ClawHub
Back to skill

Security audit

log-polish-enus-images

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local blog-polishing workflow that is underimplemented, but its file access and saved outputs are disclosed and aligned with its stated purpose.

Install only if you are comfortable with the skill reading the configured draft file and saving a timestamped markdown output under ~/.openclaw/workspace/contentPolished or another outputDir you choose. Treat the current implementation as a rough template generator, not a trustworthy publish-ready editor or actual image generator.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest says the skill will polish a technical blog draft into a 1000–1200 word en-US article and preserve technical terms/code, but the implementation replaces the draft with a fixed template containing placeholder text like 'Content polished and restructured...' and 'Technical details preserved...'. There is no actual editing, translation, preservation of code blocks, or enforcement of the promised article quality/length beyond echoing metadata from the original draft.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill title and description require producing an "en-US" article, and the usage guidance tells the agent to use the skill when asked to polish a technical blog, without first confirming the user's preferred language or locale. This forces a specific locale in natural-language behavior and matches the policy category for language/locale violations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest and documentation describe a skill that can 'generate consistent hero + per-section image prompts' and the output schema allows actual generated images, but the workflow code never invokes any image-generation tool or writes image files. It only constructs prompt strings and placeholder image paths, so the advertised publish-ready image pack behavior is broader than the actual implementation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

The skill persists potentially sensitive draft-derived content to a predictable path under the user's home directory by default. In environments with shared accounts, weak filesystem hygiene, or later automated publishing/sync, this can unintentionally retain and expose private or unpublished material beyond the current session.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md
- **Structure**: reorganize into **3–4 sections total** (not more)
- **Length**: final content **1000–1200 words**
- **Images**: generate a **hero prompt** + **one prompt per section**, all in the same style/tone
- **Save**: write everything to `~/.openclaw/workspace/contentPolished/` using `yymmddhhmm-*` naming

## When to Use This Skill

Session Persistence

Medium
Category
Rogue Agent
Confidence
79% confidence
Finding

Timestamped filenames and automatic directory creation establish durable session artifacts without prompting the user. This increases traceability of user activity and can leak existence, timing, and subject matter of drafts to other local processes or users with filesystem access.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

  1. Resolve defaults:
    • draftPath = input.draftPath || "~/.openclaw/workspace/contentDraft/latestDraft.md"
    • outputDir = input.outputDir || "~/.openclaw/workspace/contentPolished/"
  2. Create a timestamp prefix ts in yymmddhhmm format (Linux/macOS):
text
date +"%y%m%d%H%M"

Unbounded Output

Medium
Category
Output Handling
Confidence
60% confidence
Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

md
- Add missing connective tissue *only* where the meaning is unclear
- **Do not reduce content** (no big deletions)

### Step 4 — Enforce Length (1000–1200 Words) Without Cutting Meaning

Target final length 1000–1200 words (counting English words approximately by rough equivalence).

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

Writing polished markdown and image filenames to disk creates persistent records of user content and workflow outputs, which may include confidential pre-publication material. The danger is higher in this context because blog drafts often contain embargoed content, internal architecture details, or unreleased technical information.

Content

Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.

md
1. Decide `subject`:
   - `subject = input.subject || slugify(title)` (lowercase, hyphens)
2. Write the polished markdown:
   - `{{outputDir}}/{{ts}}-{{subject}}.md`
3. Determine image filenames:
   - Hero: `{{ts}}-main.png`

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The skill behavior includes saving polished content and image-related outputs into a local workspace directory, which affects user data on disk. Although the document mentions where files are saved, it does not present this as a user-facing warning or caution about automatic file creation/overwrite behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The dependency note claims there are no dependencies and frames the skill as pure Markdown input/output, yet the workflow relies on multiple shell commands such as mkdir, date, sed, grep, wc, seq, cat, and jq. This is an active mismatch between the stated implementation model and what the code actually requires at runtime.

Content

No source excerpt is available for this finding.