ClawHub
Back to skill

Security audit

Session2blog Clawhub

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed local tool for turning OpenClaw session history into Markdown blog drafts, with privacy risks users should review before sharing outputs.

Install only if you are comfortable letting the skill read the session you choose. Avoid running it on conversations with secrets, customer data, private credentials, or sensitive paths, and manually inspect the generated Markdown before publishing or sharing it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The skill's documented purpose says it converts session history into a blog post and saves Markdown locally, but the content also describes additional behaviors such as local model integration, possible platform/publishing-related configuration, and promotional/output behavior not cleanly aligned with the stated scope. Security-relevant behavior mismatches reduce user ability to give informed consent and can hide data-handling pathways, especially because this skill reads complete session histories that may contain secrets or private data.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The script states that full content is only written locally, but in practice it emits session-derived content summaries to stdout. In environments where terminal output is logged, shared, or persisted by wrappers, this can leak sensitive conversation data contrary to user expectations and reduce the effectiveness of the redaction boundary.

Unvalidated Output Injection

High
Category
Output Handling
Content
"=== 对话内容 ===\n" + dialogue_text + "\n\n=== 写作指令 ===\n" + instruction_text
    )
    try:
        out = subprocess.run(
            ["ollama", "run", "qwen3:14b", prompt],
            capture_output=True, text=True, timeout=300,
        )
Confidence
95% confidence
Finding
The script forwards untrusted session dialogue directly into a powerful LLM prompt and asks for a complete article. Because session content may contain adversarial instructions, secrets, or misleading text, the model can be induced to ignore intended constraints, reproduce sensitive content, fabricate provenance, or generate dangerous output that may later be copied, saved, or published by the user.

Credential Access

High
Category
Privilege Escalation
Content
- 该贴代码就贴代码，该贴配置就贴配置（微信平台可减少代码密度）
- 标题从对话内容中提炼，不要用占位符，且必须符合指定平台的标题调性
- **敏感信息保护（强制）**：
  - 博文中**禁止出现**任何 API Key、Access Token、Secret、appkey 等凭证
  - **禁止出现**真实用户名、邮箱、手机号、真实全文件路径（如 `/Users/xxx/...`）
  - 如果对话中涉及上述内容，`s2b.sh` 已自动脱敏为 `<REDACTED>` / `<USER_HOME>/...` 等占位符，请**保持脱敏状态**，不要还原
  - 如需引用路径，用模糊化写法（如 `~/.openclaw/...` 或 `<项目目录>/...`）
Confidence
90% confidence
Finding
This skill is explicitly designed to read and process complete conversation history, and the warning acknowledges that sessions may contain API keys, tokens, emails, and local paths. Even though the text says it will attempt redaction, relying on best-effort sanitization after broad access to sensitive session content is risky: failures in redaction could leak secrets into generated Markdown files or downstream publication workflows.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.