Skill Creator Operator

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:37 PM UTC
• Version: 1.0.1

Overview

This skill is a straightforward OpenClaw skill scaffolder, with ordinary file-writing risks users should manage when choosing an output directory.

Installers should treat this as a benign scaffolding helper. Before running the bundled script, choose a dedicated output directory, avoid attacker-controlled or shared folders, and check whether the target skill directory already exists because generated files may replace existing content.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/scaffold-skill.mjs:26

Finding

Attacker-Controlled Output Directory Allows Existing File and Symbolic-Link Target Overwrites

Content

View full analysis

Vulnerability Details

File Location: scripts/scaffold-skill.mjs, lines 26-47
Vulnerability Type: Unrestricted filesystem destination and unsafe file overwrite
Risk Level: Medium

Vulnerable Code

js

const outDir = outDirArg || path.resolve(process.cwd(), "skills");
const skillDir = path.join(outDir, slug);
const refsDir = path.join(skillDir, "references");
const scriptsDir = path.join(skillDir, "scripts");

fs.mkdirSync(refsDir, { recursive: true });
fs.mkdirSync(scriptsDir, { recursive: true });

const skillMd = `---\nname: ${slug}\ndescription: ${JSON.stringify(desc)}\n---\n\n# ${slug}\n\n## What this does\n\n- ${desc}\n\n## First run setup (premium wizard)\n\nIf this skill is not configured yet, run the setup wizard before doing real work.\n\n- Config file (workspace): <workspace>/.skill-config/${slug}.json\n\nWizard rules:\n- Ask only what is necessary to personalize the skill.\n- Keep it to 3 to 8 questions.\n- Show a short summary and ask for confirmation.\n- Persist answers to the config file.\n- Run a tiny test.\n\n## Reconfigure\n\nIf the user says: setup, configure, reconfigure, change settings then re-run the wizard.\n\n## References\n\nSee references/ for examples and deeper docs.\n`;

fs.writeFileSync(path.join(skillDir, "SKILL.md"), skillMd, "utf8");

const setupStub = `#!/usr/bin/env node\n/*\nOptional CLI setup helper.\nThis is a fallback for users who prefer terminal over chat.\nWrite config to: <workspace>/.skill-config/${slug}.json\n*/\n\nconsole.log("This skill is configured via chat by default. If you need CLI setup, implement prompts here.");\n`;
fs.writeFileSync(path.join(scriptsDir, "setup.mjs"), setupStub, "utf8");

fs.writeFileSync(path.join(refsDir, "README.md"), `# ${slug} references\n\nPut longer docs and examples here.\n`, "utf8");

console.log(JSON.stringify({ ok: true, skillDir }, null, 2));

Technical Analysis

The optional outDirArg is accepted ...[truncated 2362 chars]

Remediation

View remediation

Remediation Suggestions

1. Resolve and canonicalize both the approved skills root and requested destination using path.resolve and, where applicable, fs.realpathSync.
2. Reject destinations outside the approved root unless the user gives explicit, informed confirmation.
3. Refuse to scaffold into an existing Skill directory by default. Require an explicit --force option before replacing any content.
4. Create new files with exclusive mode, such as fs.writeFileSync(path, data, { encoding: "utf8", flag: "wx" }), so existing files are not silently overwritten.
5. Inspect every destination component with fs.lstatSync and reject symbolic links before creating directories or files.
6. Revalidate the resolved parent directory immediately before each write to reduce symbolic-link race opportunities.
7. For overwrite mode, display the exact files that will be replaced and require explicit confirmation.
8. Where practical, scaffold into a newly created temporary directory under the approved root and atomically rename it into place only after all validation and writes succeed.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

# Skill Creator Operator

This skill helps you create new OpenClaw skills that feel premium.

Premium means:
- On first use, the skill runs a short conversational setup wizard (only asks what must be personalized).

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The listed invocation examples include broad phrases such as "create a new skill" and "package this workflow as a skill" without narrowing context or exclusion conditions. In a markdown skill description, this can make activation ambiguous and increase the chance of unintended invocation during normal conversation about skills or workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.