Security audit

title

Security checks for vulnerabilities and agentic risk

Overview

The skill itself is a narrow Xiaohongshu title-writing helper, but its README points users to an ambiguous install target and a mutable external setup guide.

Review the install source carefully before installing. Prefer an exact, verified package name matching `xiaohongshu-title`, confirm the publisher and version, and treat the external setup guide as unreviewed. Use this skill when you intentionally want Chinese Xiaohongshu/RedNote-style, CTR-optimized titles, not neutral or general-purpose rewriting.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: README.md:6
Finding: Unverified and Mismatched Skill Installation Target
Content: View full analysis
📖 **Complete setup guide**: https://skillboss.co/skill.md ``` ### Technical Analysis The package declares its Skill name as `xiaohongshu-title` in `SKILL.md`, while the README instructs users to install the generic identifier `title`. The installation command does not specify an immutable version, digest, verified registry, or publisher identity. The README also delegates the complete setup procedure to content hosted on an external domain. That content is mutable and was not included in the audited project. Although the local project does not automatically download or execute this URL, users following the documentation may rely on instructions that can change independently after the package has been reviewed. This creates a supply-chain ambiguity: the installed Skill may not correspond to the audited `xiaohongshu-title` project, and the remote guide may later direct users to install or execute additional unreviewed components. ### Attack Path 1. A user obtains and reviews this project. 2. The user follows the README and runs `openclaw skill install title`. 3. The Skill registry resolves the generic `title` identifier to a package that may differ from the audited `xiaohongshu-title` Skill. 4. Alternatively, the user opens the externally hosted setup guide. 5. If the registry entry or remote guide is compromised, replaced, or controlled by an untrusted publisher, it can direct the user to install or execute an unintended package. 6. The unintended package then operates with whatever filesystem, network, tool, or Agent permissions the OpenClaw environment grants to installed Skills. The final exploitation steps are conditional on compromise or malicious co ...[truncated 668 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill hard-codes a specific emotional, platform-native output style as its default behavior without indicating that user preference should override it. This can lead to unwanted manipulation of tone, mismatch with user expectations, or generation of persuasive content styles even when the user has not asked for that framing.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger condition is effectively any user-provided raw text or topic, which makes the skill eligible to activate in a very broad set of conversations without clear scoping or consent. Overly broad activation can cause inappropriate invocation, unexpected style transformation of user content, and interference with unrelated tasks, especially in agentic environments where multiple skills may compete for activation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This markdown file contains user-facing example content exclusively in Chinese, including headings and sample outputs, with no indication that users may choose another language. The policy requires flagging language or locale constraints when a skill effectively forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file contains prescriptive Chinese keyword dictionaries and Chinese-only example templates, which implies a fixed language/locale for the skill content. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The docstring states the function filters titles based on Xiaohongshu algorithm preferences, and the validation rules that follow are entirely tailored to Chinese titles and Chinese-platform conventions. This creates a locale/language-specific constraint without any natural-language indication of user choice or opt-in, which matches the policy concern for forced language or locale behavior.
Content: No source excerpt is available for this finding.