Skillcraft

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:14 AM UTC
• Version: 1.0.0

Overview

This is a coherent OpenClaw skill-building guide, but it needs Review because it gives under-scoped guidance for storing tokens and sensitive automation state.

Review this before installing if you expect it to generate API or CLI wrapper skills. Do not follow the token-storage pattern as written; require generated skills to keep secrets in environment variables, a keychain, or a secret manager, and keep runtime state out of publishable skill directories unless it is non-sensitive and explicitly excluded from packaging.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: patterns/cli-wrapper.md:25

Finding

Plaintext Secrets and Sensitive API Data May Be Stored in Publishable Skill State

Content

View full analysis

Vulnerability Details

File Location: patterns/cli-wrapper.md:25-28 (also supported by patterns/api-wrapper.md:14-18 and SKILL.md:77-79)
Vulnerability Type: Plaintext credential and sensitive-data storage
Risk Level: Medium

Vulnerable Code Snippets

patterns/cli-wrapper.md:25-28:

markdown

## State

CLI wrappers are usually stateless. Exceptions:
- **Auth tokens** that expire → `{baseDir}/state.json`

patterns/api-wrapper.md:14-18:

markdown

### State & Caching
Store in `{baseDir}/state.json`:
- Incremental polling (last-seen ID/timestamp)
- Response cache with expiry
- Rate limit tracking

SKILL.md:77-79:

markdown

**State locations:**
- `<workspace>/memory/` — user-facing context
- `{baseDir}/state.json` — skill-internal state (travels with skill)

Technical Analysis

The Skill instructs generated CLI wrappers to store expiring authentication tokens in {baseDir}/state.json. It also recommends storing API response caches in the same location and explicitly states that this state travels with the Skill.

This creates a plaintext-secret exposure risk because the Skill directory may be copied, archived, committed to version control, or published to ClawHub. An authentication token or sensitive API response stored there could consequently be distributed with the package. This guidance also conflicts with patterns/api-wrapper.md:23-24, which more safely states that secrets should use environment variables and never be hardcoded.

The pre-scan's network-related pattern is otherwise consistent with legitimate API-wrapper functionality: the project recommends authenticated API requests but contains no fixed exfiltration endpoint, hardcoded credential, or executable network payload. The confirmed issue is the unsafe handling of credentials and response data after such requests.

Attack Path

1. A user follows this Skill to generate an authenticated CLI or API wrapper.
2. The generated wrapper writes an acc ...[truncated 1114 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the recommendation to store authentication tokens in {baseDir}/state.json.
2. Store secrets only in environment variables, an operating-system keychain, or a dedicated secret manager such as 1Password.
3. Keep non-secret runtime state in a non-publishable workspace or platform-specific application-data directory rather than inside the Skill package.
4. Cache only explicitly non-sensitive response fields. Encrypt sensitive caches when storage is unavoidable and define short retention periods.
5. Apply restrictive filesystem permissions to runtime state and secret material.
6. Add state.json and other runtime-state files to package, publication, and version-control exclusion rules.
7. Add a pre-publication check that rejects packages containing tokens, credentials, or populated runtime caches.
8. Document token revocation and rotation procedures for accidental disclosure.
9. Revise the state guidance to distinguish clearly among secrets, non-secret synchronization metadata, and potentially sensitive API response content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description says to use the skill when asked to "make/build/craft a skill," which includes very generic verbs that can overlap with ordinary conversation. Because this frontmatter drives discoverability and loading, the broad phrasing could cause unintended invocation outside a clearly bounded OpenClaw-skill-authoring context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The pattern explicitly recommends storing auth tokens in {baseDir}/state.json but does not include any guidance on secret handling, access restrictions, encryption, redaction, or avoiding persistence where possible. In a skill-building context, this can propagate insecure credential storage into generated skills, increasing the chance that tokens are written to disk in plaintext and later exposed through logs, backups, shared workspaces, or accidental publication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The example uses location_get, polling via cron, and memory history to track location over time and trigger actions like email summaries or automations. Because this involves ongoing collection and use of location data, the markdown should disclose the privacy implications and monitoring behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The example describes finding prior discussions across channels and continuing from a Telegram chat in another context, which implies transmitting or reusing user conversation data between channels or sessions. The markdown does not warn users about this cross-channel data handling or its privacy implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file describes a workflow that runs local commands via exec and accesses authenticated dashboards via browser, which can affect system integrity and expose sensitive session data. The example presents these operations as a simple pattern but gives no warning, caveat, or disclosure about their impact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.