ClawHub
Back to skill

Security audit

oh my skill, make skill easy!

Security checks for vulnerabilities and agentic risk

Overview

This skill is not overtly malicious, but it should be reviewed carefully because it turns session history into persistent reusable agent instructions with weak scoping and privacy safeguards.

Install only if you are comfortable with an agent inspecting recent session context and creating persistent skills from it. Do not use it on sessions containing secrets or private data, and review the complete generated SKILL.md before allowing it to remain in the active skills directory.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:37
Finding

Untrusted Session Content Can Be Converted into Persistent Agent Instructions

Content
View full analysis
/SKILL.md`. ``` ### Technical Analysis The Skill directs the agent to extract instructions, tool calls, decisions, and workflow steps from the current conversation and write the resulting content into a persistent `SKILL.md`. The prescribed desensitization stage only performs literal and regular-expression substitutions for selected sensitive values. It does not distinguish trusted agent decisions from untrusted user content, document text, web content, or tool output, and it does not detect prompt injection or unsafe operational instructions. Consequently, attacker-controlled content embedded in a completed workflow could be reproduced as an actionable workflow step. Saving that content under the persistent Skills directory allows it to influence later s ...[truncated 1796 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/desensitize.py:35
Finding

Incomplete Sensitive-Data Masking Can Persist Secrets in Generated Skills

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The skill claims to package completed workflows into reusable skills, but its operative content centers on inspecting the session and running a desensitization script. This description-behavior mismatch can mislead operators about what data is accessed and what actions are performed, increasing the chance of unnoticed session harvesting and persistence.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger criteria are extremely broad and proactive, causing the skill to activate after many ordinary multi-step tasks even when the user did not request persistence. In practice this increases the likelihood of capturing and saving sensitive workflow details without clear user intent.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
Write a `SKILL.md` with:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares no explicit tool scope while instructing the agent to read session content and write files under the skills workspace. That mismatch weakens reviewability and can lead to broader-than-expected file access during execution, especially when combined with proactive triggering.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

The skill is explicitly designed to persist details of prior sessions into reusable artifacts, and it does so proactively. Session persistence creates a durable record of user workflows and potentially embedded sensitive context, which can later be re-read, shared, or triggered again outside the original context.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: oh-my-skill
description: Automatically generate and save a reusable skill after AI agent successfully completes a complex task involving 5 or more tool calls. Use this skill whenever a multi-step workflow has just been completed successfully — such as document creation pipelines, data transformation flows, research-and-write tasks, multi-file editing workflows, or any agentic sequence that involved planning, tool use, and structured output. Trigger this skill proactively at the end of complex task completions even if the user hasn't asked for it, offering to save the workflow as a reusable skill. Also trigger when users say things like "save this as a skill", "make this repeatable", "turn this into a skill" or "oh-my-skill".
metadata:
  openclaw:
    requires:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly tells the agent to review and extract the current conversation/session, which expands access from a narrow workflow-summary task to broad session inspection. That can sweep up secrets, credentials, personal data, or unrelated user content and then persist parts of it into a new skill artifact.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The workflow tells the agent to analyze and extract session content before the desensitization step. This ordering defeats the stated privacy control because sensitive material may already be processed, copied into drafts, or exposed to later steps before any masking occurs.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

The template for drafting new skills encourages writing persistent trigger descriptions and workflow details into SKILL.md files, which can preserve sensitive operational patterns or contextual data from the original session. Because these artifacts are meant for reuse, any leaked context can propagate across future invocations.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

Step 2: Draft the Skill

Write a SKILL.md with:

text
---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Instructing generated skills to be 'pushy' and enumerate many triggering contexts encourages future skills to over-trigger and expand beyond their intended scope. This compounds the risk of unintended invocation and unauthorized persistence across downstream generated artifacts.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

The document tells the agent to say a specific English sentence after task completion and does not mention adapting to the user's language or locale. This can create a language-policy issue when the surrounding session is in another language and no opt-in or choice is offered.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.