Security audit
Security checks for vulnerabilities and agentic risk
The skill does not show malware-like behavior, but it should be reviewed because its workflow does not perform the polish/translation it advertises and writes persistent output files by default.
Review this skill before installing. It appears safe from a malware perspective, but it may disappoint or mislead users because the coded workflow writes placeholder content instead of a real polished translation. Use a custom output directory for sensitive drafts and verify the generated article before relying on it or publishing it.
The manifest description claims a polishing and translation-oriented workflow for technical blog drafts with images. The code reads the draft, extracts minimal metadata, writes a placeholder markdown skeleton, and generates generic prompt strings; it never performs translation and does not substantively polish the source text.
The documentation says the skill will turn a draft into a publish-ready article with spelling/grammar fixes, clarity improvements, preserved technical content, and a 1000–1200 word result. In the implementation, polish_content constructs a hardcoded markdown template with placeholder text like Content polished and restructured... and Technical details preserved..., without actually editing or preserving the source draft content.
The description mandates producing an "en-US article," which imposes a specific language/locale choice regardless of the user's preference. The file does not offer a language or locale option, nor does it justify why en-US is required.
The trigger list includes "polish blog", which is short and generic enough to match many ordinary editing requests without clearly indicating the skill's narrower scope of technical-blog polishing plus image prompt generation. The file does not provide negative examples or exclusion conditions to clarify when this skill should not activate.
The documentation explicitly states the final article should have 3–4 sections total. The code always emits Introduction, Section 1, Section 2, and Summary, and may leave Section 2 empty depending on the shell expression, rather than planning and enforcing the documented section structure from the draft.
The skill persistently saves derived content into a predictable user-home workspace path by default. In a multi-skill or shared-environment setting, predictable session persistence can expose sensitive draft content to later processes, create unintended retention, and increase the blast radius of accidental activation.
- **Structure**: reorganize into **3–4 sections total** (not more)
- **Length**: final content **1000–1200 words**
- **Images**: generate a **hero prompt** + **one prompt per section**, all in the same style/tone
- **Save**: write everything to `~/.openclaw/workspace/contentPolished/` using `yymmddhhmm-*` naming
## When to Use This Skill
The instruction says to use the skill when the user asks to polish a technical blog and create images, but it does not clearly define boundaries such as whether non-technical blogs, image-only requests, or translation-only requests should activate it. This ambiguity can cause unintended invocation in adjacent writing-assistance scenarios.
The usage and defaults sections state that the skill produces a polished en-US version and provide no mechanism for opting into another locale. This is a natural-language policy concern because it constrains output locale without user choice or stated necessity.
The workflow standardizes timestamped filenames in a known location, which makes stored outputs easy to enumerate and correlate across sessions. While not an exploit by itself, this predictable persistence weakens privacy boundaries and can leak user activity patterns or sensitive article content to other local components.
draftPath = input.draftPath || "~/.openclaw/workspace/contentDraft/latestDraft.md"outputDir = input.outputDir || "~/.openclaw/workspace/contentPolished/"ts in yymmddhhmm format (Linux/macOS):date +"%y%m%d%H%M"
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
- Add missing connective tissue *only* where the meaning is unclear
- **Do not reduce content** (no big deletions)
### Step 4 — Enforce Length (1000–1200 Words) Without Cutting Meaning
Target final length 1000–1200 words (counting English words approximately by rough equivalence).
The documentation says to create one prompt for each section heading and to match the actual section structure. The implementation only counts ## headings from the original draft and then emits generic prompts like Section 1: key concept diagram..., without extracting or using actual section headings or aligning them to the polished output.
The skill instructs writing polished markdown and image filenames to disk as part of normal operation, creating durable artifacts from user-supplied drafts. Because the path and naming scheme are deterministic, sensitive content may remain accessible longer than intended and be consumed by subsequent tools without renewed user consent.
1. Decide `subject`:
- `subject = input.subject || slugify(title)` (lowercase, hyphens)
2. Write the polished markdown:
- `{{outputDir}}/{{ts}}-{{subject}}.md`
3. Determine image filenames:
- Hero: `{{ts}}-main.png`
The skill writes output files to disk by default, but the user-facing description does not clearly warn about this side effect. Hidden persistence increases the chance of surprising file creation, accidental overwrites, and retention of potentially sensitive draft-derived content in a predictable workspace location.