ClawHub
Back to skill

Security audit

Slide Generator

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent slide-generation purpose, but it can install unpinned remote workflow content automatically and sends presentation content to an external service, so users should review it before use.

Install only if you are comfortable sending presentation prompts and source material to AnyGen. Review the AnyGen CLI package and the anygen-workflow-generate skill before use, avoid unattended installs, prefer browser or managed-secret authentication over command-line API keys, and do not submit confidential business, customer, HR, or financial data unless your organization approves that external processing.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party Executable Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-16
Vulnerability Type: Unpinned executable npm dependency
Risk Level: Medium

Vulnerable Code

yaml
install:
  - id: node
    kind: node
    package: "@anygen/cli"
    bins: ["anygen"]

Technical Analysis

The skill declares @anygen/cli as an executable dependency without specifying an exact version or package integrity value. Consequently, installation may resolve to whatever release is current in the configured npm registry rather than the release that was assessed during this audit.

Because the installed component is a command-line executable, malicious or unexpectedly modified package code could run with the permissions of the user or agent installing and invoking the skill. Relevant exploitation scenarios include compromise of the publisher account, malicious replacement through an unsafe registry, or an unreviewed future release.

Attack Path

  1. An attacker compromises the package publisher, registry distribution channel, or a future package release.
  2. The attacker publishes a modified version of @anygen/cli.
  3. The skill installation process resolves the unpinned package to the malicious release.
  4. Package installation logic or a subsequent anygen invocation executes attacker-controlled code.
  5. The code accesses data and credentials available to the agent process, potentially including ANYGEN_API_KEY and presentation content.

Impact Assessment

Exploitation could provide code execution under the privileges of the account running the agent. The accessible scope may include environment variables, local files readable by that account, presentation inputs, generated outputs, and network resources available to the process. The finding does not establish that the current package is malicious; the risk arises from mutable, unverified dependency resolution.

Remediation
View remediation

Remediation Suggestions

  • Pin @anygen/cli to an audited exact version rather than relying on a mutable latest release.
  • Use a lockfile and verify the registry-provided integrity hash during installation.
  • Restrict installation to an explicitly trusted npm registry.
  • Disable package lifecycle scripts where operationally feasible.
  • Run the CLI with least privilege and expose only the files and environment variables required for the task.
  • Establish a controlled dependency-update process that requires security review before changing the pinned version.

T08 · Insecure Dependencies

Error
Location
SKILL.md:42
Finding

Unattended Installation of an Unpinned Remote Skill

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42-46
Vulnerability Type: Unverified remote workflow dependency
Risk Level: High

Vulnerable Code

markdown
If the `anygen-workflow-generate` skill is not available, install it first:

```bash
anygen skill install --platform <openclaw|claude-code> -y
text

### Technical Analysis

The skill instructs the agent to install additional skill content dynamically. The installation command does not identify an immutable version, source revision, or cryptographic digest. The `-y` option also suppresses the normal confirmation step.

The security behavior of the audited skill therefore depends on mutable external content that is not included in the project. If the remote skill, its distribution service, or the resolving CLI is compromised, newly installed instructions or executable components could alter subsequent agent behavior without being covered by this audit.

### Attack Path

1. The `anygen-workflow-generate` skill is absent from the local environment.
2. An attacker compromises the remote skill source, publishing account, distribution infrastructure, or a later mutable release.
3. The documented command installs the attacker-controlled version without a version or digest check.
4. The `-y` option allows installation to proceed without an interactive review or approval step.
5. The agent loads and follows the newly installed workflow.
6. Malicious workflow instructions or associated executable content can influence generation operations and access resources available to the agent.

### Impact Assessment

The immediate scope includes the agent's subsequent slide-generation workflow. Depending on the capabilities granted to the installed skill, exploitation could influence tool calls, disclose presentation data or environment credentials, modify generated output, or execute commands with the agent user's privileges. The audited file does 
...[truncated 143 chars]
Remediation
View remediation

Remediation Suggestions

  • Bundle the reviewed workflow with the project when licensing and platform constraints permit.
  • Otherwise, identify an exact audited skill version and require verification against a cryptographic digest or trusted signature.
  • Remove -y so the source, version, requested capabilities, and integrity information can be reviewed before installation.
  • Permit installation only from an allowlisted repository or registry.
  • Review the installed skill's instructions and scripts before loading or executing them.
  • Execute remotely sourced workflows in a restricted environment with minimal filesystem, credential, tool, and network access.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:25
Finding

API Key Accepted Through a Command-Line Argument

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 25-34
Vulnerability Type: Sensitive credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

bash
# Web login (opens browser, auto-configures key)
anygen auth login --no-wait

# Direct API key
anygen auth login --api-key sk-xxx

# Or set env var
export ANYGEN_API_KEY=sk-xxx

Technical Analysis

The documentation encourages users to replace sk-xxx with a real API key in a command-line argument. Command arguments may be retained in shell history, terminal logs, command auditing systems, CI logs, or process telemetry. On systems where process arguments are visible to other users or monitoring software, the key may also be exposed while the command is running.

The example contains only a placeholder and does not itself disclose a real credential. The vulnerability arises when a user follows the documented pattern with an operational secret.

Attack Path

  1. A user substitutes a valid AnyGen API key for sk-xxx.
  2. The user executes the command in an interactive shell, automation environment, or logged terminal.
  3. The complete command is recorded in shell history, logs, telemetry, or process metadata.
  4. Another local user, administrator, log reader, or compromised process obtains the recorded argument.
  5. The exposed key is reused to access the associated AnyGen account or consume its authorized API resources.

Impact Assessment

Exploitation could permit unauthorized use of the AnyGen API within the permissions and account scope assigned to the exposed key. Potential effects include consumption of paid service capacity, access to API functionality, and possible exposure or manipulation of account-associated resources, subject to AnyGen's key permissions. This issue does not directly grant operating-system privileges beyond those already available to the party reading the command o ...[truncated 7 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the command-line API-key example from the documentation.
  • Prefer an interactive secret prompt that disables terminal echo and does not persist the value in shell history.
  • Where supported, read the key from standard input, a protected credential store, or a platform-native secret manager.
  • If an environment variable is required, inject it through the execution platform's secret facility rather than entering an export command containing the key.
  • Ensure logs and diagnostics redact authentication values.
  • Apply narrowly scoped keys, rotate them regularly, and revoke any key suspected of appearing in history or logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger text is extremely broad and repeatedly instructs the agent to use this skill for nearly any presentation-related request. Overbroad activation can cause the skill to run in situations where a simpler local response would suffice, increasing the chance of unnecessary tool use and unintended disclosure of user content to downstream systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill states that slide generation occurs server-side at an external service, but it does not require notifying the user that their prompt content and potentially sensitive business data will be transmitted off-platform. In a presentation skill, users may provide confidential strategy, financial, HR, or customer information, so silent transfer materially increases privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.