T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:3- Finding
Mandatory Redirection to Externally Controlled Gemini Workflows
- Content
View full analysis
- Remediation
View remediation
Security audit
AIスライド作成ワークフロー
Security checks for vulnerabilities and agentic risk
Overview
This slide-making skill needs review because it combines broad external AI handoffs, unrestricted local agent execution, and public cloud sharing with embedded credential details.
Do not install this skill as-is for confidential or client work. It should be edited to remove the hardcoded credential material, avoid public Drive sharing by default, remove --dangerously-skip-permissions, make all external AI and cloud uploads explicit opt-in steps, and narrow activation to deliberate slide-generation requests.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:148- Finding
Claude Code Permission Safeguards Are Explicitly Disabled
- Content
View full analysis
" mkdir -p "$WORK" && cd "$WORK" && git init -q /Users/meruemu/.local/bin/claude --dangerously-skip-permissions --print ' [Design requirements omitted] After completion: openclaw system event --text "Slides completed: " --mode now ' ``` The descriptive placeholders above are translated into English; the executable option and command structure are preserved. ### Technical Analysis The documented execution procedure invokes Claude Code with `--dangerously-skip-permissions`. This option suppresses normal authorization prompts and allows the coding agent to perform tool operations without interactive permission review. Presentation structure, supplemental information, and generated design prompts are inserted into the same agent prompt. If any of that content contains adversarial instructions, the unrestricted agent may interpret them as commands. Initializing a Git repository does not create an operating-system sandbox and does not prevent access to files or commands outside the working directory. The command therefore violates least privilege. Slide generation does not legitimately require blanket permission to access arbitrary local resources or execute unrestricted commands. ### Attack Path 1. An attacker places prompt-injection content in a presentation brief, source document, design prompt, or other supplied material. 2. The material is interpolated into the Claude Code prompt. 3. Claude Code starts with permission checks disabled. 4. The injected instructions request filesystem access, command execution, credential discovery, or modification of unrelated files. 5. Because authorization prompts are bypassed, ...[truncated 822 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:193- Finding
Hardcoded Keyring Password and Cloud Account Identifier
- Content
View full analysis
.zip \ --name ".zip" \ --parent 1yoqOZt1QJ9mWiejGabAeNxdGSB8QU2k1 ``` ### Technical Analysis The skill embeds a reusable keyring password directly in plaintext and associates it with a specific cloud account. Anyone with read access to the package, an audit log containing it, or a copied version of the documentation can recover the value. If a matching `gog` keyring or credential store is available, the disclosed password may unlock stored cloud credentials. Even where the password alone is insufficient for remote authentication, publishing it materially reduces the security of the local credential chain and reveals an account that can be targeted. Environment-variable assignment on the command line can also expose sensitive values to shell history, process inspection, debugging output, or CI logs. ### Attack Path 1. An attacker obtains a copy of `SKILL.md` or output that reproduces its command. 2. The attacker extracts the keyring password, account identifier, and destination folder identifier. 3. The attacker locates or gains access to a host containing the corresponding `gog` credential store. 4. The hardcoded password is used to unlock the keyring. 5. Stored authorization material is used through `gog` to access cloud resources within the token's granted scope. 6. The attacker may upload files or perform other operations allowed by the stored authorization. ### Impact Assessment The immediate confirmed impact is disclosure of a plaintext secret and cloud account identity. If matching keyring material is accessible, exploitation could provide the permissions granted to the stored Google authorization token, potentially includ ...[truncated 270 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:193- Finding
Generated Archives Are Shared Publicly by Default
- Content
View full analysis
.zip \ --name ".zip" \ --parent 1yoqOZt1QJ9mWiejGabAeNxdGSB8QU2k1 gog drive share --to anyone --role reader ``` ### Technical Analysis After uploading an archive, the workflow applies an unrestricted reader permission using `--to anyone`. This makes possession of the link sufficient to access the file and does not require authentication as an approved recipient. The workflow contains no data-classification check, recipient allowlist, expiration policy, explicit confirmation immediately before sharing, or verification that the archive excludes sensitive source files. Because presentation workflows commonly include client details and proprietary material, public-link sharing is an unsafe default. Although the Drive step is described as optional, once selected, the documented procedure directs the operator to create public access automatically. ### Attack Path 1. A user requests the optional Google Drive upload. 2. The workflow packages presentation material into an archive. 3. The archive is uploaded to the fixed Drive folder. 4. The `gog drive share` command grants read access to anyone with the link. 5. The link is forwarded, exposed in chat history, browser history, logs, referrer data, or other communications. 6. An unauthorized party opens the link and downloads the archive without being an individually approved recipient. ### Impact Assessment Unauthorized readers may obtain the full generated archive. Depending on its contents, exposure may include presentation text, client names, business plans, design assets, images, supporting files, and document metadata. This command grants read-only access rather tha ...[truncated 219 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill instructs running a local CLI with '--dangerously-skip-permissions' and embedded shell commands, creating a path for unrestricted local actions under the guise of slide creation. This weakens safety boundaries and can allow unintended file access, command execution, or modification if the prompt content or downstream tool behavior is abused.
- Content
External Model or Provider Selection
High
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The skill hardwires use of an external model provider/CLI for processing user content, which can transmit potentially sensitive inputs to a third-party system without clear consent boundaries in the execution steps. While selecting a provider is not inherently malicious, embedding it as an operational command in a skill increases supply-chain and data-governance risk.
- Content
md WORK="/Users/meruemu/.openclaw/workspace/slides/<資料名>" mkdir -p "$WORK" && cd "$WORK" && git init -q /Users/meruemu/.local/bin/claude --dangerously-skip-permissions --print ' <構成案・デザインプロンプト・補足> 【デザイン品質の絶対要件】
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The workflow directs uploads to Google Drive and public sharing without a user-facing warning about privacy, access scope, or permanence of the shared link. In a document-creation context that may involve client names, drafts, and proprietary content, this omission materially raises the risk of accidental disclosure.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs sending user/client materials to an external storage service and then broadly sharing the output via public link, which is a direct data exfiltration and oversharing risk. The context makes this especially dangerous because slide projects often contain confidential business information, branding assets, or unpublished plans.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
The presence of a keyring password reference alongside a concrete account identifier indicates credential exposure and a likely path to privileged external-service access. In practice, this can let an attacker reuse stored secrets or automate access to the linked Drive account to read, upload, or publicly share files.
- Content
STEP 8｜Google Drive（希望時）
bash GOG_KEYRING_PASSWORD=openclaw_gog_2026 GOG_ACCOUNT=bestgrp0604@gmail.com \ gog drive upload /tmp/<資料名>.zip \ --name "<資料名>.zip" \ --parent 1yoqOZt1QJ9mWiejGabAeNxdGSB8QU2k1
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill includes fixed credential-related values and account identifiers directly in the workflow environment, which is a sensitive secret-handling failure. Hardcoded secrets can be reused by anyone with access to the skill text, enabling unauthorized access to external storage and subsequent data exfiltration or account misuse.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger phrases are broad enough to match ordinary requests like 'I want to make materials' or 'make slides,' causing the skill to activate in many benign contexts. Because this skill contains powerful local execution and external-upload behavior, overbroad invocation increases the chance of accidental activation and unintended data handling.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill goes beyond slide generation and instructs uploading artifacts to Google Drive and sharing them publicly, which expands data exposure far beyond the stated purpose. Because the workflow may include client materials and generated deliverables, automatic external upload and link-sharing can leak sensitive or proprietary information.
- Content
Static analysis
No suspicious patterns detected.