OpenClaw 成功流程沉淀发布器 / OpenClaw Success Skill Publisher

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:11 PM UTC
• Version: 1.0.3

Overview

The skill is mostly coherent, but its publishing flow can send tokens and generated skill bundles to configurable endpoints and can turn untrusted input text into operative skill instructions without strong safeguards.

Install only if you are comfortable reviewing every generated artifact before publishing. Use dry-run first, inspect generated_skill/SKILL.md and share_payloads for sensitive data or injected instructions, and only use narrowly scoped tokens with a trusted HTTPS ClawHub endpoint. Avoid automatic publish/share until destination validation and a mandatory human approval step are added.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/pipeline.py:215

Finding

Untrusted success-record content is embedded into executable Skill instructions

Content

View full analysis

tuple[str, str]: title = data["title"] goal = data["user_goal"] slug = _safe_slug(title) skill_md = f"""--- name: {slug} description: Reproduce the validated implementation path for: {title}. Use when users want to achieve similar outcomes quickly with proven execution order, validation checkpoints, and rollout guardrails. --- # {title} Turn a similar request into a repeatable implementation workflow. ## Goal - {goal} ## Preconditions - Confirm acceptance criteria and constraints. - Confirm required environment and secrets before execution. ## Execution Path """ for i, step in enumerate(data["steps"], start=1): skill_md += ( f"\n{i}. {step.get('action', 'unknown action')}" f"\n - Success signal: {bool(step.get('success_signal'))}" f"\n - Expected result: {step.get('result', 'N/A')}\n" ) skill_md += """ ## Guardrails - Pause before high-impact external operations. - Keep an audit trail for every execution decision. - Prefer reversible changes and explicit approval gates. ## Deliverables - Implementation patch - Validation report - Operational runbook """ openai_yaml = f"""display_name: {title} short_description: Reuse a proven path to deliver the same outcome with less trial-and-error. default_prompt: Apply this proven workflow to my request, adapt for my constraints, and preserve the same quality gates. """ return skill_md, openai_yaml ``` The generated content is then persisted as an installable Skill: ```python safe_data = _sanitize_object(data) skill_md, openai_yaml = _generated_skill_content(safe_data) generated_skill_dir = out_dir / "generated_ ...[truncated 2949 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/pipeline.py:322

Finding

ClawHub bearer token and Skill bundle can be sent to an arbitrary or plaintext endpoint

Content

View full analysis

tuple[bool, str]: body = json.dumps(payload).encode("utf-8") headers = {"Content-Type": "application/json"} if token: headers["Authorization"] = f"Bearer {token}" req = request.Request(url=url, data=body, headers=headers, method="POST") try: with request.urlopen(req, timeout=30) as resp: text = resp.read().decode("utf-8", errors="replace") return True, f"HTTP {resp.status}: {text[:500]}" except error.HTTPError as exc: detail = exc.read().decode("utf-8", errors="replace") return False, f"HTTP {exc.code}: {detail[:500]}" except Exception as exc: # pylint: disable=broad-except return False, str(exc) def _publish_clawhub( generated_skill_zip: Path, title: str, bilingual_metadata: dict[str, str], dry_run: bool, ) -> PublishResult: base = os.getenv("CLAWHUB_API_BASE", "").rstrip("/") token = os.getenv("CLAWHUB_API_TOKEN", "").strip() if not dry_run: base = _require_env("CLAWHUB_API_BASE", "ClawHub publish").rstrip("/") token = _require_env("CLAWHUB_API_TOKEN", "ClawHub publish") elif not base: return PublishResult("clawhub", "skipped", "CLAWHUB_API_BASE not set (dry-run)") payload = { "name": _safe_slug(title), "title": title, "bundle_path": str(generated_skill_zip), "bundle_b64": base64.b64encode(generated_skill_zip.read_bytes()).decode("ascii"), "i18n": bilingual_metadata, } if dry_run: return PublishResult("clawhub", "dry-run", f"Prepared publish payload for {base}/v1/skills") ok, detail = _post_json(f"{base}/v1/skills", token, payload) return PublishResult("clawhub", "success ...[truncated 2698 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a workflow-productization and multi-platform publishing skill. The supplied code does not implement those functions. It only packages a predefined subset of repository files into a ZIP archive under a dist directory. While bundling could be a supporting step for distribution, this chunk by itself lacks the primary declared behaviors and external publishing/distribution capabilities, so the description materially overstates what the code actually does.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/pipeline.py (reported line 91)May include surrounding context.

python

def _collect_active_secret_values() -> list[str]:
    values: list[str] = []
    for key, raw in os.environ.items():
        if not raw:
            continue
        key_lower = key.lower()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares access to environment variables and describes file generation plus external publishing, but it does not define an explicit tool scope such as permissions or allowed-tools. That creates an overbroad execution surface where an agent may use network, file, or env capabilities beyond what reviewers and users can easily verify, increasing the risk of secret exposure or unintended external actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill’s name, short description, and default prompt define a broad automation flow that converts prior interactions into reusable skills and publishes/shares them automatically, but they do not specify narrow activation conditions, approval gates, or limits on where publication is allowed. In an agent setting, this can cause the skill to trigger for loosely related requests and perform unintended external publication or distribution of user-derived content without sufficient confirmation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The default behavior instructs the agent to distribute bilingual posts to configured channels automatically, which bakes in outbound sharing without requiring explicit user opt-in for language choice, channels, or content review. Because this skill productizes prior interactions, the risk is heightened: successful workflows may contain sensitive operational details, proprietary prompts, or user data that could be repackaged and posted externally.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The invocation guidance is broad enough that the skill may be triggered for loosely related requests about documenting or sharing a workflow, even when the user did not explicitly ask to publish or distribute it. Because this skill can generate publish payloads and cross-platform distribution content, unintended activation could cause premature packaging or disclosure of internal workflow details.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill generates mandatory Chinese-language payloads for Zhihu and Xiaohongshu and a bilingual payload for Moltbook without any user opt-in or language selection mechanism. Because this file is code, these natural-language string literals count for policy review, and the behavior appears to force a locale choice rather than offering one.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The rule 'Generate both Chinese and English sharing copy' imposes a language behavior by default. This can violate language/locale policy expectations when the user has not requested bilingual output or been given a language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description frames bilingual output as the default behavior rather than an optional mode, which can override user preferences or lead to unnecessary disclosure in multiple languages. In a publishing-oriented skill, forced bilingual generation also increases the chance that sensitive or internal material is prepared for wider distribution than intended.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This JSON manifest-like file includes a natural-language locale setting of "zh-CN". The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and there is no indication elsewhere in the file that the user can choose another language.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.