Blog Title Optimizer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:05 AM UTC
• Version: 1.0.7

Overview

The skill is a paid title generator, but it embeds a payment credential and attempts automatic SkillPay billing before generation, so users should review it carefully before installing.

Install only if you are comfortable with a third-party paid workflow that can attempt SkillPay billing automatically and pass your topic text to a local OpenClaw agent. The embedded merchant key should be removed or rotated, payment should require clear confirmation through a safer backend flow, and the dependency/install paths should be pinned and moved to trusted HTTPS sources before routine use. The inspected index.js also fails Node syntax checking, so this package may not run as published, but the exposed credential and intended payment flow remain review-worthy.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:6

Finding

Hard-Coded Merchant Credential Exposed in Source Code

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:13

Finding

Untrusted User Input Is Interpolated into Privileged Agent Instructions

Content

View full analysis

{ const child = spawn('openclaw', ['agent', '--agent', 'sloan', '-m', prompt], { encoding: 'utf-8', timeout: 60000 }); ``` ### Technical Analysis The command-line `topic` and `keywords` values are inserted directly into an instruction sent to the Sloan agent. Quotation marks around `topic` are only textual delimiters; they do not create a security boundary for a language model. An attacker can submit content that tells the agent to disregard the title-generation requirements and follow replacement instructions. The use of `spawn()` with an argument array prevents ordinary shell metacharacters in these fields from becoming shell commands, so this is not shell command injection. The vulnerability exists at the agent-instruction layer. The repository does not establish which tools, credentials, files, or contextual data are available to the Sloan agent. Therefore, direct host compromise cannot be claimed. If Sloan has tool access or privileged context in the deployed OpenClaw configuration, however, prompt injection could attempt to misuse those capabilities. ### Attack Path 1. An attacker supplies a crafted topic or `--keywords` value containing instructions such as a request ...[truncated 941 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:13

Finding

Installation Instructions Execute a Mutable Latest Package Release

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: package-lock.json:18

Finding

Dependency Lockfile Uses an Unofficial Plaintext HTTP Registry Mirror

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The stated purpose is simple blog title generation, but the skill also introduces payment processing, merchant credential usage, and local gateway token handling that are not clearly reflected in the primary description or permission model. Hidden or under-disclosed billing behavior is dangerous because it can lead to unauthorized charges, deceptive execution, or secret transmission under the guise of a benign writing utility.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 100% confidence

Finding

A hard-coded merchant key is embedded in source code, which can be extracted by anyone with code access and abused to perform unauthorized billing operations or impersonate the merchant. Because this is a live payment credential in a low-risk-appearing utility, the context makes it especially dangerous: a blog-title skill has no strong justification for exposing a charge-capable secret client-side.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill performs an external billing charge as part of a blog-title generator, which is outside the minimally necessary behavior implied by the skill description and creates financial risk. In this context, charging a payment API from a CLI utility can lead to unauthorized or unexpected transactions, especially because the capability is embedded directly in the tool rather than isolated behind explicit user consent and trusted payment flows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill makes outbound payment-processing requests unrelated to generating titles, introducing unnecessary network and financial capability into a content tool. This mismatch between declared purpose and actual behavior makes the skill materially more dangerous because users may not expect a title optimizer to initiate billing operations.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The project pins axios 1.13.6, which the scanner reports as affected by multiple advisories including SSRF/proxy-bypass and prototype-pollution-related MITM/credential theft issues. Because this skill is an AI-powered title optimizer and likely performs outbound HTTP requests to third-party APIs, a vulnerable HTTP client meaningfully increases risk of request manipulation, credential leakage, or unexpected access to internal resources depending on how the code uses axios.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 83% confidence

Finding

form-data 4.0.5 is flagged for CRLF injection via unescaped multipart field names and filenames. If the skill ever constructs multipart requests from user-controlled content, this can lead to malformed requests, header injection, request smuggling effects against downstream services, or bypass of server-side validation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The package is reported as resolving to axios 1.13.6, which has multiple known advisories including SSRF-related and prototype-pollution-assisted attack paths. Because this skill is an AI-powered agent component and axios is commonly used for outbound HTTP requests, a vulnerable version can materially increase risk of request forgery, credential leakage, or response manipulation if the runtime or surrounding code exposes attacker-controlled inputs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx clawhub@latest install blog-title-optimizer, which pulls and executes the latest published version of the package at install time rather than a pinned, reviewed version. If the upstream package is compromised, typo-squatted, or updated with malicious code, users may execute attacker-controlled code simply by following the installation instructions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents use of environment-based capabilities and sensitive tokens but does not declare any tool scope, permissions, or allowed-tools boundaries. This creates a transparency and containment problem: a user or host may believe the skill is purely text-generation while it can access local environment data, increasing the risk of unintended secret access or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The documented environment variables include a merchant key and gateway auth token, both of which are sensitive credentials, but the file provides no warning about secure storage, exposure risks, or whether they may be transmitted to external or local services. In a skill that appears to involve billing and gateway fallback, this omission increases the chance of credential mishandling and accidental leakage.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · index.js (reported line 7)May include surrounding context.

js

const { spawn } = require('child_process');

const CONFIG = {
  skillpay_api: 'https://api.skillpay.me/v1',
  merchant_key: process.env.SKILLPAY_MERCHANT_KEY || 'sk_91fff75ae2a7a71f8eceadcbcd816e24d57e58d9d04ccca45f0b3856af130aea',
  price_per_use: 0.001,
  currency: 'USDT'

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The skill delegates its core function to an external subprocess ('openclaw agent'), which expands the trust boundary and may execute opaque logic outside this file's control. While subprocess execution is not inherently malicious, for a simple title generator it increases attack surface and can expose user content to another tool without transparency.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

User-supplied topic and keyword data are sent to an external agent subprocess without any explicit privacy notice or consent mechanism. Even if the data seems low sensitivity, users may enter proprietary campaign plans or unreleased content ideas, so undisclosed transmission outside the local process is a real privacy and trust issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The lockfile hard-codes all package tarball URLs to a specific third-party regional mirror over plain HTTP rather than the default trusted registry or a configurable source. This increases supply-chain risk because installs depend on an external mirror without transport security, making tampering, mirror compromise, or unauthorized package substitution more plausible.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

• Category: Supply Chain
• Confidence: 80% confidence

Finding

follow-redirects 1.15.11 is reported as leaking custom authentication headers across cross-domain redirects. If this skill sends API keys or bearer tokens in outbound requests, an attacker controlling or influencing a redirect target could capture those credentials and abuse connected services.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The dependency uses a caret range (^1.6.0), which permits automatic installation of newer minor and patch releases instead of a single audited version. In a published skill, this weakens supply-chain control and can unexpectedly introduce breaking or vulnerable versions over time, especially because the dependency is network-capable and likely central to the skill's functionality.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

"author": "Matt",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.0"
  },
  "openclaw": {
    "skill": true,

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:27

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: index.js:8