ClawHub
Back to skill

Security audit

Blog Polisher

Security checks for vulnerabilities and agentic risk

Overview

This is a simple blog-polishing skill that reads a user-specified Markdown draft and writes a polished Markdown copy, with no evidence of hidden execution, exfiltration, or persistence beyond the output file.

Install only if you are comfortable letting the agent read the Markdown file path you provide and create a polished copy on disk. Check the input and output paths carefully, especially when supplying a custom outputPath, because the skill does not constrain paths in its instructions or metadata.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (9)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
5. **Output Polished**  
   Set `outputPath` = input.draftPath + "-polished.md` if not given.  
   Use your markdown write skill: `write_file --path {{output.polishedPath}} --content [polished_md]`.  
   Respond:  
   - Link to new file.  
   - Bullet changes: "- Fixed [typo/grammar]. - Added clarity to [para]. - Paragraph advice: [if any]."

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md
5. **Output Polished**  
   Set `outputPath` = input.draftPath + "-polished.md` if not given.  
   Use your markdown write skill: `write_file --path {{output.polishedPath}} --content [polished_md]`.  
   Respond:  
   - Link to new file.  
   - Bullet changes: "- Fixed [typo/grammar]. - Added clarity to [para]. - Paragraph advice: [if any]."

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · draft.md (reported line 50)May include surrounding context.

md
-quality (active) ~3000, at ClawHub.ai
    - My published skill > https://clawhub.ai/dashboard by `clawhub publish /home/jeff/.openclaw/workspace/skills/blog-editor --slug blog-editor --name "blog-editor" --version 1.0.1`
    - See below for more info
- Automation
- Media

#### Skills

Skills are organized into approximately 28 categories to help users find specific functionalities: 

- Developer Tools: Includes GitHub integration, Linear project management, and automated coding agents (543+ skills).
- AI & LLMs: Tools for specialized models, prompt engineering, and consciousness frameworks (287+ skills).
- Search & Research: Specialized scrapers using Playwright and academic research tools (253+ skills).
- Social & Communication: Email infrastructure via AgentMail and social network integrations for agents (189+ skills).

> Ref > [opencaw how many skills in clawhub community](https://www.google.com/search?client=firefox-b-d&q=openclaw+how+many+skills+in+clawhub+community+totally&udm=5

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The description says the skill 'polishes your blog draft in markdown' and 'adds clarity if needed' without defining specific trigger phrases or clear boundaries for when the skill should activate. In a manifest/markdown context, this broad wording could overlap with common writing-help requests and lacks exclusion conditions or negative examples.

Content

No source excerpt is available for this finding.

Scope Creep

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill declares no required capabilities, yet its workflow explicitly instructs the agent to read a user-supplied local file and write a new local file. This mismatch weakens security review and user consent because the manifest understates the skill's actual privileges and side effects.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

The workflow persists model-generated content to disk, which creates durable state outside the session. If the input path or output path is abused, this could overwrite or plant content in unintended locations, making the file-write capability more sensitive than a purely in-memory editing action.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
5. **Output Polished**  
   Set `outputPath` = input.draftPath + "-polished.md` if not given.  
   Use your markdown write skill: `write_file --path {{output.polishedPath}} --content [polished_md]`.  
   Respond:  
   - Link to new file.  
   - Bullet changes: "- Fixed [typo/grammar]. - Added clarity to [para]. - Paragraph advice: [if any]."

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · draft.md (reported line 117)May include surrounding context.

md
#### Security (永遠的話題)

- Protect all of your API keys - `chmod 700 .openclaw/credentials/` 
- Channel > `openclaw channels list`
- Network: `openclaw gateway` with proxy, eg. `openclaw tui`
- 永遠的話題。這個可以成為一個有償服務！

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The skill instructs the agent to create a new file by default but does not clearly foreground that behavior to the user at the point of execution. This can lead to unintended file creation or confusion about where modified content is being stored, especially when output paths are derived automatically.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The statement contrasts English with other languages and says foundational large language models are initially trained in English, which can be read as prescribing English as the preferred interaction language. Because the document does not offer a user choice or explain a justified locale-specific constraint, this may conflict with language/locale neutrality expectations.

Content

No source excerpt is available for this finding.