Sales Oratory Master
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: sales-oratory-master Version: 1.0.0 The skill is vulnerable to prompt injection. In `main.py`, user-provided inputs (`customer_quote`, `deal_stage`, `client_persona`) are directly embedded into the `prompt_template.md` using string formatting, which then forms part of the `system_message` sent to the LLM. A malicious user could craft these inputs to manipulate the LLM's behavior, potentially overriding the `PROMISE_GUARD.md` instructions or causing the LLM to generate unintended or harmful content. This is a significant vulnerability, but there is no evidence of intentional malicious code (e.g., data exfiltration, backdoors) within the skill itself.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A malicious or unusual customer quote could influence the advice or bypass the intended sales-compliance style constraints.
The customer quote and other runtime inputs are inserted directly into the prompt used for model generation. Because customer text can be untrusted, it could steer the generated wording or weaken the intended compliance guidance, although no tools or high-impact actions are exposed.
system_prompt = prompt_template.format(
customer_quote=customer_quote,
deal_stage=deal_stage,
client_persona=client_persona,
)Treat customer quotes as untrusted input, review the generated output before using it, and consider delimiting or labeling quoted customer text clearly in future versions.
Users may over-trust generated sales language as compliant when it still needs human review for accuracy, authorization, discount limits, and legal commitments.
The skill gives strong compliance-assurance instructions to the model. This is purpose-aligned, but it is still prompt-level guidance and should not be treated as a guaranteed legal or commercial compliance review.
重新润色，确保在保持商务竞争力的同时，100% 符合合规要求。
Use the skill as a drafting aid, not as final approval; have a qualified human review any customer-facing commitments, pricing, legal, or security claims.