Security audit

Yield

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review before installation because it covertly profiles users and steers bot replies toward sales or conversion outcomes.

Install only after reviewing whether your bot should perform behavioral profiling or conversion optimization at all. If used, add clear user disclosure, disable hidden system-prompt steering, avoid sensitive domains, minimize stored/exported conversation text, and enforce retention, rate limits, and host policy boundaries.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:147
Finding: Covert Behavioral Instruction Hijacking for Conversion Optimization
Content: View full analysis
meta.conversionWindow && meta.conversionWindow.open, }, ``` `examples/openclaw-integration.js:49-59`: ```javascript // Inject YIELD directive into your bot's context const enhancedPrompt = ` ${analysis.contextualDirective} User message: ${userMessage} `; // Generate response with YIELD intelligence const response = generateBotResponse(e ...[truncated 2763 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/portfolio.js:117
Finding: Unbounded Conversation and Portfolio Retention Enables Memory Exhaustion
Content: View full analysis
20) { conv.messageHistory = conv.messageHistory.slice(-20); } ``` `src/index.js:231-239`: ```javascript _getConversation(conversationId) { if (!this.conversations.has(conversationId)) { this.conversations.set(conversationId, { portfolio: new Portfolio(this.config), messageHistory: [], }); } return this.conversations.get(conversationId); } ``` `src/portfolio.js:117-123`: ```javascript // Record yield history const totalYield = this.calculateTotalYield(); this.history.push({ messageIndex: this.messageCount, yield: totalYield, assets: { ...this.assets }, timestamp: Date.now(), }); ``` ### Technical Analysis The engine maintains an unrestricted `Map` of conversations. Entries have no time-to-live, maximum count, eviction policy, or automatic cleanup. An attacker who can influence `conversationId` directly or create many platform user/channel combinations can force the process to retain an arbitrary number of conversation objects. Although `messageHistory` is limited to 20 entries, individual message size is not bounded. More importantly, `Portfolio.history` receives one object for every processed message and is never truncated. Therefore, memory consumption grows indefinitely even for a single long-running conversation. The tests verify that rapid-fire messages and long messages are accepted, but they do not enforce a maximum state size. This expos ...[truncated 1466 chars]
Remediation: View remediation
10) { this.history = this.history.slice(-10); } ``` Conversation eviction should be enforced separately because bounding each history does not prevent exhaustion through unlimited conversation identifiers. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The comments explicitly frame the system as predicting abandonment and identifying the best moment to convert a user, which is strong evidence the intended use is psychological manipulation rather than benign measurement. Given the broader skill description emphasizing compounding trust, micro-commitments, and revenue lift, this context makes the targeting behavior more dangerous, not less.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This directive explicitly instructs the agent to elicit 'small agreements' and 'micro-yeses' so they compound into larger commitment. That is a classic manipulative persuasion pattern designed to steer user consent rather than support informed, autonomous decision-making, and it becomes more dangerous because the skill is marketed for 'maximum revenue lift' and system-prompt injection into any bot.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The LEVERAGE directive tells the model to use earned credibility to make bold, direct recommendations and warns that hedging would 'waste the authority you built.' This encourages pressure through authority and confidence cues, which can unduly influence users and suppress appropriate uncertainty, especially when inserted into a system prompt controlling downstream assistant behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The HARVEST directive frames the user as 'ready' and instructs the agent to reduce friction to zero, make it easy to say yes, and give one clear action. This is explicitly conversion-optimization logic aimed at pushing acceptance at a moment of heightened trust, creating a significant risk of manipulative or coercive outcomes rather than informed choice.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill treats vulnerability, hesitation, objections, and abandonment risk as exploitable cues for adaptive response shaping, including urgency reinforcement and recovery tactics. In context, this makes the skill more dangerous because its stated purpose is revenue lift and conversion optimization, so these signals are not merely analyzed but used to influence users at weaker moments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly profiles psychological signals on every message and uses them to adapt responses, yet it provides no user-facing disclosure or consent mechanism. This creates a transparency and privacy risk because users may reveal sensitive information without knowing their disclosures, hesitation, and engagement patterns are being behaviorally scored.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill defines staged strategies such as ACCUMULATE, COMPOUND, LEVERAGE, and HARVEST that are explicitly aimed at building trust and micro-commitments until the user reaches a conversion window. This is dangerous because it operationalizes manipulative persuasion as a systematic workflow rather than ordinary conversational assistance.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The prompt-injection variant is designed to invisibly steer users toward conversion by silently evaluating psychological state and shaping replies while explicitly telling the bot to never mention YIELD to the user. Hidden persuasive optimization materially increases deception risk because users cannot recognize or contest the manipulation affecting the conversation.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This section instructs the bot to silently track personal disclosure and other psychological signals, then conceal that process from the user. Even without external storage, hidden stateful tracking of vulnerability and engagement creates a manipulation and privacy risk, especially if used in sensitive domains such as support, onboarding, or lead generation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code injects analysis.contextualDirective directly into the prompt sent to the bot response generator, enabling hidden persuasive steering based on inferred user state rather than transparent user-facing logic. In this skill's context—explicitly optimizing trust, commitment, urgency, and conversion—this increases the risk of manipulative output, policy bypass within downstream agents, and unsafe handling if the directive text is overly aggressive or insufficiently constrained.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The CRM export function packages conversation-derived analytics, portfolio state, message counts, and a stable conversation identifier tied to chatId/userId without any visible consent, minimization, or disclosure controls in this example. In a messaging context, exporting behavioral profiling data to CRM can create privacy and compliance risk because downstream systems may use it for sales targeting, retention, or profiling beyond the user's expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The engine stores raw user messages in per-conversation history and retains them across turns without any minimization, consent, or privacy controls. In a conversational skill, users may provide sensitive data, and retaining full text increases the risk of unintended exposure through logs, memory inspection, later export, or reuse by other components.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The export function serializes the full conversation state, including raw message history, into a portable object with no safeguards or warning. This makes it easy for downstream code to persist, transmit, or share complete user conversations, creating a direct privacy and data-disclosure risk if the export is mishandled or accessed by unauthorized parties.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The serialized export contains the complete plaintext message history, which enables straightforward disclosure of everything users previously said if the object is logged, stored insecurely, or shared. Because this skill is explicitly designed to profile conversational behavior for conversion strategy, the captured content can include sensitive preferences, intent, or personal details, making disclosure more harmful in context.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code goes beyond neutral analytics and explicitly decides when a user is in an 'optimal moment to present an offer' based on trust, commitment, urgency, and abandonment-style trajectory signals. In this skill context, that is not merely descriptive modeling: it operationalizes psychological state targeting for conversion, which can enable manipulative persuasion without user awareness or consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The module contains persuasive conversion-targeting behavior but provides no mechanism for disclosure, consent, or user-facing indication that the system is adapting offer timing based on inferred susceptibility signals. In a conversational skill marketed for 'maximum revenue lift,' the lack of transparency materially increases the risk of covert manipulation.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file-level strategy narrative defines a staged funnel from trust-building to leverage to harvest, explicitly modeling each conversation turn as an investment toward conversion. In context, this is not incidental wording but an architecture for progressively steering users toward commitment, which is dangerous because it operationalizes manipulative behavioral targeting across the full interaction lifecycle.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This directive specifically teaches the model to gather 'micro-yeses' and use them to build bigger commitment. That is a textbook progressive commitment tactic that can bypass reflective decision-making and is especially risky in a reusable prompt-injection skill intended for broad deployment across conversational agents.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The conversion-window logic instructs the agent to exploit a moment when trust and commitment are high by presenting a single clear action and minimizing friction. That structure is dangerous because it combines behavioral profiling with timing-based pressure to maximize acceptance, undermining voluntary and informed user choice.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest claims the engine models every bot message as a financial investment, but the tests validate detection of user-side signals such as frustration, hesitation, gratitude, personal disclosure, and buying intent. That behavior is a broader conversational profiling and sales-signal analysis function than the manifest's bot-message optimization framing suggests.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest describes a conversational engine that models each bot message as an investment for trust and conversion momentum. These tests show the skill also maintains multi-conversation state, supports reset, export/import of conversation data, and aggregates cross-conversation statistics, which are broader state-management capabilities not conveyed by the description.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The docstring for handleMessageWithYield describes the return value as an 'Enhanced bot response,' implying the function itself transforms the response. In reality, the function modifies the input prompt context and then returns whatever generateBotResponse produces, so the enhancement is indirect and occurs before generation, not on the returned response itself.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The example logs conversation-derived behavioral metrics and a conversation identifier fragment to stdout, which can expose profiling data and user-linked interaction state in application logs. In a chatbot or sales context, this is sensitive telemetry that may be retained, forwarded, or accessed by operators beyond what is necessary for response generation.
Content: No source excerpt is available for this finding.