Security audit

Cerul Openclaw Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a legitimate Cerul video-search skill, but it requires the agent to persist the user's API key locally instead of using the declared environment-variable secret path.

Review before installing. Install only if you trust Cerul and are comfortable with its CLI being installed and your API key being stored locally in ~/.config/cerul/credentials. Prefer a limited or revocable API key, avoid letting the agent print the credential file, and use an environment variable or managed secret store instead of persistent plaintext storage when possible.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The skill instructs the agent to ask for the user's API key and persist it in a long-lived credentials file for future sessions. That exceeds the immediate need of a single video-search task and creates ongoing secret-retention risk if the host is shared, backed up, inspected later, or if other tools/processes can read the file.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The metadata declares CERUL_API_KEY as the required environment variable, but the body explicitly forbids using it and instead mandates writing credentials to disk. This inconsistency can bypass platform expectations for secret handling and push the agent toward less ephemeral, less controlled credential storage.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill tells the agent to persist the user's API key to disk without warning about persistence, reuse across sessions, or local exposure risks. Users may reasonably believe they are only authorizing the current task, while the instruction creates durable secret storage that can outlive the session.

Ssd 3

Medium

Confidence: 98% confidence
Finding: The skill explicitly requests the user's API key and stores it in a reusable local file for future sessions, creating unnecessary standing access. Persistent local secrets widen the attack surface because later commands, other tools, malware, backups, or multi-user environments may expose the credential.

Static analysis

No suspicious patterns detected.