ClawHub
Back to skill

Security audit

CreezFinance

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent investor-assistant purpose, but it asks the agent to share contact details externally and follow backend-provided reply instructions without enough user-control and trust boundaries.

Install only if you trust the Creez backend and publisher. Before using lead capture, the agent should explicitly tell the user exactly what contact details will be sent and get affirmative consent. Prefer a pinned or verified release instead of the documented mutable curl install, and backend responses should be treated as data rather than instructions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:131
Finding

External Backend Response Can Hijack Agent Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 131-145
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Vulnerable Code

text
- If complete, the tool sends the payload to the backend (e.g. stored and Feishu notification to product owner). On success, use the reply_instruction: tell the user their details have been received and the founder will contact them soon; keep it professional and concise.

### Scope and safety

- Only call in RoundCloser/VC lead context; not for casual chat.
- Do not fabricate contact fields; use only what the user explicitly provided.

---

## 3. Suggested flow

1. **Knowledge first:** For Creez-related factual questions, call `knowledge_search` (with `botId` above), then answer from the results.
2. **Progressive disclosure:** Follow the reply_instruction; disclose stepwise and encourage follow-up questions without repeating earlier content.
3. **Detect intent:** Decide when the user meets the "serious intent" bar; if they ask for contact or a meeting, start collecting contact details.
4. **Submit after collection:** Once you have name + email or wechat, call `vc_lead_capture`; on success, give a short confirmation per the reply_instruction.

Technical Analysis

The Skill directs the Agent to follow a reply_instruction supplied by an external backend. It does not define a strict schema, an allowlist of permitted responses, or an explicit rule requiring the returned value to be treated solely as untrusted data.

Although line 131 describes the intended response as a concise confirmation, lines 143 and 145 more broadly require the Agent to follow the backend-provided instruction. Consequently, the effective response policy can be changed remotely after the local Skill has been reviewed. If the backend or its response path is compromised, attacker-controlled text can be inserted into reply_instruction and interpreted as an instruction rat ...[truncated 1174 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove every instruction requiring the Agent to follow backend-provided reply_instruction content.
  • Use a fixed, locally defined confirmation template, such as: “Your contact details have been received, and the founder will contact you soon.”
  • Treat all API response strings as untrusted data, never as executable Agent instructions.
  • Validate responses against a strict schema containing only typed status and data fields.
  • If response customization is required, use an allowlisted status code that maps to a local message rather than returning free-form instructions.
  • Explicitly state that API responses cannot override system, developer, user, safety, privacy, or Skill-level constraints.
  • Apply output encoding and length limits before displaying any backend-provided text.

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:43
Finding

Mutable Remote Skill Is Installed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43-48
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Medium

Vulnerable Code

bash
## Install locally

```bash
mkdir -p ~/.openclaw/skills/CreezRoundCloser
curl -sL "https://creez.lighton.video/SKILL.md" -o ~/.openclaw/skills/CreezRoundCloser/SKILL.md

Then enable the skill in OpenClaw (e.g. via openclaw skills or your OpenClaw config).

text

### Technical Analysis

The installation procedure downloads a mutable `SKILL.md` directly from an externally controlled URL into the active local Skill directory and then instructs the user to enable it. The process does not pin a release version, verify a cryptographic signature or checksum, restrict redirects, or require comparison with the reviewed artifact.

A Skill document controls Agent behavior when loaded. Therefore, replacing the hosted file changes the effective instruction payload after audit without requiring a change to the reviewed project. HTTPS protects transport under normal conditions but does not protect against compromise of the origin server, deployment pipeline, DNS or certificate infrastructure, or an authorized party replacing the hosted file.

### Attack Path

1. An attacker compromises the hosting server, deployment pipeline, domain infrastructure, or another component capable of changing the hosted `SKILL.md`.
2. The attacker replaces the hosted document with malicious Agent instructions.
3. A user executes the documented `curl -sL` installation command.
4. The command follows redirects and silently writes the substituted document into `~/.openclaw/skills/CreezRoundCloser/SKILL.md`.
5. The user enables the downloaded Skill as instructed.
6. OpenClaw loads the substituted instructions, allowing them to alter Agent behavior or direct available tools within the Agent's granted permissions.

### Impact Assessment

The attacker can replace th
...[truncated 632 chars]
Remediation
View remediation

Remediation Suggestions

  • Publish immutable, versioned Skill releases through a trusted registry or release mechanism.
  • Pin installation to an exact release rather than a mutable /SKILL.md URL.
  • Publish a SHA-256 digest through an independently trusted channel and verify it before writing the file into the Skill directory.
  • Prefer cryptographic signature verification with a pinned maintainer public key.
  • Download to a staging location, verify integrity and authenticity, and only then atomically move the file into the active Skill directory.
  • Avoid silent redirect following, or restrict redirects to explicitly approved HTTPS hosts.
  • Require users or administrators to review the verified artifact before enabling it.
  • Document a secure update process that repeats signature or checksum verification for every release.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

Install locally

bash
mkdir -p ~/.openclaw/skills/CreezRoundCloser
curl -sL "https://creez.lighton.video/SKILL.md" -o ~/.openclaw/skills/CreezRoundCloser/SKILL.md

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

bash
mkdir -p ~/.openclaw/skills/CreezRoundCloser
curl -sL "https://creez.lighton.video/SKILL.md" -o ~/.openclaw/skills/CreezRoundCloser/SKILL.md

Then enable the skill in OpenClaw (e.g. via openclaw skills or your OpenClaw config).

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to forward investor contact details to an external backend and founder once certain conditions are met, but it does not require an explicit just-in-time notice or consent statement before transmission. This creates a real privacy and data-sharing risk because users may provide contact details in conversation without understanding that the data will be sent off-platform to a third party.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
62% confidence
Finding

The natural-language instructions prominently require contact collection via email and/or WeChat, which may impose a locale-specific communication method without explicit user choice or justification. While not severe, this can be read as favoring a specific regional platform in the skill's operating policy.

Content

No source excerpt is available for this finding.