Automation Workflow Helper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:52 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent automation guide, but it recommends sensitive browser automation patterns with saved login sessions, plaintext credential examples, and an unpinned third-party RPA install without enough safeguards.

Review carefully before installing. Use this only in environments where browser automation is allowed, avoid putting passwords or MFA codes into chat prompts, prefer OAuth or a secrets manager, use least-privilege automation accounts, isolate RPA runs from personal browser profiles, and inspect or pin the referenced openclaw-rpa package before granting it access to internal systems or business data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:120

Finding

Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk

Content

View full analysis

**Recommended tool: OpenClaw RPA** > > An RPA compiler built for AI Agents — describe the task in plain language, AI drives a real browser to record it once, and auto-generates a standalone Playwright Python script. Every subsequent replay runs with **zero Token, zero hallucination, in seconds**. > > Real-world demo videos include e-commerce price monitoring, financial reconciliation, hotel data collection, and stock news briefings: > 👉 **[View README + Video Demos](https://github.com/laziobird/openclaw-rpa)** > > **Featured case tutorials:** > - 🛒 **[Amazon Best Sellers Scraper](https://github.com/laziobird/openclaw-rpa/blob/main/articles/scenario-amazon-bestsellers.en-US.md)** > - 🏨 **[Airbnb Competitor Price Tracker](https://github.com/laziobird/openclaw-rpa/blob/main/articles/scenario-airbnb-compare.en-US.md)** > - 🏦 **[AP Reconciliation](https://github.com/laziobird/openclaw-rpa/blob/main/articles/scenario-ap-reconciliation.en-US.md)** > > Install on the OpenClaw platform in one click: > 👉 **[clawhub.ai/laziobird/openclaw-rpa](https://clawhub.ai/laziobird/openclaw-rpa)** > > Or run in terminal: > ```bash > openclaw skills install openclaw-rpa > ``` ``` ### Technical Analysis The Skill directs users to install a separately maintained third-party Skill by its mutable package name. The command does not specify an immutable version, source commit, checksum, signature, or other integrity constraint. It also provides no instructions to inspect the dependency or review its requested capabilities before installation. The external dependency is not included in the audited project, so its implementation and effective permissions cannot be verified through this audit. Even if the dependency is currently benign, an upstream account compromise, distribution-pl ...[truncated 1629 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:110

Finding

Plaintext Credential Entry and Persistent Authentication Cookie Reuse

Content

View full analysis

, username , password ``` At line 428: ```markdown > **Tip:** If the system requires an SMS verification code, run `#rpa-login ` first to save the login session. Subsequent recordings auto-inject the cookie — no repeated login needed. ``` ### Technical Analysis The example encourages users to place a username and password directly into task text. Depending on the hosting platform, task text may be retained in chat history, telemetry, execution logs, generated scripts, diagnostic records, or other artifacts. The documentation does not instruct users to use a secret manager, interactive credential prompt, redaction mechanism, or protected credential reference. The Skill also recommends saving and automatically reinjecting authentication cookies. A session cookie is commonly a bearer credential: possession may be sufficient to impersonate the authenticated user until the session expires or is revoked. Reusing a cookie to avoid SMS verification or another authentication challenge increases the sensitivity of the stored session state. No controls are specified for: - Encryption at rest. - Restrictive file permissions. - Origin or domain binding. - Session expiry and rotation. - Log and artifact redaction. - Revocation after use. - Secure deletion. - Separation between users or automation jobs. The audited file does not itself implement cookie storage or transmit credentials. The vulnerability is the insecure operational guidance and absence of required safeguards. ### A ...[truncated 1670 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 187)May include surrounding context.

md

Actions:
  Step 1: Write lead to spreadsheet (name, phone, requirement)
  Step 2: Send welcome email to customer
  Step 3: Send message to sales channel: "New lead: [Name] [Phone]"
  Step 4: Create follow-up task in project management tool, remind in 3 days

Error handling: If Step 1 fails, send alert email to me

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger description is extremely broad and matches common terms like "workflow," "efficiency," and "save time," which can cause this skill to activate in many unrelated contexts. Overbroad activation increases the chance the skill will steer users into automation or RPA guidance for tasks involving sensitive systems or data without sufficient user intent verification.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

**Easiest wins to start with:**

- Form submission → auto send email / Slack notification
- Form data → auto save to spreadsheet
- Payment received → auto generate invoice
- Scheduled weekly report delivery to clients

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill provides detailed automation patterns for handling leads, onboarding, financial reconciliation, internal systems, and message routing involving personal, financial, and operational data, but it does not include explicit safeguards around credential handling, consent, least privilege, data minimization, retention, or policy/legal compliance. In practice, this could lead users to automate sensitive workflows in insecure ways, including storing credentials in prompts, propagating PII to third-party tools, or automating actions against production systems without review.

Content

No source excerpt is available for this finding.