ClawHub
Back to skill

Security audit

MENA Property Listing Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but its code can send a MiniMax API key and listing data to LLM providers that are not disclosed in the skill description.

Review this skill before installing. It stores listing and agent data locally and uses an LLM for generation; only install it if you are comfortable sending property details and agent names to a remote service. Keep LLM_BASE_URL unset unless you understand the routing behavior, and use a restricted MiniMax API key because the current code can send that key to undeclared LLM hosts if the environment is configured that way.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/property_listing.py:214
Finding

MiniMax API Credential and Listing Data Can Be Routed to Undeclared Third-Party Providers

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (13)

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The skill explicitly persists sensitive business data locally and sends property specs plus agent contact details to an external LLM API. This creates session persistence and third-party exposure risks, especially because the stored data includes phone numbers, profiles, listings, and monthly counters that may outlive the user session.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
name: mena-property-listing-generator
version: 1.0.1
author: "NASSER AL-SOLAITTI"
description: "AI-powered bilingual property listing generator for MENA real estate agents. Input: basic property specs. Output: SEO-optimized Arabic + English listing text, Instagram caption, TikTok script, Facebook post, and WhatsApp follow-up scripts. Use when user says 'create property listing', 'real estate listing', 'listing in Arabic', 'PropertyFinder listing', or wants to reduce manual copywriting time.
permissions:
  - network: send listing text and agent details to minimax LLM API (api.minimax.chat) only
  - filesystem-write: write generated listings to ~/.openclaw/mena-property-listing-generator/

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The activation guidance is overly broad because it includes a generic trigger like wanting to 'reduce manual copywriting time,' which could cause the skill to activate in contexts beyond real-estate listing generation. Over-broad invocation increases the chance of unintended data handling and external transmission to the configured LLM API when the user did not specifically request this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description repeatedly presents bilingual Arabic + English generation as the default behavior, including the tagline and core output list. This can violate language/locale policy when a skill forces specific languages without stating that the user can choose or opt in to that locale behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/property_listing.py (reported line 224)May include surrounding context.

python
# Hardcoded defaults per provider (credential is keyed to provider)
LLM_DEFAULTS = {
    "MINIMAX_API_KEY": "https://api.minimax.chat/v1",
    "OPENAI_API_KEY": "https://api.openai.com/v1",
    "LLM_API_KEY": "https://api.minimax.chat/v1",
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/property_listing.py (reported line 226)May include surrounding context.

python
# Hardcoded defaults per provider (credential is keyed to provider)
LLM_DEFAULTS = {
    "MINIMAX_API_KEY": "https://api.minimax.chat/v1",
    "OPENAI_API_KEY": "https://api.openai.com/v1",
    "LLM_API_KEY": "https://api.minimax.chat/v1",
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/property_listing.py (reported line 245)May include surrounding context.

python
# Hardcoded defaults per provider (credential is keyed to provider)
LLM_DEFAULTS = {
    "MINIMAX_API_KEY": "https://api.minimax.chat/v1",
    "OPENAI_API_KEY": "https://api.openai.com/v1",
    "LLM_API_KEY": "https://api.minimax.chat/v1",
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/property_listing.py (reported line 225)May include surrounding context.

python
# Hardcoded defaults per provider (credential is keyed to provider)
LLM_DEFAULTS = {
    "MINIMAX_API_KEY": "https://api.minimax.chat/v1",
    "OPENAI_API_KEY": "https://api.openai.com/v1",
    "LLM_API_KEY": "https://api.minimax.chat/v1",
}

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script sends listing contents and agent information to an external LLM service when a MINIMAX_API_KEY is present, but this network transmission is not clearly disclosed at the point of use or gated by explicit opt-in. Because agent names, phone numbers, and property details are included in the prompt, users may unknowingly exfiltrate business or personal data to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The LLM request includes property and agent data and transmits it to a remote API without explicit runtime disclosure or consent beyond the presence of an environment variable. In a CLI skill context, hidden third-party transmission is more concerning because users may assume formatting is local-only based on the tool's primary purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill automatically generates bilingual English/Arabic output and injects Arabic translations into listing data without exposing any language selection or opt-in mechanism. Under the policy, forcing a specific language or locale without user choice is a natural-language policy violation unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The skill description mandates bilingual Arabic and English output by default without indicating that the user can choose a single language. This can lead to unnecessary disclosure of user-provided property and agent details in additional generated outputs and may produce content the user did not request.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/property_listing.py (reported line 50)May include surrounding context.

python
level = logging.INFO
    env_level = os.environ.get("CLAWHUB_LOG_LEVEL", "").upper()
    if env_level in ("DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"):
        level = getattr(logging, env_level)
    logging.basicConfig(
        level=level,
        format="%(asctime)s [%(levelname)s] %(name)s: %(message)s",

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The inline comment at L231-L232 says the function is scoped to MINIMAX only and will not accept OPENAI_API_KEY or LLM_API_KEY. But nearby documentation/configuration at L222-L227 still describes hardcoded defaults for OPENAI_API_KEY and LLM_API_KEY as provider mappings, which contradicts the stated intent and can mislead maintainers about actual supported credential scope.

Content

No source excerpt is available for this finding.