ClawHub
Back to skill

Security audit

blog-polish-eng-images

Security checks across malware telemetry and agentic risk

Overview

This skill reads a blog draft, writes a polished version and image prompts to a disclosed output folder, and does not show hidden or unrelated behavior.

Before installing, understand that polished drafts and image prompt metadata are saved to disk by default. Use a custom outputDir or delete generated files afterward if the draft contains unpublished, proprietary, or sensitive material.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Session Persistence

Medium
Category
Rogue Agent
Content
- **Structure**: reorganize into **3–4 sections total** (not more)
- **Length**: final content **1000–1200 words**
- **Images**: generate a **hero prompt** + **one prompt per section**, all in the same style/tone
- **Save**: write everything to `~/.openclaw/workspace/contentPolished/` using `yymmddhhmm-*` naming

## When to Use This Skill
Confidence
83% confidence
Finding
write everything to `~/.openclaw/workspace/contentPolished/` using `yymmddhhmm-*` naming ## When to Use This Skill When the user asks to polish a technical blog, and create images, you MUST use this

Session Persistence

Medium
Category
Rogue Agent
Content
1. Decide `subject`:
   - `subject = input.subject || slugify(title)` (lowercase, hyphens)
2. Write the polished markdown:
   - `{{outputDir}}/{{ts}}-{{subject}}.md`
3. Determine image filenames:
   - Hero: `{{ts}}-main.png`
Confidence
87% confidence
Finding
Write the polished markdown: - `{{outputDir}}/{{ts}}-{{subject}}.md` 3. Determine image filenames: - Hero: `{{ts}}-main.png` - Per section: `{{ts}}-section1.png`, `{{ts}}-section2.png`, ... 4

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.