ClawHub
Back to skill

Security audit

Cocktail Craft

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent cocktail reference pack, but its unverified remote install instructions and some high-risk alcohol-preparation guidance need review before use.

Review the package contents before installing, and avoid the README's mutable GitHub main-branch install flow unless you pin and verify the exact revision. Treat the recipe content as for legal-age users only, add your own safety checks for high-proof alcohol, heat, pressure equipment, allergens, and sensitive botanicals, and do not rely on it as professional food-safety or medical advice.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:31
Finding

Unpinned Skill Installation from a Mutable Personal Repository

Content
View full analysis

Vulnerability Details

File Location: README.md:31 and README.md:55
Vulnerability Type: Supply-chain risk from an unpinned remote Skill package
Risk Level: Medium

Vulnerable Code

sh
curl -L -o cocktail-craft.zip https://github.com/makishimatouri/COCKTAIL/archive/refs/heads/main.zip
sh
git clone https://github.com/makishimatouri/COCKTAIL.git ~/.openclaw/workspace/skills/cocktail-craft

Technical Analysis

Both documented installation methods retrieve the Skill from the mutable main branch of a personal GitHub repository. Neither method pins a reviewed commit or version, verifies a cryptographic checksum, nor validates a release signature.

The downloaded archive is not directly executed, and the repository contains no scripts or executable code in the audited version. Therefore, this is not a confirmed direct remote-code-execution mechanism. Nevertheless, installing remotely retrieved content into an Agent's Skill directory creates a supply-chain trust boundary: the content installed later may differ from the content reviewed during this audit.

A malicious repository update could replace SKILL.md, add scripts, or introduce hostile instructions. Once installed in an Agent Skill directory, such content may be loaded in later sessions and receive access to whatever tools and permissions the host Agent grants to installed Skills.

Attack Path

  1. An attacker compromises the repository owner account, repository credentials, or another mechanism capable of modifying the main branch.
  2. The attacker adds malicious Skill instructions or executable components to the repository.
  3. A user sends the README's installation prompt to an Agent, or manually runs one of the documented commands.
  4. The command retrieves the attacker's current main branch without verifying that it matches an audited revision.
  5. The retrieved content is moved or cloned into a persistent Agent Skill direc ...[truncated 851 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin installation instructions to a specific reviewed commit hash rather than main.
  2. Prefer versioned, immutable release archives over branch archives.
  3. Publish a SHA-256 checksum through a trusted channel and require verification before extraction or installation.
  4. If releases are signed, verify the maintainer's signature and document the expected signing identity.
  5. Clone without automatically activating the Skill, inspect the checked-out revision, and only then move it into the active Skill directory.
  6. Extract archives into a newly created temporary directory and verify that paths remain within that directory before moving files.
  7. Document the exact expected file inventory and reject unexpected scripts, binaries, symbolic links, or additional instruction files.
  8. For automated installers, enforce an allowlisted repository origin and immutable revision, then display the resolved commit before activation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (19)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The vermouth section instructs users to combine wine and aromatics and 'slow cook' at 52°C for 2 hours before adding spirits, but the presentation is ambiguous and lacks an explicit warning not to heat alcohol directly or use open flame. In a home setting, readers may misapply the process to alcohol-containing mixtures, creating significant fire and vapor hazards.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The primary descriptive text is written in Chinese, and the file does not indicate that language selection is optional or that the skill is intended only for a Chinese-speaking audience. Under the policy, forcing a specific language without opt-in can be a locale/language policy issue.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The README contains a direct curl download from GitHub followed by installation into an agent skill path, which is an external transmission and remote supply-chain intake point. In the context of agent skills, this is more dangerous than ordinary documentation because users are encouraged to paste the commands into AI-assisted environments that may execute them with limited scrutiny, allowing tampered upstream content to be installed and later invoked automatically.

Content

Scanner excerpt · README.md (reported line 31)May include surrounding context.

md
请安装 Cocktail Craft skill：

# 下载
curl -L -o cocktail-craft.zip https://github.com/makishimatouri/COCKTAIL/archive/refs/heads/main.zip

# 解压
unzip cocktail-craft.zip -d /tmp/cocktail-craft

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README says the skill auto-triggers whenever a user discusses cocktail recipes, bartending techniques, or liquor history, but it does not define specific invocation phrases, scope boundaries, or exclusion examples. This is broad natural-language matching that could cause unintended activation during general conversation about drinks rather than deliberate skill use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
77% confidence
Finding

The manifest description is entirely in Chinese and the document's operational rules are written as mandatory instructions for the skill, but there is no indication that users may choose another language. The policy requires flagging language or locale constraints when a specific language is effectively forced without opt-in or justification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest trigger list is composed of broad topical categories rather than precise invocation criteria, making the skill eligible for many loosely related requests. This increases accidental activation and can steer the agent into using this skill when not needed, enlarging the attack surface and creating response-quality and precedence problems.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The rule requires the skill to load its reference set for any cocktail-related question, which creates an extremely broad activation condition tied to a common topic domain rather than a narrow user intent. In an agent environment, this can cause unnecessary skill invocation, increase prompt/context hijacking surface from bundled reference content, and override more appropriate general responses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file provides detailed alcoholic drink recipes and advanced preparation techniques but contains no health, legal-age, moderation, allergy, or pregnancy/driving warning. In a consumer-facing skill, omission of basic safety guidance can contribute to misuse or unsafe consumption, especially because the content is instructional and normalized throughout.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The title and the document content are written in Chinese, and the file provides no indication that language selection is optional or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The file gives actionable instructions for infusing ingredients in very high-proof alcohol (>50% ABV, including Everclear/151 rum) but does not warn about flammability, ventilation, safe storage, or keeping such solvents away from heat/open flame. In a consumer cocktail skill, omission of those precautions creates a realistic risk of fire, accidental misuse, or unsafe handling by non-expert users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The ingredient list recommends cinchona bark and wormwood without any caution that these are potentially sensitive botanicals: cinchona contains quinine, which may be unsuitable for some users, and wormwood can be problematic if misused or overconsumed. In a recipe-oriented skill aimed at general users, presenting them without dosage, sourcing, or sensitivity warnings can lead to avoidable health risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document title and all instructional content are written exclusively in Chinese, with no indication that the skill supports other languages or that Chinese is a required locale for a region-specific purpose. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The installation block instructs an agent to download remote content and move it into privileged skill directories, but it does not include integrity verification, pinning to a specific commit, or a clear warning that this performs network and filesystem changes. In an agent setting, such copy-paste install instructions can lead to unreviewed code ingestion and persistence, increasing supply-chain and accidental execution risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

The natural-language content is presented exclusively in Chinese, with no indication that the user can choose another language or that the file is intentionally limited to a Chinese-speaking audience. This can violate a language/locale policy when a skill forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

This markdown file is entirely written in Chinese, with no indication that language selection is optional or that the skill is region-specific. Under the policy check for language/locale, presenting the skill content in a single language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

该 markdown 明确将 Liquor.com 描述为“首选的英文站点”，并给出固定英文搜索模板，属于自然语言层面的语言偏好约束。文档未向用户提供语言选择、替代语言来源，或说明为何必须使用英文，因此符合语言/locale policy violation 的判定条件。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

该技能文件的标题与全部说明内容均为中文，没有看到提供多语言选项、用户选择机制，或说明该技能仅面向特定中文使用场景。按照语言/locale 政策，这种未声明理由的单一语言强制可能构成自然语言策略违规。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file content is written in Chinese throughout, with no indication that the skill supports other languages or that Chinese is a required locale. Under the policy rule, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This markdown file contains user-facing natural language exclusively in Chinese, including headings, instructions, and lookup guidance. Under the policy rule for language or locale constraints, forcing a single language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.