T09 · Insecure Skill Coding Practices
Error
- Location
references/phase1-diagnosis-full.md:47- Finding
Command Injection Through User-Controlled Brand Names and Workspace Paths
- Content
View full analysis
- Remediation
View remediation
Security audit
Moments GEO skills
Security checks for vulnerabilities and agentic risk
Overview
The skill is a mostly coherent AI visibility marketing workflow, but it gives agents broad browser/network/file authority and includes unsafe shell and URL-fetch patterns that users should review before installing.
Install only if you want a tool-heavy marketing workflow that can browse AI platforms, fetch websites, and write local client reports. Run it in a bounded workspace, restrict audits to authorized public HTTPS sites, avoid feeding untrusted brand names or paths into shell commands, and be careful with logged-in AI/browser sessions and sensitive client data.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
references/phase1-diagnosis-full.md:82- Finding
Server-Side Request Forgery Through Unvalidated Client Website URLs
- Content
View full analysis
.*' # Inspect Open Graph metadata curl -s https://example.com | grep 'og:' # Inspect H1 elements curl -s https://example.com | grep -i '- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (57)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md 5. `browser snapshot` → capture AI response 6. `browser screenshot` → save to `{客户工作目录}/01_diagnosis/screenshots/` When the `browser` tool is available: run real tests (no estimates, no disclaimer needed). When the `browser` tool is unavailable: apply Rule 2 (estimates + disclaimer). - WebFetch / WebSearch: website audits, competitor research
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a broad Generative Engine Optimization skill focused on improving brand visibility across AI search/answer platforms. The supplied code does not implement GEO, AI platform testing, mention monitoring, search visibility analysis, schema/FAQ optimization, or any AI-engine-specific workflows. Instead, it analyzes writing style and brand voice using keyword matching, readability scoring, and sentence structure analysis. That is a materially different primary purpose. While content quality could loosely support marketing workflows, this code’s actual functionality is limited to brand voice consistency analysis and does not substantiate the declared GEO-focused behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description promises a broad GEO/AEO/AIEO agent centered on optimizing and monitoring brand visibility in AI-generated answers across multiple AI platforms. The supplied code does not do that. It only performs conventional on-page SEO analysis on provided text: word count, keyword density, simple structure/readability checks, related-term extraction, meta title/description/url suggestions, and recommendation generation. There is no evidence of AI-platform testing, AI mention monitoring, generative-engine visibility analysis, question library building, schema optimization, or any external service interaction. This is a material primary-purpose mismatch, not merely an incomplete implementation detail.
- Content
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger conditions are extremely broad, causing the skill to activate for many ordinary queries about brands, AI answers, content, or visibility. Over-broad activation can route unrelated conversations into a powerful domain workflow that encourages file reads, external research, and operational actions, increasing the chance of unintended data exposure, incorrect task execution, or prompt-surface expansion through unnecessary skill invocation.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md ## Identity You are GEO-Claw 🔍, an AI visibility optimization specialist. Your skill is loaded at: `~/.openclaw-geo/skills/geo-claw/SKILL.md` ## Work Directory All client deliverables save to: `~/.openclaw-geo/work-geo-claw/`
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file mandates a fixed Chinese disclaimer text and Chinese labeling for every report when real tests are unavailable. This is a natural-language locale constraint with no indication that the user can choose another language or opt in, which violates the language/locale policy criterion.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The entire template and usage instructions are presented only in Chinese, with no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking or China-specific context. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The entire FAQ template, headings, examples, and writing checklist are written only in Chinese, indicating the skill is designed to produce Chinese-language content by default. The file does not offer a language/locale choice or explain that the constraint is region-specific, which matches the policy's language/locale violation criterion.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file is entirely framed as a Chinese-only content template, including headings, checklist items, and example output, but it does not state that Chinese is optional or limited to a China-specific workflow. Under the policy rule for natural-language constraints, forcing a specific language without user opt-in is a reportable locale-policy issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The entire report template is written in Chinese and provides no indication that language selection is optional or configurable. Per the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file title and instructions require an output template in Chinese (e.g. "输出文件模板" and "所有内容输出文件应遵循以下结构"), and the rest of the template/examples are written as if Chinese is mandatory. This is a natural-language locale policy issue because the skill appears to force a specific language without user opt-in or an explicit region-specific justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The template is entirely written in Chinese and strongly steers outputs toward Chinese-language deliverables without any visible mechanism to respect the user's preferred language. In a general-purpose agent skill, this can cause unexpected language switching, reduce usability, and produce outputs that do not match user instructions or organizational requirements.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The template normalizes and promotes alcohol use across common social contexts such as business entertaining, sports viewing, and gatherings, but provides no safety messaging about legal drinking age, impaired driving, health risks, or moderation. In a reusable content-generation skill, this can systematically produce persuasive alcohol recommendations at scale without guardrails, increasing the chance of unsafe or irresponsible outputs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file’s natural-language content is written entirely in Chinese, and several template values are hard-coded for a China locale. Because this is a generic schema template file rather than a clearly documented region-specific tool, it imposes a specific language/locale without offering user choice or stating that the template is limited to Chinese-market use.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The localBusiness schema fixes the address country to "CN", which makes the template implicitly China-specific. Without nearby documentation that this template is only for China-region businesses, this hard-coded locale constraint can violate the requirement not to force a locale without user opt-in or clear justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This JSON eval file contains natural-language requirements that implicitly require responses in Chinese, including Chinese-only prompts and expected outputs mandating use of Chinese brand names and platforms. The file does not offer a language choice or explain a justified locale constraint, which matches the policy category for language/locale restrictions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The prompt and expected output for this eval are written in Chinese and require use of the Chinese brand name throughout, effectively enforcing a Chinese-language response. There is no accompanying note that this is a China-market-specific evaluation or that users may choose another language.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This eval uses a Chinese prompt and expects output tailored to Chinese-language channels and examples, which effectively imposes a locale/language constraint. Because the file does not state that the skill is intentionally China-market-specific or provide user language choice, this is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The markdown repeatedly describes platform strategy in ways that prescribe a preferred language, such as '英文优先' and similar '中文' constraints elsewhere. Because this is natural-language guidance rather than a clearly justified region-specific compliance requirement or an explicit user choice, it can conflict with language/locale choice policies.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The '豆包' platform characteristics specify '中文，口语化' as the language preference, which frames a specific locale and tone as the default operating mode. The file does not offer a language choice or clarify that this is only for a China-specific audience segment, so it risks violating language-choice policy.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The entire skill file is written in Chinese and presents all guidance exclusively in that language, with no indication that users may choose another language or that the content is limited to a China-specific compliance context. The policy explicitly flags language or locale constraints when they are imposed without opt-in or clear justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file title and all guidance are written entirely in Chinese, and the specifications throughout the document implicitly require content production in Chinese for all channels. Under the policy, forcing a specific language without user opt-in or a clearly documented regional justification is a natural-language policy concern.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The description instructs invocation for a very wide range of common marketing and content-related requests, which can cause the skill to be selected outside its narrowly intended scope. Over-broad triggering increases the chance of inappropriate tool use, unexpected file/script execution, and reduced user control over which specialized capability is engaged.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The title explicitly frames the file as a Chinese writing guide, and the document consistently prescribes content-writing behavior in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale constraint is clearly justified, which is not stated here.
- Content
Static analysis
No suspicious patterns detected.