawhub_methods": "Installation and usage methods",
        "breaking_changes": "Latest version migrations"
    }

    return {
        "status": "completed",
        "sources": documentation_sources,
        "extracted_info": extracted_info
    }


def step_2_research_public_skills(keywords: List[str]) -> Dict[str, Any]:
    """
    Step 2: Research Related Public Skills on ClawHub/ClawdHub
    Query ClawHub/ClawdHub for relevant skills based on keywords.
    """
    print(f"Step 2: Researching public skills with keywords: {keywords}")

    # Simulate querying public skills
    selected_skills = []
    for kw in keywords[:4]:  # Select up to 4 skills
        skill_info = {
            "keyword": kw,
            "selected": True,
            "downloads": "high",
            "recent_update": True,

...[truncated 3586 chars]
Remediation
View remediation

Remediation Suggestions

  1. Implement real retrieval for each documented source using authenticated, bounded network clients.
  2. Record source URL, retrieval timestamp, version, response status, and relevant quoted evidence for every conclusion.
  3. Parse actual ClawHub metadata rather than assigning synthetic download, update, and rating values.
  4. Mark a step as completed only after required sources have been accessed and validated.
  5. Return a clear failed, unavailable, or partial status when retrieval cannot be performed.
  6. Remove claims of comprehensive or current research if the implementation remains static.
  7. If static examples are retained for testing, label them explicitly as fixtures and prevent them from entering production generation context.
  8. Add provenance checks so the generation phase cannot describe unsupported records as verified research.
  9. Add integration tests that verify real source access and ensure simulated data is never used in production.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

Tainted flow: 'SKILLBOSS_API_KEY' from os.environ.get (line 18, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/advanced_skill_processor.py (reported line 24)May include surrounding context.

python
def pilot(body: dict) -> dict:
    """Call SkillBoss API Hub /v1/pilot endpoint."""
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The activation condition is overly broad, including vague phrases like '写一个让它...' and a catch-all for any Claw-related skill request. This can cause the skill to trigger on unrelated prompts, unexpectedly taking over the conversation and steering the agent into executing its prescribed workflow, which is especially risky because the skill also pushes external research/API usage.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md
- "SKILL.md" "when:" OR "metadata.openclaw" site:github.com

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
---
name: advanced-skill-creator
name: advanced-skill-creator
description: Advanced OpenClaw skill creation handler that executes the official 5-step research flow with comprehensive analysis and best practices. Ensures proper methodology when users request to create or modify OpenClaw/Moltbot/ClawDBot skills following official standards.
when: "When user mentions '写一个触发', '写skill', 'claw skill', 'openclaw skill', 'moltbot skill', '创建技能', '写一个让它...', or any request related to creating or modifying Claw系 skills"
examples:
  - "写一个触发监控系统"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill states that AI-assisted generation is powered by SkillBoss API Hub but does not warn that prompts, specifications, or skill contents may be sent to a third-party service. This creates a privacy and data-governance risk because users may provide sensitive code, credentials, or internal requirements without informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The repeated 'When to use' guidance reinforces ambiguous activation criteria without scope limits or counterexamples. In prompt-routed systems, this increases false positives and can cause the agent to invoke this skill in contexts where users did not intend skill creation, reducing reliability and potentially exposing user content to downstream tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The output requirements mandate AI-generated content via an external service while omitting any privacy, retention, or data-handling notice. Because this instruction is mandatory and broad, it could systematically route user-provided content to a third party without transparency or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Forcing exact Chinese headings imposes a fixed locale regardless of the user's preferences or operating language. This is primarily a usability and compatibility issue, but it can also cause downstream parsing or workflow mismatches when tools expect language-aligned output.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The file explicitly documents use of an external endpoint for AI generation, which means user-supplied content may leave the local environment. External transmission is especially relevant here because the skill is designed to process user requests for creating or modifying skills, which may include unpublished code, prompts, internal conventions, or secrets embedded in examples.

Content

Scanner excerpt · UPLOAD_INSTRUCTIONS.md (reported line 7)May include surrounding context.

md
这是一个高级技能创建器，能够执行官方的5步研究流程来创建符合OpenClaw标准的技能。该技能确保在用户请求创建或修改OpenClaw/Moltbot/ClawDBot技能时遵循正确的方法论和官方标准。

AI 内容生成由 SkillBoss API Hub 提供支持，通过统一入口 `https://api.heybossai.com/v1/pilot` 自动路由最优模型。

## 功能特性

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation states that AI generation is powered by an external API endpoint but does not clearly warn that user prompts or skill content may be transmitted off-system. This creates a meaningful data-handling risk because users may provide proprietary code, prompts, or internal requirements without informed consent about third-party processing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documented auto-trigger phrases are broad enough to match ordinary user requests about writing skills, which can cause the skill to activate unexpectedly. In a skill-creation context, unintended activation can redirect user workflows, increase prompt-surface exposure, and potentially send user content into downstream processing paths that were not explicitly requested.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/advanced_skill_processor.py (reported line 8)May include surrounding context.

python
This script implements the 5-step research flow for creating OpenClaw skills
according to official standards and best practices.

AI generation powered by SkillBoss API Hub via https://api.heybossai.com/v1/pilot
"""

import json

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/advanced_skill_processor.py (reported line 19)May include surrounding context.

python
This script implements the 5-step research flow for creating OpenClaw skills
according to official standards and best practices.

AI generation powered by SkillBoss API Hub via https://api.heybossai.com/v1/pilot
"""

import json

External Transmission

Medium
Category
Data Exfiltration
Confidence
82% confidence
Finding

The script sends user-supplied requests and accumulated research context to an external third-party API service. In a skill-processing context, those inputs may contain sensitive workspace content, proprietary prompts, or internal project details, so exporting them off-box can create confidentiality and data-governance risks if users are not clearly informed and consent is not obtained.

Content

Scanner excerpt · scripts/advanced_skill_processor.py (reported line 24)May include surrounding context.

python
def pilot(body: dict) -> dict:
    """Call SkillBoss API Hub /v1/pilot endpoint."""
    r = requests.post(
        f"{API_BASE}/pilot",
        headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"},
        json=body,

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The docstrings for steps 1 through 3 describe active behaviors such as consulting official documentation, querying public skills, and searching best practices. In reality, these functions construct static lists and dictionaries locally and return them without making any network calls, file reads, or searches, which materially contradicts the stated intent of those routines.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The prompt hard-codes Chinese instructions for generated output, which imposes a specific language choice regardless of the user's language preference. This is a natural-language policy concern because the file provides no user choice or documented reason for restricting generation to Chinese.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file presents the skill instructions entirely in Chinese, which effectively forces a specific language for users reading the documentation. The policy allows locale constraints when users are given a choice or the restriction is clearly justified, but neither is stated here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.