Clawvicular

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:34 PM UTC
• Version: 1.0.0

Overview

This skill is openly a daily looksmaxxing content bot, but it can publish unattended posts and may surface unsafe medical, self-harm-adjacent, hateful, or body-image-harmful material without safeguards.

Install only if you intentionally want an edgy looksmaxxing/Clavicular content bot and are comfortable with persistent local tracking, source archiving, live web lookups, and potentially harmful community language. Do not enable the cron/announce command for a public or group channel unless you add review, filtering, and safety guidance first.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: SKILL.md:100
• Finding: Persistent Scheduled Agent Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:100-104` **Additional Location**: `README.md:27-32` **Vulnerability Type**: `T06: System Persistence` **Risk Level**: High ### Vulnerable Code ```bash openclaw cron add --name "clawvicular-daily" \ --cron "0 10 * * *" --tz "America/Los_Angeles" \ --session isolated \ --message "Run the /clawvicular skill: generate today's looksmaxxing tip and Clavicular news." \ --announce --channel telegram --to "<channel-id>" ``` ### Technical Analysis The documented command registers a recurring OpenClaw cron task that survives the initial skill run and invokes the agent every day. Each scheduled invocation can conduct web searches, modify local state and source files, generate content, and publish that content to an external messaging channel. This constitutes system persistence because execution continues across sessions until the cron entry is explicitly removed. The behavior is openly documented and requires the user to run the setup command; the audit found no evidence of covert installation or an undisclosed backdoor. Nevertheless, the scheduled job creates an unattended execution path with network, filesystem, and external-publication effects. The use of an isolated session limits session-level carryover but does not eliminate the persistence itself or the risks associated with processing changing web content without interactive review. ### Attack Path 1. A user follows the installation instructions and runs the supplied `openclaw cron add` command. 2. OpenClaw registers the `clawvicular-daily` recurring task. 3. At 10:00 AM Pacific Time each day, the task starts an isolated agent session without requiring fresh user approval. 4. The skill performs web searches against external, dynamically changing content. 5. It updates local state and the persistent source archive. 6. It publishes generated output to the configured Telegram or other messaging destination. 7. This process repeats until ...[truncated 963 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make cron registration explicitly optional and separate it from normal skill installation. 2. Display a clear confirmation explaining the schedule, network activity, filesystem writes, publication destination, and removal procedure before registration. 3. Require explicit approval before externally publishing each generated post, or place generated content in a review queue. 4. Restrict web research to an allowlist of trusted domains and treat all retrieved material as untrusted data rather than agent instructions. 5. Run scheduled sessions with least-privilege filesystem and network permissions. 6. Restrict write access to the specific state and source files required by the workflow. 7. Validate the destination channel identifier and show the resolved destination before enabling announcements. 8. Add an expiration time, maximum-run count, or automatic disablement after repeated failures. 9. Log every scheduled invocation, network source, file modification, and publication action. 10. Provide the removal command next to the installation command: ```bash openclaw cron remove --name "clawvicular-daily" ``` 11. Offer a safer manual invocation mode as the default configuration. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Session Persistence

Medium

• Category: Rogue Agent

Content

3. Pick a random term that has NOT been sent yet.
4. If all terms have been sent, reset the sent list (clear the file) and start over.

### Step 2: Write the Slang Tip

1. Using the picked term's definition and example from `{baseDir}/references/slang-dictionary.md`, write a short tip explaining the term.
2. Optionally, search Urban Dictionary for the term to get the freshest/most authentic community definition:

• Confidence: 87% confidence
• Finding: The skill maintains session-spanning memory by reading and updating `sent-terms.json`, including resetting and rewriting the file when all terms are exhausted. This is a genuine persistence behavior that can surprise users, affect reproducibility, and create a durable record of prior executions without any explicit consent or retention policy.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to modify persistent files (`state/sent-terms.json` and `references/sources.md`) as part of normal execution, but it does not warn the user that invoking the skill will write to disk and permanently alter local state. This creates a real integrity and transparency issue: users may believe they are only generating content, while the skill silently accumulates archived URLs and mutates state across runs.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This section gives a detailed, normalized inventory of anabolic steroids, peptides, prescription drugs, and admitted methamphetamine use under a branded 'Drug Stack (Pharmamaxxing)' heading, without an explicit health-risk warning or discouraging framing. In the context of a youth-skewing looksmaxxing skill, that level of specificity can function as tacit instruction or glamorization, increasing the chance of imitation, unsafe self-medication, or medical harm.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This section includes self-harm-adjacent and physically dangerous body-modification slang such as 'bonesmashing' and 'ropemaxxing,' with examples that normalize or joke about injury and suicidal ideation. In a slang/reference skill aimed at daily tips with 'Extremely online Gen Z energy,' this framing increases the chance such terms are repeated to users without crisis-sensitive context or harm warnings.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The file catalogs pharmaceuticals, hormones, peptides, surgery, and extreme weight-loss practices in a casual, promotional tone without a general medical disclaimer. Because this is a reusable reference for an agent skill, the assistant may surface these terms as suggestions or normalized options for appearance improvement, encouraging unsafe self-treatment or elective procedures without professional guidance.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: This section embeds rigid attractiveness hierarchies, gender stereotypes, and derogatory identity labels as if they are default evaluative frameworks. In the context of a personality-driven skill serving daily content, these norms can be amplified as authoritative language, contributing to harassment, discriminatory outputs, and body-image harm for users who did not opt into that framing.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This markdown file instructs maintainers to keep updating a repository of tweets, clips, and articles, including references to drug use, underage abuse, racial slurs, violence, and Nazi salutes. Because the file is a markdown artifact and contains no warning that the skill may surface disturbing or unsafe content, it lacks the user disclosure expected for material that could affect user safety or wellbeing.

Static analysis

No suspicious patterns detected.