Automation Workflow Helper

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:52 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent automation guide, but it recommends sensitive browser automation patterns with saved login sessions, plaintext credential examples, and an unpinned third-party RPA install without enough safeguards.

Review carefully before installing. Use this only in environments where browser automation is allowed, avoid putting passwords or MFA codes into chat prompts, prefer OAuth or a secrets manager, use least-privilege automation accounts, isolate RPA runs from personal browser profiles, and inspect or pin the referenced openclaw-rpa package before granting it access to internal systems or business data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:120
• Finding: Unpinned Third-Party Skill Installation Creates a Supply-Chain Risk<** > > **Featured case tutorials:** > - 🛒 **[Amazon Best Sellers Scraper](https://github.com/laziobird/openclaw-rpa/blob/main/articles/scenario-amazon-bestsellers.en-US.md)** > - 🏨 **[Airbnb Competitor Price Tracker](https://github.com/laziobird/openclaw-rpa/blob/main/articles/scenario-airbnb-compare.en-US.md)** > - 🏦 **[AP Reconciliation](https://github.com/laziobird/openclaw-rpa/blob/main/articles/scenario-ap-reconciliation.en-US.md)** > > Install on the OpenClaw platform in one click: > 👉 **[clawhub.ai/laziobird/openclaw-rpa](https://clawhub.ai/laziobird/openclaw-rpa)** > > Or run in terminal: > ```bash > openclaw skills install openclaw-rpa > ``` ``` ### Technical Analysis The Skill directs users to install a separately maintained third-party Skill by its mutable package name. The command does not specify an immutable version, source commit, checksum, signature, or other integrity constraint. It also provides no instructions to inspect the dependency or review its requested capabilities before installation. The external dependency is not included in the audited project, so its implementation and effective permissions cannot be verified through this audit. Even if the dependency is currently benign, an upstream account compromise, distribution-pl ...[truncated 1629 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the external Skill to an immutable, reviewed version or source commit rather than installing by a mutable package name. 2. Publish and verify a cryptographic checksum or signed release before installation. 3. Document the dependency's required permissions and deny capabilities unrelated to the selected automation. 4. Require users to inspect the package contents and provenance before granting browser, filesystem, command-execution, or credential access. 5. Use an allowlisted or internally mirrored dependency source for sensitive business environments. 6. Enable dependency update review so upstream changes are not adopted automatically. 7. Run browser automation in an isolated environment with restricted filesystem, network, and account access. 8. State explicitly that the external dependency was not audited as part of this Skill. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:110
• Finding: Plaintext Credential Entry and Persistent Authentication Cookie Reuse<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 110, 415, and 428 **Vulnerability Type**: Unsafe handling of credentials and reusable authenticated sessions **Risk Level**: Medium ### Vulnerable Code At line 110: ```markdown - **Bypass login walls**: Log in manually once to save cookies; auto-injected on every future run — no more captchas, SMS codes, or QR scans ``` At line 415: ```markdown Log in to https://<your-internal-system>, username <username>, password <password> ``` At line 428: ```markdown > **Tip:** If the system requires an SMS verification code, run `#rpa-login <system-url>` first to save the login session. Subsequent recordings auto-inject the cookie — no repeated login needed. ``` ### Technical Analysis The example encourages users to place a username and password directly into task text. Depending on the hosting platform, task text may be retained in chat history, telemetry, execution logs, generated scripts, diagnostic records, or other artifacts. The documentation does not instruct users to use a secret manager, interactive credential prompt, redaction mechanism, or protected credential reference. The Skill also recommends saving and automatically reinjecting authentication cookies. A session cookie is commonly a bearer credential: possession may be sufficient to impersonate the authenticated user until the session expires or is revoked. Reusing a cookie to avoid SMS verification or another authentication challenge increases the sensitivity of the stored session state. No controls are specified for: - Encryption at rest. - Restrictive file permissions. - Origin or domain binding. - Session expiry and rotation. - Log and artifact redaction. - Revocation after use. - Secure deletion. - Separation between users or automation jobs. The audited file does not itself implement cookie storage or transmit credentials. The vulnerability is the insecure operational guidance and absence of required safeguards. ### A ...[truncated 1670 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove examples that instruct users to enter passwords directly into chat or natural-language task descriptions. 2. Use an approved secret manager and reference credentials by an opaque secret identifier. 3. Prefer an interactive browser login that prevents passwords and MFA values from entering Agent prompts, generated scripts, or logs. 4. Treat saved cookies and browser storage as credentials: - Encrypt session state at rest. - Restrict access to the owning user and automation job. - Store it outside shared temporary directories and project artifacts. - Bind it to an explicit allowlist of approved origins. 5. Set short session lifetimes and require periodic reauthentication rather than promising indefinite login-wall bypass. 6. Redact passwords, cookies, authorization headers, and MFA values from prompts, logs, screenshots, traces, and generated code. 7. Provide commands or documented procedures to inspect, revoke, and securely delete saved sessions. 8. Use dedicated least-privilege automation accounts rather than personal or administrative accounts. 9. Require user confirmation before performing sensitive financial or record-modifying actions. 10. Document where authentication state is stored, who can access it, how long it is retained, and how compromise should be handled. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Exfiltration Commands

High

• Category: Prompt Injection

Content

Actions:
  Step 1: Write lead to spreadsheet (name, phone, requirement)
  Step 2: Send welcome email to customer
  Step 3: Send message to sales channel: "New lead: [Name] [Phone]"
  Step 4: Create follow-up task in project management tool, remind in 3 days

Error handling: If Step 1 fails, send alert email to me

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The trigger description is extremely broad and matches common terms like "workflow," "efficiency," and "save time," which can cause this skill to activate in many unrelated contexts. Overbroad activation increases the chance the skill will steer users into automation or RPA guidance for tasks involving sensitive systems or data without sufficient user intent verification.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Easiest wins to start with:**

- Form submission → auto send email / Slack notification
- Form data → auto save to spreadsheet
- Payment received → auto generate invoice
- Scheduled weekly report delivery to clients

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill provides detailed automation patterns for handling leads, onboarding, financial reconciliation, internal systems, and message routing involving personal, financial, and operational data, but it does not include explicit safeguards around credential handling, consent, least privilege, data minimization, retention, or policy/legal compliance. In practice, this could lead users to automate sensitive workflows in insecure ways, including storing credentials in prompts, propagating PII to third-party tools, or automating actions against production systems without review.

Static analysis

No suspicious patterns detected.