ai-content-creator-assistant

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:40 AM UTC
• Version: 1.0.0

Overview

This skill matches its content-creation purpose, but its local payment verification and order-file handling are under-secured enough to merit review before installation.

Review this skill carefully before installing. It does not show exfiltration, destructive behavior, auto-posting, or hidden credential theft, but it persists the user's prompt in local order files and its payment verification is weak enough that the advertised clawtip authorization boundary should not be treated as robust. Run the npx sandbox command only in a constrained environment and inspect the promoted pro package separately before installing it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/service.py:108

Finding

Persistent Promotional Output and Third-Party Installation Directive

Content

View full analysis

💡 **高频用户推荐：** 另有 **ai-content-creator-pro** 买断版（¥9.90），\ > 一次付费永久使用，不限次数。\ > 安装：`openclaw skills install @jinyu12166/ai-content-creator-pro` ``` ### Technical Analysis The successful service path unconditionally inserts a promotional block instructing the user to install another Skill. This behavior is unrelated to payment verification or content generation and is not conditional on an explicit request for recommendations. Because Skill output may be consumed by either a user or another Agent, installation instructions embedded in routine output can influence downstream actions. The target package is outside the audited project, so its behavior and security properties cannot be inferred from this repository. ### Attack Path 1. A valid or locally accepted order is supplied to `scripts/service.py`. 2. The payment checks pass. 3. The script unconditionally prints the promotional installation directive. 4. A user or automation follows the directive and installs `@jinyu12166/ai-content-creator-pro`. 5. The newly installed Skill executes with whatever permissions its own manifest requests. ### Impact Assessment The immediate impact is manipulation of expected service output and unsolicited redirection to another package. If the directive is followed, the resulting privilege and data exposure depend on the permissions and behavior of the external Skill, which were not available in this audit. No evidenc ...[truncated 92 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/service.py:50

Finding

Locally Forgeable Payment Credential Allows Authorization Bypass

Content

View full analysis

bool: credential = order_data.get("payCredential") if not credential: return False credential_ts = order_data.get("credentialTimestamp") if credential_ts and time.time() - credential_ts > CREDENTIAL_TTL: return False return True ``` ```python if not is_credential_valid(order_data): print("PAY_STATUS: ERROR") print("ERROR_INFO: No valid payment credential found. Complete payment via clawtip first.") sys.exit(1) pay_status = order_data.get("payStatus", "SUCCESS") print(f"PAY_STATUS: {pay_status}") if pay_status != "SUCCESS": print(f"ERROR_INFO: Payment status is '{pay_status}', cannot proceed") sys.exit(1) ``` ### Technical Analysis The application treats any nonempty `payCredential` value as valid. It does not verify a digital signature, message authentication code, credential issuer, recipient, amount, order number, or association between the credential and the current order. Expiration enforcement is also fail-open: `credentialTimestamp` is optional, so omitting it bypasses the 24-hour TTL. Likewise, `payStatus` defaults to `SUCCESS` when the field is absent. Order files are stored under the current user's home directory and are therefore normally editable by that user. Consequently, the payment decision relies entirely on attacker-controlled local JSON fields rather than authenticated payment evidence. ### Attack Path 1. Run `scripts/create_order.py` to create a legitimate local order file. 2. Open the generated JSON file under `~/.openclaw/skills/orders/{indicator}/{order_no}.json`. 3. Add an arbitrary nonempty value such as: ```json { "payCredential": "forged" } ``` 4. Omit `cr ...[truncated 702 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:105

Finding

Unattended Download and Execution of an npm Package Without Integrity Verification

Content

View full analysis

-i -v 1.0.12 ``` ### Technical Analysis The documented sandbox workflow uses `npx --yes`, which can download and execute package code from the npm registry without an interactive installation confirmation. The package version is pinned, reducing accidental version drift, but no package integrity hash, vendored artifact, signature, or other independent verification mechanism is provided. Execution through `npx` may run the package CLI and applicable npm lifecycle behavior with the privileges of the invoking user. If the registry account, distribution infrastructure, or pinned package artifact is compromised, the command could execute altered code even though this repository itself has not changed. This is a supply-chain exposure rather than evidence that the named package is currently malicious. ### Attack Path 1. A user follows the sandbox payment instructions in `SKILL.md`. 2. `npx --yes` resolves and downloads `@clawtip/clawtip-sandbox-cli@1.0.0` from the configured npm registry or cache. 3. npm executes the downloaded package without requiring interactive approval. 4. If that package artifact or its dependency chain has been compromised, attacker-controlled code executes under the invoking user's account. 5. Such code could access files, environment variables, and network resources available to that account. ### Impact Assessment A compromised dependency could execute arbitrary code with the current user's privileges. Its practical scope would include data and resources accessible to that user, potentially including OpenClaw configuration, local order files, environment variables, and user-writable files. The audit found no evidence that the package is currently compromised; the risk ari ...[truncated 64 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction '请使用中文与用户交互。' requires a specific language for all user interactions. Under the policy, forcing a language or locale without user opt-in or a clearly justified region-specific constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The file header and runtime notice claim only payment metadata is stored, but the implementation saves the full user-provided question into the order JSON. If users include sensitive business plans, drafts, personal data, or account details in the prompt, that data is silently persisted on disk under the user's home directory, creating an unnecessary confidentiality risk and a misleading data-handling boundary.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The comments state the payment credential payload is encrypted for processing, but the code falls back to storing the plaintext JSON payload when the key is missing or encryption fails. This means sensitive payment metadata can be written unencrypted while only emitting a warning, undermining the documented security expectation and exposing local data to other processes or users with file access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/create_order.py (reported line 177)May include surrounding context.

python

if __name__ == "__main__":
    parser = argparse.ArgumentParser(
        description="Create order for ai-content-creator-assistant"
    )
    parser.add_argument("question", help="User question / consultation content")
    args = parser.parse_args()

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The script presents fixed output requirements tailored to specific Chinese platforms and content norms, such as Xiaohongshu, Douyin/Kuaishou, and WeChat/Zhihu, without indicating that the user can choose language or locale. This is a natural-language locale policy concern because the behavior appears prescribed rather than optional or region-justified.

Content

No source excerpt is available for this finding.