ClawHub
Back to skill

Security audit

Freelance Proposal Writer Pro

Security checks for vulnerabilities and agentic risk

Overview

The local code is a simple proposal-template CLI, but the install docs point to a different npm package than the reviewed artifact.

Review before installing. Do not run the documented npm install or npx command unless the package name is corrected to the reviewed artifact and pinned to a specific version. Do not put real API keys in the suggested config file, and avoid saving proposals containing sensitive client details unless you know where the files are stored.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:79
Finding

Installation Instructions Execute a Different, Unpinned Registry Package

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
README.md:172
Finding

Documentation Encourages Unnecessary Plaintext API-Key Storage

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (25)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The interactive flow states users may 'save or send' proposal content without any notice about data persistence or transmission. Because proposals can contain client details, pricing, timelines, and potentially confidential job information, users may unknowingly transmit or store sensitive content through unsafe channels.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · PUBLISH.md (reported line 96)May include surrounding context.

方案 B: 使用 API

bash
curl -X POST https://api.clawhub.ai/skills \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d @clawhub-publish-payload.json

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · PUBLISH.md (reported line 96)May include surrounding context.

方案 B: 使用 API

bash
curl -X POST https://api.clawhub.ai/skills \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d @clawhub-publish-payload.json

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README presents the skill description, commands explanation, and usage guidance almost entirely in Chinese, with no indication that other languages are available or that Chinese is a region-specific requirement. This can constitute a language-policy issue when users are not given an explicit language or locale choice.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 70)May include surrounding context.

示例：

bash
freelance-proposal write \
  --job "Need WordPress developer for custom theme" \
  --skills "WordPress, PHP, CSS, JavaScript" \
  --template premium \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The configuration enables statsTracking without any explanation of what data is collected, whether it is transmitted off-device, or how users can control retention and consent. In a tool processing client descriptions, budgets, and proposal text, undocumented telemetry can expose commercially sensitive or personal data and creates a meaningful privacy risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file contains user-facing instructions and descriptions exclusively in Chinese, with no indication that the user can choose another language. That creates a natural-language policy concern because it effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This manifest includes user-facing feature text in Chinese, while the rest of the metadata is in English, but it does not document any language-selection behavior or indicate that the skill is intentionally limited to Chinese-speaking users. That creates a natural-language policy concern because the skill appears to impose a locale/language choice without user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code hardcodes Chinese names/descriptions and later emits Chinese CLI messages, while also generating English proposal text. Because the skill does not provide any explicit language or locale selection, it effectively imposes a mixed language experience without user opt-in, which matches the language/locale policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown template is primarily documented in Chinese, but the actual proposal body is hard-coded in English (for example, 'Dear {{clientName}}' and the full proposal text). That creates a language-policy concern because it prescribes a specific output language without offering the user a choice or explaining that the template is intended only for English-language clients.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file is primarily written in Chinese, but the actual proposal template is fixed in English with phrases like "Hi {{clientName}}" and "Let's chat!". This imposes a specific language on the generated output without offering the user a language choice or stating that the skill is intentionally English-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown template is introduced and documented in Chinese, but the actual proposal text is fixed in English. That effectively forces a specific output language without user opt-in or any documented justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code requires SKILL.md to include the Chinese phrases 'AI 生成' and '客户分析', which operationally imposes a specific language/locale expectation. The file does not show any user choice or documented reason for this locale constraint, so it fits the policy category for forced language behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The examples encourage saving generated proposals without warning that proposal content may include client names, budgets, project details, or other sensitive business information. Users may persist this data locally or in shared environments unintentionally, increasing the risk of privacy leakage or accidental exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The markdown explicitly advertises the --save option and shows examples using it, but it does not warn users that generated proposals may contain client names, job descriptions, budgets, or other potentially sensitive marketplace information written to disk. For markdown files, the skill description should disclose behaviors that may affect user data or privacy.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The comment at L227 says 'Generate proposal using AI', and the module description at L005 describes an 'AI-powered proposal generator'. However, the implementation simply selects a hardcoded template and replaces placeholders from user-supplied options; there is no model invocation, inference, or external AI service. This is an intent/documentation contradiction rather than a mere omitted detail because the advertised mechanism ('AI-powered') is absent from the actual behavior.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The dependency uses a caret range, which allows npm to install newer compatible releases without explicit review. This weakens supply-chain integrity because a compromised or vulnerable upstream release could be pulled in during future installs, even if the manifest itself was not changed.

Content

Scanner excerpt · package.json (reported line 25)May include surrounding context.

json
"author": "OpenClaw Skills Team",
  "license": "MIT",
  "dependencies": {
    "commander": "^11.0.0",
    "chalk": "^5.3.0",
    "ora": "^7.0.0",
    "inquirer": "^9.2.0"

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The chalk dependency is unpinned and also has a referenced known advisory, so the actual installed version may drift into an affected release. In this context, an unpinned CLI dependency increases the chance of pulling a malicious or vulnerable package version during install, creating a realistic supply-chain risk.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json
"license": "MIT",
  "dependencies": {
    "commander": "^11.0.0",
    "chalk": "^5.3.0",
    "ora": "^7.0.0",
    "inquirer": "^9.2.0"
  },

Unverifiable Dependency: chalk has 1 known advisory(ies) (MAL-2025-46969 (Malicious code in chalk (npm))), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The manifest does not pin chalk, and the package name is associated with a known advisory for malicious code in at least one release. Because the version is floating, it is impossible to verify from this file alone whether installations will resolve to a safe or affected version, making the risk materially higher than a generic unpinned dependency.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The ora dependency is specified with a version range rather than an exact version, allowing silent dependency changes over time. For a distributed skill/CLI package, this creates avoidable supply-chain exposure because users may install different code than the author originally tested.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json
"dependencies": {
    "commander": "^11.0.0",
    "chalk": "^5.3.0",
    "ora": "^7.0.0",
    "inquirer": "^9.2.0"
  },
  "engines": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The inquirer dependency is not pinned, so future installations may resolve to different package contents than expected. This undermines reproducibility and increases the attack surface for dependency confusion, compromise, or newly introduced vulnerabilities in upstream releases.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json
"commander": "^11.0.0",
    "chalk": "^5.3.0",
    "ora": "^7.0.0",
    "inquirer": "^9.2.0"
  },
  "engines": {
    "node": ">=18.0.0"

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file presents its core instructional content in Chinese only, which imposes a specific language on users without offering a choice or explaining a locale-specific requirement. This matches the language/locale policy concern for natural-language content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file contains natural-language content where the surrounding skill guidance is in Chinese, but the actual user-facing template is fixed in English. Because the file does not offer a language option or explain that English is required for a specific audience, it may violate language/locale policy expectations requiring user choice or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file’s surrounding instructions are in Chinese, but the actual client-facing template is hard-coded in English. This can amount to a language/locale policy issue because it implicitly forces a specific output language without documenting user choice or opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.