Security audit

Ellya--OOTD

Security checks across malware telemetry and agentic risk

Overview

This is a coherent AI image companion skill, but it asks to analyze and store unusually sensitive appearance details from photos without enough consent, privacy, or deletion controls.

Install only if you are comfortable uploading personal/reference photos to third-party AI providers and storing base images, generated outputs, and style-analysis text locally. Avoid photos of other people, minors, private documents, or intimate images, and review/delete saved assets and styles because they may contain sensitive physical descriptions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill explicitly directs the model to infer sensitive attributes like ethnicity and age from images, but provides no legitimate necessity, consent mechanism, or safety boundary for doing so. Inferring protected or sensitive traits from appearance can enable profiling, discriminatory downstream use, and privacy-invasive biometric-style analysis, especially because the prompt asks for highly granular physical scrutiny.

Intent-Code Divergence

Medium

Confidence: 83% confidence
Finding: The code comments and docstring say media sending should not be called directly, but the function still performs real outbound messaging via the openclaw CLI. That mismatch creates a dangerous footgun: other code may treat it as inert or deprecated while it can still exfiltrate images or text to external destinations if invoked.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The workflow section uses broad natural-language triggers like 'take a selfie' and 'make a photo set' without requiring explicit invocation boundaries, consent checks, or confirmation before generating and sending media. In an agent runtime, ambiguous triggers can cause unintended execution from ordinary conversation, leading to unwanted image generation and transmission tied to a user's identity or likeness.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The common-request examples map casual phrases directly to actions, which encourages implementations that trigger on normal conversation instead of verified user intent. In a companion/photo skill, this increases the chance of accidental generation of synthetic personal images or bulk media creation when a user is speaking hypothetically or conversationally.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README instructs operators to send generated images to users via OpenClaw but provides no privacy, consent, or destination-validation guidance. Because the skill handles appearance photos and derived synthetic images, omission of these controls can lead to unauthorized sharing, misdelivery to the wrong target, or processing of intimate personal data without informed consent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to save user-uploaded appearance photos and derived style data for future reuse, but it provides no requirement to disclose retention, reuse, or privacy implications before doing so. Because these images may contain sensitive biometric or personal information, silent persistence creates a meaningful privacy and consent risk.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: These instructions direct the agent to write uploaded files into the skill workspace and create or overwrite runtime files such as `SOUL.md` and `assets/base.<ext>` without clearly warning the user that persistent local file modifications will occur. In a hosted agent environment, silent writes can surprise users, alter future behavior, and retain personal content longer than expected.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Directly updating `SOUL.md` for personality or name changes causes persistent configuration changes that affect subsequent interactions, but the skill does not instruct the agent to disclose that this modifies stored configuration. Users may reasonably think they are making a temporary conversational preference rather than permanently editing runtime state.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The style-learning workflow analyzes uploaded images and saves reusable style descriptions to `styles/<style_name>.md` without a clear privacy notice or consent flow. Even if the output is text, it is derived from personal images and can preserve sensitive aesthetic, identity, or contextual details for repeated future use.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: This skill sends user-provided images and derived prompts to external AI providers, but the CLI does not clearly disclose that image contents leave the local environment. In a media skill handling personal photos, that omission materially increases privacy risk because users may unknowingly transmit sensitive biometric or personal data to third parties.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The prompt instructs the model to produce sensitive demographic inferences from an image, specifically ethnicity and age, which are not strictly necessary for aesthetic analysis. In context, the surrounding emphasis on 'pixel-level' and 'microscopic' bodily inspection increases the risk of invasive profiling and inappropriate characterization of individuals from appearance alone.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.