Security audit

Publish Clean

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed UI theming helper, but it requires persistent daily execution that rewrites app files and crontab entries, so it needs careful review before installation.

Review before installing. Only use this skill if you are comfortable with an agent editing UI build files and adding a daily cron job under your user account. Prefer disabling or making the cron self-healing step explicit and opt-in, backing up your crontab first, and inspecting any snapshot HTML/JavaScript before it can be reinserted into the Control UI.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T06 · System Persistence

Error

Location: SKILL.md:127
Finding: Mandatory Daily Cron Job Creates Cross-Session Persistence
Content: View full analysis
**Self-healing loop = injection + snapshot + cron + verification; all four steps are required.** 4. **Register cron immediately (mandatory, not optional)**: ( crontab -l 2>/dev/null | grep -v 'heal.sh' ; echo '0 6 * * * /bin/bash "/scripts/heal.sh" >> ~/.openclaw/workspace/theme-coach/heal.log 2>&1' ) | crontab - crontab -l | grep heal.sh ``` The final checklist reinforces the requirement: ```text - [ ] Register the heal cron job (mandatory) and immediately run `heal.sh ` to verify the loop ``` ### Technical Analysis The Skill explicitly requires an agent to modify the user's crontab and execute `scripts/heal.sh` every day at 06:00. This scheduled task survives the original Skill session and continues executing code from the Skill installation directory. Automatic recovery may be useful for a theme that can be overwritten by upgrades, but mandatory daily execution is not the least-privileged mechanism necessary to design or install a UI theme. An on-demand repair command would satisfy the core functionality without persistent execution. The cron entry references the mutable Skill installation path rather than a version-pinned or integrity-verified copy. If `scripts/heal.sh` is subsequently changed through a compromised update, filesystem tampering, or package replacement, the cron job will execute the changed code automatically. ### Attack Path 1. A user asks the agent to install a theme. 2. Following the mandatory instructions, the agent adds the daily `heal.sh` entry to the user's crontab. 3. The Skill directory or `scripts/heal.sh` is later replaced or modified. 4. At the next scheduled time, cron invokes `/bin/bash` on the modified script. 5. The replacement code executes with the permissions ...[truncated 454 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:136
Finding: Unscoped Crontab Filtering Can Delete or Modify Unrelated Scheduled Jobs
Content: View full analysis
/dev/null | grep -v 'heal.sh' ; echo '0 6 * * * /bin/bash "/scripts/heal.sh" >> ~/.openclaw/workspace/theme-coach/heal.log 2>&1' ) | crontab - crontab -l | grep heal.sh ``` Theme switching uses an unscoped textual replacement: ```bash crontab -l | sed 's#heal.sh" A#heal.sh" B#' | crontab - crontab -l | grep heal.sh ``` Uninstallation again removes every line containing `heal.sh`: ```bash ( crontab -l 2>/dev/null | grep -v 'heal.sh' ) | crontab - ``` ### Technical Analysis The crontab is shared user configuration, but the Skill identifies its entry only through the generic substring `heal.sh`. The `grep -v` operations therefore remove any scheduled job containing that substring, regardless of ownership or purpose. The switching command has the same scoping problem: it applies a textual substitution across the complete crontab rather than updating a uniquely identified record. Merely inspecting the existing crontab before modification, as recommended by the document, does not prevent accidental deletion. The command itself remains overbroad and applies its result without a confirmation step or exact-entry validation. ### Attack Path 1. The user already has an unrelated scheduled task whose command, path, argument, or comment contains `heal.sh`. 2. The Skill installs, switches, or uninstalls a theme. 3. The documented pipeline reads the entire crontab. 4. `grep -v 'heal.sh'` removes the unrelated entry, or `sed` modifies matching unrelated content. 5. The altered output is immediately submitted to `crontab -`. 6. The unrelated scheduled task is silently deleted or change ...[truncated 427 chars]
Remediation: View remediation
``` 2. Match only an exact, anchored entry containing that marker. 3. Never use a generic `grep -v 'heal.sh'` filter against the entire crontab. 4. Store the existing crontab in a timestamped backup before applying changes. 5. Generate and display a diff before calling `crontab -`. 6. Abort if more than one owned entry matches or if the target entry does not have the expected structure. 7. For theme switching, reconstruct the one owned entry rather than applying a global `sed` substitution. 8. For uninstall, remove only the exact entry associated with the selected theme and preserve all other lines byte-for-byte. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/heal.sh:169
Finding: Fingerprint-Only Snapshot Validation Enables Persistent HTML and JavaScript Reinjection
Content: View full analysis
&2 echo "[heal] Create it first (theme-vars.html + injector.html, see SKILL.md 3.2), or pick another theme." >&2 exit 1 fi tv="$snapdir/theme-vars.html" inj="$snapdir/injector.html" [ -f "$tv" ] || missing="$tv" [ -f "$inj" ] || missing="$missing${missing:+ }$inj" if [ -n "$missing" ]; then echo "[heal] ERROR: snapshot incomplete: missing $missing" >&2 exit 1 fi for f in "$tv" "$inj"; do snap_theme="$(grep -o 'data-theme-id="[^"]*"' "$f" 2>/dev/null | head -1 || true)" snap_theme="${snap_theme#data-theme-id=\"}"; snap_theme="${snap_theme%\"}" if [ "$snap_theme" != "$theme" ]; then echo "[heal] ERROR: snapshot contract violation: $(basename "$f") declares theme='${snap_theme:-}', expected '$theme'." >&2 exit 1 fi done echo "[heal] OK: snapshot for '$theme' validated (directory + theme-vars.html + injector.html + fingerprint match)." } ``` The validated files are then inserted into the application HTML without content authentication or structural enforcement: ```bash inject_theme() { local index="$1" theme="$2" snapdir="$3" local tv inj tv="$snapdir/theme-vars.html" inj="$snapdir/injector.html" for f in "$tv" "$inj"; do if [ ! -f "$f" ]; then echo "[heal] ERROR: snapshot incomplete: missing $f" >&2 exit 1 fi done local snap_theme snap_theme="$(grep -o 'data-theme-id="[^"]*"' "$tv" 2>/dev/null | head -1 || true)" snap_theme="${snap_theme ...[truncated 3260 chars]
Remediation: View remediation
` element. - `injector.html` must contain exactly one expected `

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (31)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向 OpenClaw Control UI 的主题设计与应用系统，核心应包括交互式引导、风格化主题生成、调色板派生以及部署/自愈机制。提供的代码却仅执行非常有限的单一任务：接收两个 HEX 颜色，验证格式，计算 WCAG 对比度，并输出 AA normal/large 的通过情况。这可以算作与 UI 设计相关的辅助小工具，但它既不是所宣称技能的主要功能，也没有体现描述中的大部分关键能力。因此属于明显的描述与行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: 声明描述的是一个较完整的主题设计顾问型技能，包含交互引导、风格化定制，以及若干运维/自愈/学习能力。实际代码只是单一的颜色派生脚本：读取一个主色，计算配色、边框对比度，并输出 CSS 变量。它确实覆盖了声明中的“主色派生调色板”这一小部分，但没有看到任何问答引导、主题注入、计划任务、快照恢复、学习反馈等实现。因此代码行为仅部分匹配描述，且主要目的明显更窄，构成实质性描述不符。
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly directs registration of a recurring cron job to reapply modifications and monitor theme presence. Persistence mechanisms are high-risk because they alter host-level scheduled tasks and can survive beyond the user's immediate session, which is especially dangerous in an agent skill whose expected purpose is UI customization.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 98% confidence
Finding: The YARA hit is justified by the documented crontab command that establishes persistent scheduled execution from the skill directory. Although it is framed as 'self-healing' rather than overt malware, the technique matches a persistence/backdoor class of behavior and is especially suspicious in a UI-theming skill where such host persistence is not essential.
Content: Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.
�有主题原样不动；重注入前比对 data-upstream-version 与当前 dist 版本，主版本跳大先警告再注入（DOM/CSS 钩子可能已变，注入后必须人工验证；样式坏了就按新 dist 重做快照） 4. 当场注册 cron（必做，不是可选项）：注入验收通过后立即注册每天自检。合并式追加，不覆盖现有 crontab：

bash
( crontab -l 2>/dev/null | grep -v 'heal.sh' ; echo '0 6 * * * /bin/bash "<skill 安装目录>/scripts/heal.sh" <主题名> >> ~/.openclaw/workspace/theme-coach/heal.log 2>&1' ) | crontab - crontab -l | grep heal.sh # 确认注册成功

<skill 安装目录> 换成 skill 实际路径（在 skill 目录里执行 pwd 即得）；<主题名> 换成刚注入的主题。改现有 crontab 前必须先 crontab -l 看现状。

当场跑一次验证闭环（必做）：注册完立刻手动执行一次 bash "<skill 安装目录>/scripts/heal.sh" <主题名>，输出应为

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented switch/uninstall workflow modifies system crontab entries, extending the skill's influence into persistent host configuration management. Even if intended for self-healing themes, this creates a durable foothold and raises the risk of misuse, accidental breakage, or repurposing for unauthorized persistence.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 331)May include surrounding context.
md
- [ ] semver 版本号定好 - [ ] clawhub skill publish --dry-run 预检通过 - [ ] frontmatter 按 Agent Skills 标准自查（name 规则 7 条 / description ≤1024 / 缺 description 不加载），清单+自动化脚本见 `references/open-source-checklist.md` - [ ] 安全审计：注入代码/素材零外链、字体纹理全部本地化（web 调研/curl 校验属开发期行为，不进注入产物）、无敏感文件读取、无 curl|bash 模式 ### 7.3 版本策略 - Patch（1.0.x）：颜色微调、bug 修复

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · SKILL.md (reported line 331)May include surrounding context.
md
- [ ] semver 版本号定好 - [ ] clawhub skill publish --dry-run 预检通过 - [ ] frontmatter 按 Agent Skills 标准自查(name 规则 7 条 / description ≤1024 / 缺 description 不加载),清单+自动化脚本见 `references/open-source-checklist.md` - [ ] 安全审计:注入代码/素材零外链、字体纹理全部本地化(web 调研/curl 校验属开发期行为,不进注入产物)、无敏感文件读取、无 curl|bash 模式 ### 7.3 版本策略 - Patch(1.0.x):颜色微调、bug 修复

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README explicitly states that the skill records user preferences for a feedback-learning loop, but it does not disclose what data is stored, how long it persists, or how users can review or delete it. In a UI theming assistant, preferences may seem low risk, but they can still reveal aesthetic choices, project names, workflow details, or other user-linked metadata, creating avoidable privacy and retention risk.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documents file read/write behavior (editing index.html, backups, snapshots, feedback.json) but does not declare any explicit tool scope or allowed-tools restrictions. This creates an over-privileged and under-specified skill boundary, making it easier for an agent runtime to grant broader filesystem access than users expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description declares trigger words as “主题、换皮、皮肤、UI 美化、风格”, several of which are generic conversational terms rather than narrowly scoped invocation phrases. Without stronger context constraints or exclusion examples, the skill could be invoked for unrelated requests about style, appearance, or themes outside this specific OpenClaw UI task.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The '何时使用' section lists generic keywords like “主题、换皮、皮肤、UI 美化、风格” but does not specify where the skill should and should not activate. This ambiguity increases the risk of accidental invocation during ordinary design or aesthetic discussions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes the skill as an OpenClaw Control UI theme coach, but the documentation explicitly states it should also be used for DSH web UI and arbitrary Web projects. That broadens the operational scope from a product-specific theming assistant to a general web UI theming and injection workflow.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill instructs external web research and tool use beyond a local theming advisor, which expands the attack surface to untrusted web content and downloaded assets/scripts. Because the content is treated as procedural guidance, an agent may fetch or rely on external resources without strong trust validation.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 99% confidence
Finding: The crontab registration command establishes recurring execution of a script from the skill directory, which is a persistence mechanism. In context, this is more dangerous because the skill is supposed to customize UI themes, not install scheduled tasks that survive the session and can be modified later if the script path or contents change.
Content: Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

自愈脚本 scripts/heal.sh：自动探测 OpenClaw 安装路径（不硬编码）；检查指纹 → 缺失则从快照恢复；同主题跳过、不同主题明确报出（先 heal.sh uninstall 再重灌）；heal.sh uninstall [主题名] 卸载还原原版；--force 切换时先验目标快照（目录 + 契约文件 + 指纹全对上）再卸载旧主题——目标快照缺失/契约违反直接报错退出（exit 非 0），现有主题原样不动；重注入前比对 data-upstream-version 与当前 dist 版本，主版本跳大先警告再注入（DOM/CSS 钩子可能已变，注入后必须人工验证；样式坏了就按新 dist 重做快照）

当场注册 cron（必做，不是可选项）：注入验收通过后立即注册每天自检。合并式追加，不覆盖现有 crontab：
bash
( crontab -l 2>/dev/null | grep -v 'heal.sh' ; echo '0 6 * * * /bin/bash "<skill 安装目录>/scripts/heal.sh" <主题名> >> ~/.openclaw/workspace/theme-coach/heal.log 2>&1' ) | crontab - crontab -l | grep heal.sh # 确认注册成功

<skill 安装目录> 换成 skill 实际路径（在 skill 目录里执行 pwd 即得）；<主题名> 换成刚注入的主题。改现有 crontab 前必须先 crontab -l 看现状。

Session Persistence

Medium

Category: Rogue Agent
Confidence: 98% confidence
Finding: Verifying cron registration and directing later log inspection reinforces a persistent background execution model. This extends the life of the skill's changes and makes host modification durable in a way disproportionate to the declared purpose of theming.
Content: Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

当场注册 cron（必做，不是可选项）：注入验收通过后立即注册每天自检。合并式追加，不覆盖现有 crontab：
bash
( crontab -l 2>/dev/null | grep -v 'heal.sh' ; echo '0 6 * * * /bin/bash "<skill 安装目录>/scripts/heal.sh" <主题名> >> ~/.openclaw/workspace/theme-coach/heal.log 2>&1' ) | crontab - crontab -l | grep heal.sh # 确认注册成功

<skill 安装目录> 换成 skill 实际路径（在 skill 目录里执行 pwd 即得）；<主题名> 换成刚注入的主题。改现有 crontab 前必须先 crontab -l 看现状。

当场跑一次验证闭环（必做）：注册完立刻手动执行一次 bash "<skill 安装目录>/scripts/heal.sh" <主题名>，输出应为 [heal] Theme '<主题名>' is present, skipping.——确认「已注入状态能被自愈脚本正确识别」后闭环才算成立。只注册不验证 = 没做；以后可用 tail ~/.openclaw/workspace/theme-coach/heal.log 查看每日自检结果

Session Persistence

Medium

Category: Rogue Agent
Confidence: 97% confidence
Finding: The skill mandates immediate execution of the heal script after cron registration, confirming the persistence loop is active and functioning. This combination of install-plus-verify behavior resembles persistence establishment patterns and creates ongoing integrity risk on the host.
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
( crontab -l 2>/dev/null | grep -v 'heal.sh' ; echo '0 6 * * * /bin/bash "<skill 安装目录>/scripts/heal.sh" <主题名> >> ~/.openclaw/workspace/theme-coach/heal.log 2>&1' ) | crontab - crontab -l | grep heal.sh # 确认注册成功

text
> `<skill 安装目录>` 换成 skill 实际路径（在 skill 目录里执行 `pwd` 即得）；`<主题名>` 换成刚注入的主题。改现有 crontab 前必须先 `crontab -l` 看现状。 5. **当场跑一次验证闭环（必做）**：注册完立刻手动执行一次 `bash "<skill 安装目录>/scripts/heal.sh" <主题名>`，输出应为 `[heal] Theme '<主题名>' is present, skipping.`——确认「已注入状态能被自愈脚本正确识别」后闭环才算成立。**只注册不验证 = 没做**；以后可用 `tail ~/.openclaw/workspace/theme-coach/heal.log` 查看每日自检结果 6. **幂等安全**：检测到同主题已注入则跳过，不会重复注入

Session Persistence

Medium

Category: Rogue Agent
Confidence: 96% confidence
Finding: The theme-switch workflow edits existing crontab entries to point at a different theme, meaning the skill actively maintains and mutates persistent scheduled execution. That increases operational risk and provides a ready-made channel for durable unintended behavior.
Content: Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

用户确认要换 → bash "<skill 安装目录>/scripts/heal.sh" B --force（能力细节见 3.2 第 3 条：先验目标快照 → 卸载 A → 注入 B，全程自动备份 + 上游版本比对，此处不再重复）

同步 cron 主题名：crontab 里 heal.sh 行还带着旧主题 A，必须改成 B，否则每天自检拿错主题误报：
bash
crontab -l | sed 's#heal.sh" A#heal.sh" B#' | crontab - # A/B 换成实际主题名 crontab -l | grep heal.sh # 确认已更新

Ctrl+Shift+R 强制刷新验收

Session Persistence

Medium

Category: Rogue Agent
Confidence: 96% confidence
Finding: Re-checking the modified crontab confirms continued persistence after the switch. This operationalizes long-lived host changes in a way that is not necessary for a styling assistant and substantially increases risk if the skill or referenced script is later altered.
Content: Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

同步 cron 主题名：crontab 里 heal.sh 行还带着旧主题 A，必须改成 B，否则每天自检拿错主题误报：
bash
crontab -l | sed 's#heal.sh" A#heal.sh" B#' | crontab - # A/B 换成实际主题名 crontab -l | grep heal.sh # 确认已更新

Ctrl+Shift+R 强制刷新验收

Session Persistence

Medium

Category: Rogue Agent
Confidence: 95% confidence
Finding: Even the uninstall workflow directly rewrites crontab, showing the skill assumes control over persistent scheduler state throughout its lifecycle. Managing system persistence from a theming skill is an unnecessary privilege escalation in context.
Content: Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

bash "<skill 安装目录>/scripts/heal.sh" uninstall [主题名]——主题名省略 = 自动检测当前注入的主题；自动备份（index.html.bak-heal-<时间戳>）后移除带指纹的 <style>/<script> 注入块

从 crontab 摘掉对应自愈行（不再每天自检）：
bash
( crontab -l 2>/dev/null | grep -v 'heal.sh' ) | crontab -

Ctrl+Shift+R 看回原版 UI

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Recommending external commands like ffmpeg and download scripts increases exposure to unsafe command execution and supply-chain risk. In a skill context, vague guidance around 'download scripts' can lead an agent or user to fetch and run untrusted code while believing it is part of normal workflow.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs storing user preferences and history in feedback.json without an explicit opt-in mechanism. Persistent retention of user-provided preferences creates a privacy and data-governance risk, especially when users may not expect their interaction history to be saved locally across sessions.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documented feedback loop creates a natural-language data retention store containing user preferences and history. Even if the data seems low sensitivity, persistent local storage can accumulate behavioral profiling data and may be accessed later by other processes or users on the same system.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file advises authors to place trigger words such as “主题、换皮、皮肤” directly into the description to improve matching. Without requiring narrow context, exclusion conditions, or negative examples, these triggers can be broad and may overlap with ordinary user language, increasing the risk of unintended invocation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JSON test file embeds user-facing prompt and response content exclusively in Chinese, which can enforce a specific language/locale behavior if used as skill guidance or evaluation data. The file does not indicate that users may choose another language or that the locale restriction is intentional and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The user-facing instructions and usage content are presented only in Chinese, with no indication that the user can choose another language. That can constitute a language/locale policy issue because the skill appears to force a specific language without opt-in or a documented regional justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.