Security audit

Content Creation Multi Agent

Security checks for vulnerabilities and agentic risk

Overview

This content-creation skill has useful disclosed features, but its installer, credential handling, and publishing scripts create high-impact risks that need manual review before installation.

Install only after reviewing the scripts locally. Avoid curl|bash, do not paste App Secret into chat, rotate any secret already entered, keep bot configs out of indexed/shared folders, and do not run the publishing scripts unless you understand that they can alter Git credential storage, remotes, repository contents, and public GitHub state.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: README.md:61
Finding: Unpinned Remote Script Is Downloaded and Executed Directly
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/configure-bot.sh:37
Finding: Feishu App Secret Is Echoed and Stored in Plaintext Configuration Files
Content: View full analysis
"$CONFIG_FILE" << EOF { "robot_name": "$ROBOT_NAME", "app_id": "$APP_ID", "app_secret": "$APP_SECRET", ``` It is duplicated in each selected agent configuration: ```bash cat >> "$CONFIG_FILE" << EOF { "name": "$AGENT_NAME", "role": "$ROLE", "model": "$AGENT_MODEL", "thinking": $THINKING, "feishu": { "appId": "$APP_ID", "appSecret": "$APP_SECRET" }, ``` ### Technical Analysis The script uses ordinary `read` rather than silent input, causing the App Secret to be visible on the terminal while it is entered. It then writes the credential into a timestamped plaintext JSON file under `~/.openclaw/workspace-main/bot-configs/`, including duplicate copies for individual agents. The script does not establish a restrictive `umask` or explicitly set the generated file to mode `0600`. Its effective accessibility therefore depends on the user's existing environment. The same workspace is within the broad read scope assigned to the note agent elsewhere in the project. In addition, user-controlled values such as `APP_ID`, `APP_SECRET`, `ROBOT_NAME`, and `MODEL_NAME` are interpolated directly into JSON without escaping. Quotes, backslashes, or crafted JSON fragments can corrupt the output or inject additional configuration properties. ### Attack Path 1. The user runs `scripts/configure-bot.sh`. 2. The App Secret is visibly entered ...[truncated 1249 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: agents/note-shrimp.json:40
Finding: Note Agent Receives Excessive Recursive Access to User Files and Credential-Bearing Workspace Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/auto-publish.sh:97
Finding: Publishing Scripts Enable Persistent Global Plaintext Git Credential Storage
Content: View full analysis
&1; then ``` The second publishing script makes the same global change: ```bash git config --global credential.helper store echo "推送到 GitHub..." if GIT_USERNAME=$GITHUB_USER GIT_PASSWORD=$GITHUB_TOKEN git push -f -u origin main 2>&1; then ``` The failure guidance also suggests placing the token in a remote URL: ```bash echo " git remote set-url origin https://$GITHUB_USER:$GITHUB_TOKEN@github.com/$GITHUB_USER/$GITHUB_REPO.git" ``` The usage guide recommends persistent shell-profile storage: ```bash echo 'export GITHUB_TOKEN=ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx' >> ~/.zshrc source ~/.zshrc echo $GITHUB_TOKEN ``` ### Technical Analysis `git config --global credential.helper store` changes the user's Git behavior globally, including for repositories unrelated to this Skill. Git's `store` credential helper persists credentials unencrypted in the user's home directory when Git supplies credentials to the helper. The scripts also encourage persistent token storage in a shell profile and suggest embedding the token in a Git remote URL. These practices can disclose the token through home-directory access, backups, shell initialization files, repository configuration, logs, copied diagnostics, terminal output, or process inspection. The global setting survives the script run and is unnecessary for a content-generation Skill. ### Attack Path 1. A user exports a Gi ...[truncated 1059 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/auto-create-and-push.sh:28
Finding: Publishing Scripts Can Upload Unintended Files, Replace Repository Remotes, and Force-Overwrite History
Content: View full analysis
&1; then ``` ### Technical Analysis Both scripts use repository-wide staging without an explicit file allowlist. This can publish generated files, credentials, local notes, or unrelated artifacts that happen to be present in the repository. `auto-create-and-push.sh` calculates the directory containing the script—which is the `scripts` directory—but never executes `cd "$SKILL_DIR"`. Its Git commands therefore operate in the caller's current working directory. If that directory is another repository, the script can stage and commit that repository's files. Both scri ...[truncated 1296 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: _meta_v3.json:100
Finding: Metadata and Executable Installation Paths Identify Different Source Repositories
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (58)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The | bash construct creates immediate command chaining from untrusted network content into a shell, eliminating any review boundary. In the context of an installation README for a skill that targets broad user adoption, this greatly amplifies the blast radius of a repository or delivery-channel compromise and can result in full host compromise.
Content: Scanner excerpt · README.md (reported line 62)May include surrounding context.
macOS / Linux:

bash
curl -fsSL https://raw.githubusercontent.com/jiebao360/content-creation-multi-agent/main/install.sh | bash

Windows:

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/AUTO_PUBLISH_USAGE.md (reported line 21)May include surrounding context.
md
## 🔑 配置步骤 ### 步骤 1：创建 Personal Access Token 1. **访问**：https://github.com/settings/tokens 2. **点击**："Generate new token (classic)"

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The command git config --global credential.helper store enables persistent plaintext-like credential storage for all Git usage on the host, without warning the user. In a script that handles GITHUB_TOKEN, this increases the risk of long-term credential exposure to other local users, malware, backups, or later accidental disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script reads the App Secret from the terminal and then persists it in plaintext into the generated JSON configuration and embedded per-agent feishu blocks. Anyone with access to the user's filesystem, backups, sync targets, or logs can recover the credential and impersonate the bot or access associated services.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: At L228-L245 the script announces it is generating a local document, then writes the Feishu App ID into the Markdown file and, earlier, stores both App ID and App Secret in the JSON config. While the Markdown excerpt shown only includes App ID, the surrounding configuration workflow is handling secrets and persisting them to disk; the 'local document' framing understates that the script is creating credential-bearing artifacts rather than harmless documentation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: All user-facing instructions, examples, and invocation guidance in this file are presented only in Chinese. Under the stated policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The guide explicitly instructs the agent to read a local file from the user's home directory (e.g. ~/Documents/产品资料.md) without any notice about sensitivity, consent, or scope limits. In an agentic environment, this can normalize access to local data and lead users to expose proprietary or personal files unintentionally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README tells users to execute a remote script directly from the network with curl ... | bash and provides no integrity, review, or trust warning. This creates a direct code-execution path where a compromised GitHub account, repository, branch, CDN response, or MITM on a misconfigured system could lead to arbitrary command execution on the user's machine.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README says configuration files and local documents are generated but does not warn that they may contain sensitive bot configuration data. This is dangerous because users may leave secrets in world-readable files, synced folders, backups, or source-control repositories without realizing the outputs include credentials or other sensitive operational details.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The README explicitly instructs users to provide App Secret in natural-language chat with the bot. That creates a high-risk secret collection channel because chat platforms, agent logs, observability systems, transcripts, and downstream tools may retain or expose the credential beyond the user's intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README instructs users to enter App ID and App Secret without any warning about secret handling, storage, logging, or least-privilege practices. In a bot/agent ecosystem, users may assume the values are handled safely, increasing the risk of accidental disclosure to chat logs, shell history, screenshots, or shared environments.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The sample configuration file includes app_secret in plaintext, normalizing insecure secret storage and encouraging implementers to persist credentials in output artifacts. In the context of this skill, generated config files are a core product of the setup flow, so demonstrating plaintext secrets materially increases the chance of real-world credential leakage through disk, backups, sharing, or repository commits.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill promotes local file reading and broad web search capabilities but omits any privacy notice about accessing user files or sending user-derived queries to external services. In a multi-agent content workflow, this can expose sensitive local data or confidential prompts to third parties if users do not understand what content is being collected and transmitted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly advertises automatic installation behaviors such as configuring permissions and restarting the gateway, but provides no warning, consent checkpoint, or explanation of scope. In an agent skill context, system-modifying actions can affect host integrity and availability, and normalizing unattended permission changes increases the chance of unsafe execution of bundled scripts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The instructions direct the user to execute a shell script and restart the gateway immediately, without advising script review or warning that these steps change the local environment. This is dangerous because install scripts are a common delivery mechanism for persistence, privilege abuse, or unsafe configuration changes, especially when paired with service restarts that activate new behavior.
Content: No source excerpt is available for this finding.

File System Enumeration

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Content: Scanner excerpt · README.md (reported line 123)May include surrounding context.

验证安装

bash
ls -la ~/.openclaw/workspace/skills/content-creation-multi-agent/

重启 Gateway

File System Enumeration

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Content: Scanner excerpt · README.md (reported line 126)May include surrounding context.

验证安装

bash
ls -la ~/.openclaw/workspace/skills/content-creation-multi-agent/

重启 Gateway

File System Enumeration

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

验证安装

bash
ls -la ~/.openclaw/workspace/skills/content-creation-multi-agent/

重启 Gateway

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description is entirely in Chinese and presents the skill as a Chinese-language content generation system, with no indication that users can choose another language or opt in to this locale constraint. This creates a natural-language policy concern because the skill appears to enforce a specific language without documented choice or region-specific justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest enables automatic installation from a remote GitHub source and lists privileged post-install behaviors such as downloading files, setting permissions, restarting the gateway, and generating configs/docs, but it does not define explicit user confirmation, trust boundaries, scope restrictions, or rollback controls. In an agent-skill ecosystem, this creates a meaningful supply-chain and local-environment risk because installation can modify the workspace and service state with broad side effects if the repository or install script is changed or abused.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The keyword field is very broad and includes common terms such as articles, reports, copywriting, email, and creation. In a skill-routing system, such generic triggers can cause this agent to match a large share of ordinary requests, leading to over-invocation, unintended routing, or priority conflicts with other skills rather than a direct code-execution issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly describes searching reference images and generating images through external services, yet it provides no disclosure that user prompts, product details, or other request content may be transmitted to third-party image-search or Doubao systems. This creates a real privacy and data-handling risk because users may supply sensitive commercial or personal information without informed consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The keyword list is broad enough to match generic image-related requests, which can cause this skill to be selected outside its intended scope. Because the skill can search web, local-files, and a material library and then supply outputs to other agents, over-triggering increases the chance of unnecessary data exposure, inappropriate tool use, or unreviewed downstream content generation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill encourages automatically opening the user's browser and visiting external sites but does not warn about privacy, tracking, or local system impact. This can cause unintended disclosure of search interests, trigger navigation to untrusted content, and perform user-visible actions without informed consent, which is especially risky in an agent context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest uses very broad, everyday knowledge-management keywords such as notes, organization, knowledge base, and materials, which can cause the skill to activate for routine user requests unrelated to sensitive data handling. Because the same skill also has browser-search and local file-reading capabilities, overbroad routing increases the chance that benign requests are handled by a more privileged agent than necessary.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.