Security audit

Difficult Conversations

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent conversation-coaching guide, but it asks for filesystem access it does not explain and uses an unpinned npx installer.

Review this skill before installing. The coaching text itself is straightforward, but install it only in a restricted environment or with a pinned, trusted installer, and avoid granting filesystem access unless the publisher documents exactly why it is needed and what paths it can touch.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:14
Finding: Unpinned Package Execution in Installation Command
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

yaml
install: "npx clawhub install howtousehumans/difficult-conversations"

Technical Analysis

The installation command invokes clawhub through npx without specifying a reviewed package version or integrity value. Depending on the local npm configuration and cache state, npx can retrieve and execute the package version currently resolved by the configured registry.

This creates a supply-chain trust dependency on the package registry, the clawhub package, its maintainers, and its transitive dependencies. If any component is compromised or unexpectedly changed after review, the command can execute code that was not included in this audited project. The project does not provide a lockfile, package hash, registry restriction, or other mechanism for reproducing and verifying the installed executable.

Attack Path

An attacker compromises the resolved clawhub package, one of its dependencies, its publishing account, or the configured package registry.

The attacker publishes a malicious version that is selected by the unpinned npx clawhub invocation.

A user or deployment process runs the installation command from the skill metadata.

npx downloads and executes the attacker-controlled package.

The malicious package operates with the privileges of the account running the installer.

Impact Assessment

Successful exploitation could permit arbitrary command execution under the installing user's privileges. Depending on those privileges, the payload could read or modify accessible files, obtain environment variables and credentials, alter installed skills, or install additional software. The scope is limited by the operating-system permissions and sandboxing applied to the installation process.
Remediation: View remediation
Remediation Suggestions

Pin clawhub to an explicitly reviewed version rather than allowing dynamic resolution.

Use a trusted, explicitly configured package registry.

Verify package provenance and integrity through registry signatures, checksums, or an equivalent integrity mechanism.

Lock and audit all transitive dependencies used by the installer.

Execute installation in a restricted environment without administrative privileges or unnecessary credentials.

Re-review the resolved package whenever the pinned version is updated.

T05 · Unauthorized Access and Privilege Escalation

Note

Location: SKILL.md:11
Finding: Unnecessary Filesystem Capability Violates Least Privilege
Content: View full analysis
Vulnerability Details

File Location: SKILL.md, lines 11-14
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Low

Vulnerable Code Snippet:

yaml
openclaw: requires: tools: [filesystem] install: "npx clawhub install howtousehumans/difficult-conversations"

Technical Analysis

The skill requests the filesystem tool, but its documented workflow consists entirely of conversational coaching, templates, and safety guidance. No instruction in the reviewed file identifies a legitimate filesystem operation required to provide that functionality.

Granting an unnecessary tool expands the agent's authority beyond the minimum needed for the task. If malicious or untrusted content later influences the agent, the filesystem capability could become an access channel to local data. The exact exposure depends on the tool's sandbox, path restrictions, confirmation requirements, and the privileges of the process hosting the agent.

Attack Path

The skill is loaded with its declared filesystem capability.

The agent receives malicious contextual content, prompt injection, or a misleading request that induces a filesystem operation.

Because the unnecessary tool is available, the agent attempts to read or modify an accessible path.

If platform controls do not independently block the operation, local data is disclosed or changed within the filesystem tool's permission scope.

No direct instruction to abuse the filesystem was found in the reviewed skill. Exploitation therefore requires an additional malicious or erroneous instruction source.

Impact Assessment

Potential impact includes unauthorized reading or modification of files exposed to the filesystem tool. This could affect user documents, agent configuration, local state, or credentials stored in accessible files. It does not inherently grant privileges beyond those already available to the agent ...[truncated 89 chars]
Remediation: View remediation
Remediation Suggestions

Remove filesystem from the required tools because the documented coaching workflow does not need local file access.

If a future feature must save a script, request access only when the user explicitly invokes that feature.

Restrict access to a user-selected output file or a dedicated sandbox directory.

Prefer write-only, create-new-file behavior where reading existing files is unnecessary.

Require user confirmation before reading, overwriting, or deleting any file.

Document the exact filesystem operations and paths needed so deployment policy can enforce a narrow allowlist.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description says to use the skill for 'any situation they've been avoiding,' after listing several common scenarios. That phrase is open-ended and overlaps with many everyday support requests, making it unclear where this skill's scope ends versus more general advice or coaching skills.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The skill metadata includes an install command using npx clawhub without pinning a specific package version. This creates a supply-chain risk: a future compromised or malicious release of the package could be fetched and executed at install time, and npx commonly runs package code immediately. The conversational nature of the skill does not reduce this risk because the exposure is in installation, not in runtime content.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.