Security audit

Link All

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent, but it can create persistent platform-connection skills and may record authentication configuration without clear safeguards against saving secrets.

Review this skill before installing if you use it for accounts, APIs, or CLIs. Do not let generated skills store raw tokens, private keys, session cookies, full auth headers, or sensitive account details; require a preview of any files written under ~/.openclaw/skills/ and keep credentials in a proper secret store or environment variable reference.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Credential Access

High

Category: Privilege Escalation
Content: ### 基本信息 - 官网：https://github.com - 类型：代码托管平台 - 认证方式：Personal Access Token (PAT) ### 技术文档 - API：https://docs.github.com/rest
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill covers authentication setup for plugins, CLI tools, and APIs, but it does not warn users about handling API keys, OAuth tokens, SSH keys, or other secrets. This omission increases the chance that users will paste credentials into chat, store them insecurely, or allow them to be embedded in scripts or generated skills.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs creating directories and files under ~/.openclaw/skills/ after a successful link, but it does not explicitly warn the user that this modifies the local filesystem or require a separate consent step for the write operation itself. In an agent setting, undocumented writes to user home directories can surprise users, create persistence, and normalize unsafe file creation behavior.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The instruction to record the complete connection scheme, including authentication method and configuration parameters, into a reusable skill creates a strong risk that secrets or sensitive setup details will be persisted. In this context, the danger is elevated because the skill's whole purpose is platform linking, so credentials and connection metadata are central to its workflow.

Ssd 3

Medium

Confidence: 88% confidence
Finding: The example success report includes user identity and authentication state, which normalizes echoing account and auth details back into chat or logs. While not always catastrophic, this can leak sensitive operational information to shared transcripts, logging systems, or unintended viewers.

Natural-Language Policy Violations

Low

Confidence: 76% confidence
Finding: All user-facing instructions, prompts, and examples are in Chinese, including required reply options like "要" / "不要". This effectively imposes a language/locale expectation without user opt-in or a documented reason that the skill is region-specific.

Static analysis

No suspicious patterns detected.