ClawHub
Back to skill

Security audit

skill-README-writer

Security checks for vulnerabilities and agentic risk

Overview

This README generator is mostly disclosed, but it needs review because it can insert generic third-party badges, external links, and unverified platform claims into project documentation.

Install only if you are comfortable reviewing the generated README before publishing. Pay particular attention to badges, external links, platform support claims, default MIT/version values, and overwrite choices for existing README files.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:278
Finding

Mandatory Injection of Unrelated Promotional Links into Generated Documentation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 5)May include surrounding context.

md
📝 为本地项目或 GitHub 项目生成专业的 README.md 文档。采用 11 步交互式工作流程，自动收集项目信息、智能生成 Badge、中英双语完整翻译。

<!-- Badge Row 1: Core Info -->
[![ClawHub](https://img.shields.io/badge/ClawHub-README--writer-E75C46?logo=clawhub)](https://clawhub.ai/JustZeroX/README-writer)
[![GitHub](https://img.shields.io/badge/GitHub-JustZeroX-181717?logo=github)](https://github.com/JustZeroX/skill-README-Writer)
[![Version](https://img.shields.io/badge/version-0.0.1-orange)](https://github.com/author/skill-README-writer)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · README.md (reported line 12)May include surrounding context.

md
Hub-JustZeroX-181717?logo=github)](https://github.com/JustZeroX/skill-README-Writer)
[![Version](https://img.shields.io/badge/version-0.0.1-orange)](https://github.com/author/skill-README-writer)

<!-- Badge Row 2: Platforms -->
[![macOS](https://img.shields.io/badge/macOS-000000?logo=apple&logoColor=white)]() 
[![Windows](https://img.shields.io/badge/Windows-0078D6?logo=data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHZpZXdCb3g9IjAgMCA4OCA4OCI+PHBhdGggZmlsbD0iI2ZmZiIgZD0iTTAgMGgzOXYzOUgweiIvPjxwYXRoIGZpbGw9IiNmZmYiIGQ9Ik00OSAwaDM5djM5SDQ5eiIvPjxwYXRoIGZpbGw9IiNmZmYiIGQ9Ik0wIDQ5aDM5djM5SDB6Ii8+PHBhdGggZmlsbD0iI2ZmZiIgZD0iTTQ5IDQ5aDM5djM5SDQ5eiIvPjwvc3ZnPg==)]() 
[![Linux](https://img.shields.io/badge/Linux-FCC624?logo=linux&logoColor=black)]()

<!-- Badge Row 3: License -->
[![License](https://img.shields.io/badge/License-MIT-BD2D2D)](LICENSE)


---

### 中文 | [English](#english-version)

---

## 目录

- [✨ 核心功能](#-核心功能)
- [🎯 触

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: README-writer
description: 为本地项目或 GitHub 项目生成专业的 README.md 文档。**触发词："写 README"、"生成 README"、"README.md"、"项目文档"、"GitHub 文档"、"readme"、"项目介绍"、"文档生成"**。支持自动收集项目信息、交互式确认、中英双语。根据项目类型（Python/前端/Skill/CLI 等）生成对应的专业文档。
---

# README Writer - 项目文档生成器

📝 **为本地项目或 GitHub 项目生成专业的 README.md 文档**

采用交互式工作流程：自动收集信息 → 用户确认 → 生成目录 → 用户确认 → 生�

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

md
- **条件**：检测到是 OpenClaw Skill（有 `SKILL.md`）

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description states the skill generates a complete Chinese-English bilingual README as a built-in behavior. This imposes a language output policy by default rather than offering language selection, which can violate locale/language choice expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

These checklist items require the English version to fully translate all sections and match the Chinese content, making English output mandatory. The README does not present this as an optional mode or user-selected preference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The English feature list says the skill provides a Chinese plus English version that is complete and consistent, again describing bilingual output as a default requirement. This is a natural-language locale policy issue because it does not let users opt into their preferred language.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 295)May include surrounding context.

md
| Scenario | Example |
|----------|---------|
| **Local Project** | "Write README for this project: ~/.openclaw/skills/my-project" |
| **GitHub Project** | "Write README for https://github.com/user/repo" |
| **Skill Project** | "Write README for easy-image-generate" |
| **Optimize Existing** | "Optimize this project's README" |

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list includes broad everyday phrases such as '项目介绍' and '文档生成', which can cause the skill to activate outside the user's actual intent. In an agent environment, accidental invocation can lead to unintended filesystem or repository inspection and possible overwriting of README files if the workflow proceeds automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill describes overwrite and backup behavior for existing README files but does not present a prominent explicit warning about destructive modification risk before replacement. In practice, users may unintentionally lose curated documentation or sensitive manual edits if the agent defaults to rewrite behavior or if confirmation is ambiguous.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

L462 明确写明“默认中文 + English version”，并在多处要求英文部分必须完整翻译，体现出默认强制输出双语内容而非基于用户明确选择。虽然配置区提供了语言参数选项，但该默认策略仍可能在未获用户同意时施加特定语言/locale 要求。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

L273-L275 与 L357-L365 明确要求“平台 Badge 全部生成（macOS/Windows/Linux/Android/iOS/Web）”，且示例展示了 5 行 Badge 布局；但 L513-L517 的检查项又写成“使用 3 行布局”并把平台要求弱化为“默认 macOS+Windows+Linux 或用户指定”。这不是简单遗漏，而是文档内部对技能应生成内容的主动矛盾，可能导致代理按不同规则生成不同 README。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The manifest description is written only in Chinese, which indicates a language-specific presentation by default. Because the policy requires avoiding forced language or locale constraints without user opt-in, this is a mild natural-language policy concern unless the skill clearly documents language selection elsewhere.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.