Security audit

Brand Marketing Workflow

Security checks for vulnerabilities and agentic risk

Overview

The package presents itself as documentation-only but includes runnable workflow code that can read local OpenClaw configuration and send brand data over the network.

Review this as an operational, network-capable marketing workflow, not as documentation. Install only if you are comfortable with it reading OpenClaw config values, using configured LLM and search services, caching competitor content, and sending brand briefs or strategy data externally before the current authorization check runs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: clawhub.yaml:8
Finding: Misleading documentation-only metadata conceals executable and network-capable implementation
Content: View full analysis
dict: proc = subprocess.run( ["python3", str(BASE / script)], input=json.dumps(payload).encode(), stdout=subprocess.PIPE, stderr=subprocess.PIPE, ) ``` The installation entry point also attempts to execute Python: ```bash SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" exec python3 "$SCRIPT_DIR/lib/run.py" "$@" ``` ### Technical Analysis The manifest and skill documentation explicitly state that the artifact is documentation-only and contains no executable implementation. In reality, the package ships multiple executable Python and shell files, including a root workflow that performs subprocess execution, network requests, credential reads, web-content retrieval, and LLM calls. This discrepancy prevents users and automated reviewers from making an informed privilege and data-processing decision. It also creates operational ambiguity because the documented and installed entry points are inconsistent: - `SKILL.md` refers to `scripts/run.py`, which does not exist. - `install.sh` refers to `lib/run.py`, which does not exist. - The actual launcher is root-level `run.py`. The executable ...[truncated 1396 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: scripts/competitor_ai_analyzer.py:64
Finding: Untrusted competitor web content is embedded directly into an LLM instruction
Content: View full analysis
str: """构建竞品分析 prompt。""" return f"""你是品牌竞争情报分析师。分析以下竞品公开内容，提取营销信号。竞品名称：{competitor_name} 品牌背景（你的品牌，作为参照）：{brand_summary} 竞品原始内容（来源：{source_type}）： {raw_text} 请用 JSON 格式输出，只含以下字段（全英文，不要中文值）： {{ "theme": "主题定位（1-3英文词，如 minimalism / productivity-platform / lifestyle-brand）", "tone": "内容语气（2-4英文词）", "frequency": "内容频率估计（daily/weekly/irregular）", "hooks": ["钩子1", "钩子2", "钩子3"], "content_patterns": ["模式1", "模式2", "模式3"], "channel_strength": ["渠道1", "渠道2"], "gaps": ["弱点/差异化机会1", "弱点2"] }} 只输出 JSON，不要其他说明文字。""" ``` ```python prompt = _build_prompt(competitor_name, raw_text, source_type, brand_summary) try: llm_response = llm_complete( prompt=prompt, model=ANALYSIS_MODEL, max_tokens=ANALYSIS_MAX_TOKENS, ) analysis = _parse_llm_json(llm_response, competitor_name) ``` ### Technical Analysis `raw_text` originates from public competitor pages or search results retrieved by `scripts/competitor_fetcher.py`. That remotely controlled text is concatenated into the same natural-language prompt as the analyzer's operational instructions. There is no security boundary between instructions and source data, no prompt-injection detection, and no semantic validation of the returned values. JSON parsing only verifies that the model returned a dictionary; it does not verify that the analysis was derived from the source or that each field conforms to a constrained schema. A competitor page could contain text such as instructions to disregard the requested analysis, emit misleading themes, or return attacker-selected JSON. The model may treat those embedded instructions as authoritative. ...[truncated 1493 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/oc_llm_client.py:25
Finding: LLM API key and brand prompts can be transmitted to an unvalidated provider URL
Content: View full analysis
dict: """返回 {'base_url', 'api_key', 'api', 'model_id'}""" c = _cfg() env_vars = c.get("env", {}).get("vars", {}) primary = c.get("agents", {}).get("defaults", {}).get("model", {}).get("primary", "") if "/" not in primary: raise RuntimeError(f"无法解析默认模型: {primary!r}") provider_id, model_id = primary.split("/", 1) p = c.get("models", {}).get("providers", {}).get(provider_id) if not p: raise RuntimeError(f"provider '{provider_id}' 未在 openclaw.json 中配置") return { "base_url": p["baseUrl"].rstrip("/"), "api_key": _expand(str(p.get("apiKey", "")), env_vars), "api": p.get("api", "openai-completions"), "model_id": model_id, } ``` ```python def _call_openai(prompt, mc, max_tokens, system): messages = [] if system: messages.append({"role": "system", "content": system}) messages.append({"role": "user", "content": prompt}) body = json.dumps({ "model": mc["model_id"], "messages": messages, "max_tokens": max_tokens, "stream": True, }).encode() req = urllib.request.Request( f"{mc['base_url']}/v1/chat/completions", data=body, headers={"Content-Type": "application/json", "Authorization": f"Bearer {mc['api_key']}"}, method="POST", ) chunks = [] with urllib.request.urlopen(req, timeout=60) as resp: ``` ```python def _call_anthropic(prompt, mc, max_tokens, system): messages = [{"role": "user", "content": prompt}] body_dict = {"model": mc["model_id"], "max_tokens": max_tokens, "messages": messages} if system: body_dict["system"] = system body = json.dumps(body_dict).encode() req = urlli ...[truncated 2461 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: run.py:102
Finding: Authorization checks occur after external LLM and competitor-fetching operations
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (97)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The described workflow processes inputs into operational marketing outputs and performs policy/compliance checks, which is substantive implementation behavior. Labeling it as structural reference only makes the skill more dangerous in context because users may trust it as inert while it can influence actions and handle potentially sensitive business data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The described workflow processes inputs into operational marketing outputs and performs policy/compliance checks, which is substantive implementation behavior. Labeling it as structural reference only makes the skill more dangerous in context because users may trust it as inert while it can influence actions and handle potentially sensitive business data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The described workflow processes inputs into operational marketing outputs and performs policy/compliance checks, which is substantive implementation behavior. Labeling it as structural reference only makes the skill more dangerous in context because users may trust it as inert while it can influence actions and handle potentially sensitive business data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The described workflow processes inputs into operational marketing outputs and performs policy/compliance checks, which is substantive implementation behavior. Labeling it as structural reference only makes the skill more dangerous in context because users may trust it as inert while it can influence actions and handle potentially sensitive business data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The described workflow processes inputs into operational marketing outputs and performs policy/compliance checks, which is substantive implementation behavior. Labeling it as structural reference only makes the skill more dangerous in context because users may trust it as inert while it can influence actions and handle potentially sensitive business data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The described workflow processes inputs into operational marketing outputs and performs policy/compliance checks, which is substantive implementation behavior. Labeling it as structural reference only makes the skill more dangerous in context because users may trust it as inert while it can influence actions and handle potentially sensitive business data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The described workflow processes inputs into operational marketing outputs and performs policy/compliance checks, which is substantive implementation behavior. Labeling it as structural reference only makes the skill more dangerous in context because users may trust it as inert while it can influence actions and handle potentially sensitive business data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The described workflow processes inputs into operational marketing outputs and performs policy/compliance checks, which is substantive implementation behavior. Labeling it as structural reference only makes the skill more dangerous in context because users may trust it as inert while it can influence actions and handle potentially sensitive business data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The described workflow processes inputs into operational marketing outputs and performs policy/compliance checks, which is substantive implementation behavior. Labeling it as structural reference only makes the skill more dangerous in context because users may trust it as inert while it can influence actions and handle potentially sensitive business data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The described workflow processes inputs into operational marketing outputs and performs policy/compliance checks, which is substantive implementation behavior. Labeling it as structural reference only makes the skill more dangerous in context because users may trust it as inert while it can influence actions and handle potentially sensitive business data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The described workflow processes inputs into operational marketing outputs and performs policy/compliance checks, which is substantive implementation behavior. Labeling it as structural reference only makes the skill more dangerous in context because users may trust it as inert while it can influence actions and handle potentially sensitive business data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The described workflow processes inputs into operational marketing outputs and performs policy/compliance checks, which is substantive implementation behavior. Labeling it as structural reference only makes the skill more dangerous in context because users may trust it as inert while it can influence actions and handle potentially sensitive business data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The described workflow processes inputs into operational marketing outputs and performs policy/compliance checks, which is substantive implementation behavior. Labeling it as structural reference only makes the skill more dangerous in context because users may trust it as inert while it can influence actions and handle potentially sensitive business data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The described workflow processes inputs into operational marketing outputs and performs policy/compliance checks, which is substantive implementation behavior. Labeling it as structural reference only makes the skill more dangerous in context because users may trust it as inert while it can influence actions and handle potentially sensitive business data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The described workflow processes inputs into operational marketing outputs and performs policy/compliance checks, which is substantive implementation behavior. Labeling it as structural reference only makes the skill more dangerous in context because users may trust it as inert while it can influence actions and handle potentially sensitive business data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The described workflow processes inputs into operational marketing outputs and performs policy/compliance checks, which is substantive implementation behavior. Labeling it as structural reference only makes the skill more dangerous in context because users may trust it as inert while it can influence actions and handle potentially sensitive business data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The described workflow processes inputs into operational marketing outputs and performs policy/compliance checks, which is substantive implementation behavior. Labeling it as structural reference only makes the skill more dangerous in context because users may trust it as inert while it can influence actions and handle potentially sensitive business data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The document explicitly states that it contains no executable code, but later sections describe an operational bootstrap, usage commands, and a script inventory. This internal inconsistency is dangerous because it can mislead human reviewers and automated systems into treating an executable package as a low-risk documentation artifact.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Claiming the artifact is non-executable while including runnable bootstrap and command examples is a direct contradiction. In practice, that can facilitate accidental or unauthorized execution by users who rely on the safer top-level description.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script performs active benchmark execution, including invoking Python workflows and processing their outputs, which exceeds the declared documentation-only scope of the skill. In a review-only context, bundling executable operational logic creates an unexpected capability surface that could trigger code execution, expose implementation behavior, or undermine user trust about what the skill is allowed to do.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code invokes python3 run.py --demo during normal benchmark flow, causing local workflow execution that is unjustified for a documentation-only skill. Even if intended for benchmarking, this creates a direct execution path that could run nontrivial code, access local resources, or reveal implementation details contrary to the stated scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script runs integration tests via a local Python command despite the skill being described as structural documentation without implementation exposure. This mismatch is dangerous because it introduces hidden execution behavior into a context where users and reviewers would reasonably expect inert content only.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The evidence shows active browser operations such as public-signal collection and draft publication planning, which materially exceed a skill described as documentation-only workflow review. This scope mismatch is dangerous because consumers of the skill may authorize or invoke it expecting passive analysis, while the workflow is actually capable of external interaction and content-preparation actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Browser-based collection of platform signals is not justified by a skill advertised as structural documentation for workflow understanding or audit. Even if constrained to public data, this introduces live external data access and platform interaction that users would not reasonably expect from a documentation-review skill, creating consent and overreach risks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Forcing zh-CN while declaring a global region and no user opt-in creates a hidden behavioral constraint that can override user expectations and cause unauthorized or inappropriate audience targeting. In a marketing workflow, this can lead to misdelivery, compliance issues, and deceptive or harmful automation outcomes because the system may generate or prepare region-mismatched content without explicit consent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.