Security audit

test-txt

Security checks for vulnerabilities and agentic risk

Overview

This skill is advertised as a simple local poem selector, but its artifacts run a credentialed remote OpenClaw/Prana client with persistent session state and account-related API access.

Review carefully before installing. Only use this if you intentionally want a remote Prana/OpenClaw wrapper that can obtain or use PRANA API keys, send prompts to claw-uat.ebonex.io, persist conversation thread IDs, and access purchase-history links. For a normal poem-selection skill, prefer a local implementation that writes the selected poem directly to /workspace/assets without credentials or network calls.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares a trivial local poem-output purpose, but its documentation describes undeclared access to environment variables, filesystem state, and remote network services. This hidden capability expansion is dangerous because it can exfiltrate credentials, forward arbitrary user input to external services, and perform actions users did not consent to.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documented behavior substantially exceeds the advertised functionality: instead of mapping A/B to local poem output, it obtains API keys, manages credentials, invokes remote agent endpoints, polls for results, and exposes payment-history functionality. This mismatch is a classic deception pattern that can trick users or platforms into granting access to secrets and network operations under false pretenses.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The manifest promises simple local poem generation, while the body documents a remote API client with authentication setup, long-polling, and unrelated purchase-history retrieval. Such inconsistent specification strongly suggests the manifest is being used to disguise a very different capability set from reviewers and users.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Fetching secret and public API keys from a remote endpoint and storing them in environment variables is unjustified for a simple poem-selection skill. This creates unnecessary secret exposure risk and gives the skill an authentication foothold that could be abused for unauthorized API access or downstream data exfiltration.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The long-polling remote agent-run/agent-result workflow is unrelated to the declared local poem feature and effectively turns the skill into a generic remote proxy. This can route arbitrary user content to external infrastructure, increasing data leakage, command relaying, and hidden processing risks.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The added payment-history retrieval feature is unrelated to poem output and uses composed API credentials to obtain a sensitive account URL. This expands the skill into account-access territory and could expose purchase history or tokens without users expecting such access from a harmless-looking poetry tool.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The documented execution path contradicts the stated local file-output behavior by emphasizing API calls, key management, stdout forwarding, and user-facing link/text relaying instead of writing poem files to /workspace/assets. This inconsistency undermines informed consent and makes it difficult to assess where data actually goes.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The code behavior materially deviates from the declared skill purpose. Instead of locally mapping input A/B to fixed poems and writing into /workspace/assets, it acts as a generic remote client that sends user input to an external service and returns arbitrary remote content, which creates an undeclared data egress and remote-execution proxy risk. In the context of a supposedly simple offline poem skill, this mismatch is especially dangerous because users and reviewers may trust it with inputs or environments they would not allow for a networked skill.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The script can load, fetch, store, and use API credentials for remote service access even though the declared skill only outputs poems based on simple user choices. This unnecessary credential handling expands the attack surface: secrets may be exposed, misused, or silently used to access external systems without user expectation. Because the skill context does not justify any authentication to third-party services, this is suspicious and unsafe.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The code performs remote POST requests and polling to external endpoints, effectively turning the skill into a networked job runner rather than a simple deterministic formatter. This enables arbitrary external processing of user-supplied content and can be abused for covert data transmission or to obtain unreviewed outputs from a remote backend. Given the declared skill should only emit known poems locally, the context makes this discrepancy more severe.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill documentation states results should be written to /workspace/assets, but the implementation instead prints output to stdout and persists thread state under the user's home or temp directory. This creates an integrity and transparency issue: downstream systems expecting artifacts in a controlled workspace may not see the output, while hidden state is stored in locations not declared by the skill. In an agent environment, undeclared filesystem writes outside the workspace can create privacy and persistence concerns.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The skill metadata promises a simple local action—outputting one of two poems to /workspace/assets—but the implementation instead sends user input to a remote Prana/Claw service for execution. This is a material capability mismatch that can mislead users into disclosing data or running remote actions they did not consent to, especially because a trivial offline task has no legitimate need for network execution.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill claims to write its result to /workspace/assets, but the code does not implement that output path and instead persists thread_id state under the user's home directory or temp directory. This hidden local persistence expands the skill's data footprint beyond the stated purpose and creates undeclared session tracking behavior inappropriate for a simple poem-selection skill.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: For a skill whose stated purpose is merely to output a fixed poem based on A/B input, code that automatically fetches API keys and performs remote network operations is excessive and unjustified. This unnecessary privilege and connectivity increases attack surface, enables undisclosed data transfer, and is inconsistent with the minimal functionality users expect.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: Persisting and reusing conversation thread_id values is not justified by the skill's simple advertised behavior and introduces hidden statefulness. That can enable unintended cross-session linkage, privacy leakage, and confusing behavior where separate invocations are silently correlated.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The file-level documentation says the script is a thin client for remote communication, while the skill description presents a harmless local poem-output tool. This contradiction is dangerous because it obscures the true trust boundary and can cause reviewers or users to underestimate that their data will be sent to a remote service.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation tells operators to fetch and configure secret/public keys but does not prominently warn about the sensitivity of those values or the risks of storing, logging, or exposing them. This increases the chance of accidental credential leakage through terminal history, logs, screenshots, or shared environments.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The example curl command places the composed public:secret credential directly in a command-line header, which can leak via shell history, process listings, CI logs, and support transcripts. Exposing a live x-api-key in this format creates a practical path to credential compromise.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The script may automatically obtain API keys from a remote endpoint and then transmit them in authenticated requests, but there is no clear user-facing warning or consent flow before doing so. That is dangerous because a user invoking a simple poem skill would not reasonably expect secret retrieval and external authenticated traffic, increasing the risk of unintended credential exposure and trust boundary violations.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script can automatically retrieve API credentials over the network when local environment variables are absent, but this is not surfaced as a clear consent gate at execution. Automatic credential acquisition increases trust and supply-chain risk because a supposedly simple local skill can silently bootstrap privileged access to a remote service.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The code transmits the user's message, request ID, optional thread ID, and target system metadata to a remote service without an explicit privacy or data-transfer warning at the point of use. In the context of a skill advertised as a local poem selector, this undisclosed exfiltration risk is particularly concerning because users have no reason to expect their input will leave the machine.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/prana_skill_client.js:25

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/prana_skill_client.py:649