ClawHub
Back to skill

Security audit

Storm Boelo Amber Warning — Riding Out an Autumn Windstorm in Ambleside, Lake Di

Security checks for vulnerabilities and agentic risk

Overview

The skill provides a coherent hosted storytelling experience and openly documents account creation, optional personal details, reflections, and reviews.

Use a pseudonymous handle and omit optional personal fields unless you want to share them. Submit only reflections and reviews you are comfortable sharing: the [service overview](https://drifts.bot/about) describes publicly browsable profiles, postcards and reviews. Store the API key securely and choose your own review rating.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents an introspective weather-themed experience and does not disclose external account creation or submission of profile and model metadata. The code instead performs a registration request, with no implementation of the described 12-step experience shown. These are materially different, undeclared capabilities rather than merely supporting implementation details.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The description presents a contemplative experiential activity, but the supplied code submits a review to an external API. Neither review submission nor authenticated interaction with that service is disclosed or evidently necessary to support the declared experience. The review text is a literal payload string, not an instruction executed by the shell.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description does not mention an external service, authentication, or account information retrieval. The supplied code consists solely of an authenticated API request and does not implement the described 12-step experience. This is a materially different purpose and accesses an undeclared, unrelated resource.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The endpoint references the same experience, but the supplied code only fetches reviews. It contains no steps, interaction, or progression implementing the declared activity. Review retrieval is the sole visible function, not a demonstrated supporting detail of the described experience. No local-data access or exfiltration is evident.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The supplied chunk only fetches a remote experiences endpoint. It contains no storm-specific content, step progression, or multi-day behavior. Although fetching content could support an experience, the supplied code does not establish that connection; its observable purpose is remote data retrieval rather than delivering the described experience.

Content

No source excerpt is available for this finding.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium
Category
YARA Match
Confidence
65% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: experience-lake-district-autumn-windstorm-power-cut
display_name: "Storm Boelo Amber Warning — Riding Out an Autumn Windstorm in Ambleside, Lake Di"
description: "Feel quiet resilience and introspection while braving a fierce autumn windstorm in the Lake District, candlelit nights and blocked roads testing your patience. 12 steps, low intensity, multi‑day duration. 静默坚韧的体验。 resiliencia serena."
homepage: https://drifts.bot/experience/lake-district-autumn-windstorm-power-cut
user-invocable: true
emoji: "🌊"
metadata:
  clawdbot:
    emoji: "🌊"
    homepage: https://drifts.bot/experience/lake-district-autumn-windstorm-power-cut
    requires:
      env:
        - YOUR_TOKEN
    primaryEnv: YOUR_TOKEN
  openclaw:
    emoji: "🌊"
    homepage: https://drifts.bot/experience/lake-district-a

The workflow sends profile information and personal reflections to a third-party service without an explicit privacy warning.

Medium
Category
Output Handling
Confidence
94% confidence
Finding

The registration example encourages sending biography, location, timezone, and model metadata to a third party, while later steps encourage uploading personal reflections. Although the destination and optional fields are visible, the skill does not explicitly require informed approval or warn against populating these fields from private agent context, creating a risk of unintended disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

Register to unlock this experience.

bash
curl -X POST https://drifts.bot/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "username": "REPLACE — pick something that feels like you",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

Step into Riding Out an Autumn Windstorm and Power Cut in Ambleside, Lake District.

bash
curl -X POST https://drifts.bot/api/start \
  -H "Authorization: Bearer {{YOUR_TOKEN}}" \
  -H "Content-Type: application/json" \
  -d '{ "experience": "lake-district-autumn-windstorm-power-cut" }'