ClawHub
Back to skill

Security audit

latent-press

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Latent Press publishing helper with expected API, scheduling, narration, and credential-handling behavior, though users should understand it can publish or delete content and persist an API key.

Install only if you want an agent to create, upload, publish, and potentially delete Latent Press content on your behalf. Prefer providing LATENTPRESS_API_KEY through your runtime's secret or environment mechanism, review any generated cron/automation command before enabling it, and use --yes deletion commands only when you intend irreversible removal.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (45)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description is about a publishing-platform integration for creating and publishing books on Latent Press. The supplied code does none of that. It reads a local file, analyzes prose patterns, formats lint findings, and optionally returns a failing exit code with --strict. There is no HTTP/network access, no authentication, no platform integration, no cron logic, and no book-management features. This is a materially different primary purpose, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
This is a standard Agent Skills folder (`SKILL.md` + `scripts/`). It runs unchanged on

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
| `schedule.js` | Prints the exact cron command for your runtime. Prints only, never executes |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

md
| `schedule.js` | Prints the exact cron command for your runtime. Prints only, never executes |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

md
| `schedule.js` | Prints the exact cron command for your runtime. Prints only, never executes |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
| `api.js` | All API operations. Start every session with `api.js resume` |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md
| `api.js` | All API operations. Start every session with `api.js resume` |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.

md
| `api.js` | All API operations. Start every session with `api.js resume` |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

md
| `api.js` | All API operations. Start every session with `api.js resume` |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md
| `narrate.js` | Render a voice-tagged chapter to one MP3 with edge-tts, fallbacks included |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 555)May include surrounding context.

md
| `narrate.js` | Render a voice-tagged chapter to one MP3 with edge-tts, fallbacks included |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 578)May include surrounding context.

md
| `narrate.js` | Render a voice-tagged chapter to one MP3 with edge-tts, fallbacks included |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 662)May include surrounding context.

md
| `narrate.js` | Render a voice-tagged chapter to one MP3 with edge-tts, fallbacks included |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

md
| `lint.js` | Flag the prose tells readers use to spot machine writing. `add-chapter` runs it for you |

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/api.js (reported line 285)May include surrounding context.

js
//
// Order (first hit wins):
//   1. LATENTPRESS_API_KEY          — the standard path. OpenClaw injects this from
//                                     skills.entries.<key>.apiKey / .env via primaryEnv;
//                                     Hermes exports profile .env vars to the shell tool.
//   2. .env beside this skill       — survives when env injection doesn't reach the process
//                                     (sandboxed runs, cron, bare `node scripts/api.js`).

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/key.js (reported line 5)May include surrounding context.

js
//
// Order (first hit wins):
//   1. LATENTPRESS_API_KEY          — the standard path. OpenClaw injects this from
//                                     skills.entries.<key>.apiKey / .env via primaryEnv;
//                                     Hermes exports profile .env vars to the shell tool.
//   2. .env beside this skill       — survives when env injection doesn't reach the process
//                                     (sandboxed runs, cron, bare `node scripts/api.js`).

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/key.js (reported line 6)May include surrounding context.

js
//
// Order (first hit wins):
//   1. LATENTPRESS_API_KEY          — the standard path. OpenClaw injects this from
//                                     skills.entries.<key>.apiKey / .env via primaryEnv;
//                                     Hermes exports profile .env vars to the shell tool.
//   2. .env beside this skill       — survives when env injection doesn't reach the process
//                                     (sandboxed runs, cron, bare `node scripts/api.js`).

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/key.js (reported line 7)May include surrounding context.

js
//
// Order (first hit wins):
//   1. LATENTPRESS_API_KEY          — the standard path. OpenClaw injects this from
//                                     skills.entries.<key>.apiKey / .env via primaryEnv;
//                                     Hermes exports profile .env vars to the shell tool.
//   2. .env beside this skill       — survives when env injection doesn't reach the process
//                                     (sandboxed runs, cron, bare `node scripts/api.js`).

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/key.js (reported line 44)May include surrounding context.

js
//
// Order (first hit wins):
//   1. LATENTPRESS_API_KEY          — the standard path. OpenClaw injects this from
//                                     skills.entries.<key>.apiKey / .env via primaryEnv;
//                                     Hermes exports profile .env vars to the shell tool.
//   2. .env beside this skill       — survives when env injection doesn't reach the process
//                                     (sandboxed runs, cron, bare `node scripts/api.js`).

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/schedule.js (reported line 120)May include surrounding context.

js
//
// Order (first hit wins):
//   1. LATENTPRESS_API_KEY          — the standard path. OpenClaw injects this from
//                                     skills.entries.<key>.apiKey / .env via primaryEnv;
//                                     Hermes exports profile .env vars to the shell tool.
//   2. .env beside this skill       — survives when env injection doesn't reach the process
//                                     (sandboxed runs, cron, bare `node scripts/api.js`).

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/schedule.js (reported line 135)May include surrounding context.

js
//
// Order (first hit wins):
//   1. LATENTPRESS_API_KEY          — the standard path. OpenClaw injects this from
//                                     skills.entries.<key>.apiKey / .env via primaryEnv;
//                                     Hermes exports profile .env vars to the shell tool.
//   2. .env beside this skill       — survives when env injection doesn't reach the process
//                                     (sandboxed runs, cron, bare `node scripts/api.js`).

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/schedule.js (reported line 146)May include surrounding context.

js
//
// Order (first hit wins):
//   1. LATENTPRESS_API_KEY          — the standard path. OpenClaw injects this from
//                                     skills.entries.<key>.apiKey / .env via primaryEnv;
//                                     Hermes exports profile .env vars to the shell tool.
//   2. .env beside this skill       — survives when env injection doesn't reach the process
//                                     (sandboxed runs, cron, bare `node scripts/api.js`).

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

The code constructs a path to a .env file in the skill directory and later reads secrets from it. While this is common practice, storing long-lived API keys in a local file beside the skill increases exposure to accidental inclusion, unintended read access by other local processes, or leakage from a compromised workspace; the skill context makes this somewhat more sensitive because it is explicitly handling publisher API credentials for automated agent workflows.

Content

Scanner excerpt · scripts/key.js (reported line 18)May include surrounding context.

js
const ENV_VAR = 'LATENTPRESS_API_KEY';
const SKILL_DIR = process.env.CLAUDE_SKILL_DIR || path.join(__dirname, '..');
const ENV_PATH = path.join(SKILL_DIR, '.env');

function fromEnvVar() {
  const key = (process.env[ENV_VAR] || '').trim();

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

saveKey persists the API key to a .env file on disk, creating a durable local secret that may outlive the session and be exposed through backups, workspace sharing, or other filesystem access. Although the code attempts to set mode 0600, this still expands the attack surface compared with ephemeral environment injection, especially in automated agent environments where many tools may access the workspace.

Content

Scanner excerpt · scripts/key.js (reported line 62)May include surrounding context.

js
function saveKey(key) {
  // mode: on writeFileSync only applies when the file is created, so an existing
  // .env keeps whatever permissions it had. chmod after the write, every time.
  const tmp = `${ENV_PATH}.${process.pid}.tmp`;
  try {
    fs.mkdirSync(SKILL_DIR, { recursive: true });

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/schedule.js (reported line 118)May include surrounding context.

js
'A crontab line on the machine where Claude Code and this skill are installed:',
      '',
      `CRON_TZ=${tz}`,
      `${cronExpr(time)} cd ${sh(path.dirname(SKILL_DIR))} && set -a && . ${sh(path.join(SKILL_DIR, '.env'))} && set +a && claude -p ${sh(prompt)} >> ~/latent-press-nightly.log 2>&1`,
      '',
      `Sources the .env that \`register.js\` wrote beside this skill (chmod 600) instead of putting the key in the crontab line itself.`,
      'Add it with `crontab -e`; the log holds each night\'s final message with the chapter link.',

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/narrate.js:123