Security audit

advanced-skill-creator

Security checks for vulnerabilities and agentic risk

Overview

The skill is not obvious malware, but it should be reviewed because it tells agents to add broad system-prompt and memory-style instructions into skills they generate.

Review before installing. The external API and research behavior are mostly disclosed, but generated skills should be checked manually to remove generic 'You are now...' role prompts, memory-system directives, and unrelated cognitive-framework language before installation or publication.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

Location: skill.md:148
Finding: Mandatory Downstream System-Prompt Injection in Generated Skills
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The activation condition is overly broad and can trigger on generic phrases related to writing or creating skills. This is dangerous because it increases unintended invocation of a powerful skill that may perform external research, use third-party AI services, and shape outputs in ways the user did not explicitly request.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · skill.md (reported line 3)May include surrounding context.
md
--- name: advanced-skill-creator description: Advanced OpenClaw skill creation handler that executes the official 5-step research flow with comprehensive analysis and best practices. Ensures proper methodology when users request to create or modify OpenClaw/Moltbot/ClawDBot skills following official standards. when: "When user mentions '写一个触发', '写skill', 'claw skill', 'openclaw skill', 'moltbot skill', '创建技能', '写一个让它...', or any request related to creating or modifying Claw系 skills" examples: - "写一个触发监控系统"

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest describes a handler that ensures proper methodology for creating or modifying OpenClaw-family skills. However, the documented behavior explicitly routes content through the SkillBoss API Hub /v1/pilot endpoint, introducing external AI-powered generation rather than just enforcing a local 5-step standards workflow.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The repeated broad trigger guidance reinforces ambiguous activation boundaries without meaningful constraints. In context, that makes the skill more dangerous because accidental routing into this skill can expose conversations to unnecessary external lookup and prescriptive output behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest centers on following official standards and the official 5-step research flow for skill creation. The file also requires searching GitHub, blogs, Reddit, and X for best practices, which expands the behavior into broad open-ended internet research not conveyed by the manifest description.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file requires outputs to use the exact headings 【最终推荐方案】, 【文件结构预览】, 【完整文件内容】, which imposes a specific language and locale format on all users. There is no opt-in, language selection, or justification that the skill is intended only for a Chinese-language environment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs inclusion of system-prompt elements and a cognitive framework unrelated to the core task of creating OpenClaw skills. This is dangerous because it encourages hidden instruction injection into generated artifacts, expanding control over downstream model behavior and creating a channel for policy bypass or stealthy prompt manipulation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.