Skill Quick Index

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:56 AM UTC
• Version: 1.0.1

Overview

This skill is not malicious, but it needs Review because vague phrases can route users toward powerful skills like messaging, automation, configuration changes, and agent self-modification without clear confirmation boundaries.

Install only if you want a broad skill router and are comfortable reviewing its recommendations before acting on them. Treat matches for messaging, automation, configuration, skill installation, and agent-evolution skills as suggestions, not authorization to run them; require explicit confirmation for those actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (14)

Vague Triggers

High

• Confidence: 95% confidence
• Finding: Many skill trigger lists include generic terms such as '启动', '学习', '写', '测试', '配置', or '声明', which can match ordinary conversation unrelated to those tools. Because this index is meant for rapid routing, ambiguous triggers materially raise the chance of accidental invocation or recommendation of powerful skills, including automation, agent self-modification, testing, and communication actions.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The match rules intentionally use very broad category triggers where any single keyword can recommend all skills in a category, which is a genuine unsafe prompt-routing design. In this skill context, many categories map to sensitive actions like messaging, browser automation, workflow execution, and external integrations, so common words could misroute requests into higher-risk capabilities without clear user intent.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The run command and all usage examples are written as Chinese input strings, which presents the skill as expecting a specific language. The file does not state that this is optional, multilingual, or limited to a justified Chinese-only context, so it appears to impose a locale preference without user opt-in.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill describes scanning local files under ~/.openclaw/workspace/skills/*/SKILL.md but does not declare any explicit tool scope or permissions boundary. That creates a real security and governance gap: an indexing skill with implicit file-read behavior may access local content without clear user or platform visibility, making review and containment harder.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Skill Quick Index

Create and use a fast local index so users can trigger skills with natural language (broad keywords) and still get precise skill routing.

## What this skill does

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The skill is explicitly designed for broad natural-language triggering and routing, which increases the chance of unintended invocation of other skills based on vague user input. In a dispatcher or router, weak activation boundaries can cause privilege confusion, accidental execution chains, or invocation of sensitive skills the user did not clearly request.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The phrase 'Supports quick lookup from any user phrase' is overly permissive and suggests unconstrained parsing of arbitrary input for routing decisions. That broad scope makes prompt/intent overmatching more likely and can let unrelated or adversarial phrasing trigger skill discovery or downstream execution unexpectedly.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: This manifest file explicitly describes the skill as using "Wide-trigger + precise-call" routing from natural language, but it does not specify what trigger phrases are in scope or what should not invoke the skill. That broad wording can overlap with common requests and creates ambiguity about when the skill should activate.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The manifest's user-facing examples and usage instructions only show Chinese input strings such as "你的需求", "打开网页并截图", and "ocr识别". This suggests a language preference is being imposed without any opt-in or explanation that the skill is intentionally locale-specific.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The file consistently presents names, descriptions, quick references, and matching rules in Chinese, while also indexing English trigger terms, but it provides no language selection or opt-in behavior. This can violate language/locale policy expectations when used in broader multilingual environments because the locale choice is implicit rather than user-directed.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The manifest says this skill builds an index for local OpenClaw skills and routes by intent/category/keywords, which implies a catalog of local skills. However, the indexed categories and referenced skills prominently cover external services and platforms such as Discord, WeChat, Slack, Trello, GitHub, YouTube, Spotify, HomeKit/Hue/Sonos, travel/weather, and web search, making the actual scope broader than 'local OpenClaw skills'.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence
• Finding: The trigger list explicitly references 'npx skills', which implies on-demand execution or installation of an unpinned package/toolchain component. Unpinned NPX usage is a real supply-chain risk because resolution can drift over time or be hijacked upstream, leading users or downstream routers toward executing unexpected code.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This Python file contains natural-language strings that present the tool's description and usage only in Chinese. The policy forbids forcing a specific language without user opt-in, and there is no indication that this skill is region-specific or that users can select another locale.

Description-Behavior Mismatch

Low

• Confidence: 93% confidence
• Finding: The description claims an index for local OpenClaw skills '(L1-L3)'. But the skill_details section explicitly includes multiple L0 entries such as skill-safe-install, config-modification, agent-evolution, semantic-router, semantic-system, and semantic-declaration, which conflicts with the stated level range.

Static analysis

No suspicious patterns detected.