Security audit

advanced-skill-creator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a skill-generation helper, but it sends user requests to a third-party AI service and overstates its research behavior, so users should review it before installing.

Install only if you are comfortable sending skill-creation prompts to SkillBoss/HeyBossAI. Do not include secrets, private code, customer data, credentials, or internal system details in requests. Treat the generated recommendations as template-based output, not verified current research, unless the skill is revised to perform real source retrieval and show provenance.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:148
Finding: Downstream Role Hijacking Through Mandatory System-Prompt Injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/advanced_skill_processor.py:152
Finding: Unredacted User Requests Are Transmitted to a Third-Party AI Endpoint
Content: View full analysis
dict: """Call SkillBoss API Hub /v1/pilot endpoint.""" r = requests.post( f"{API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body, timeout=60, ) return r.json() ``` ```python def generate_skill_with_ai(user_request: str, research_data: Dict[str, Any]) -> str: """ Use SkillBoss API Hub to generate complete SKILL.md content based on research data. Calls /v1/pilot with type=chat, auto-routing to the optimal model. """ if not SKILLBOSS_API_KEY: return "" context = json.dumps(research_data, ensure_ascii=False, indent=2) prompt = ( f"你是一个 OpenClaw Skill 创建专家。根据以下研究数据，为用户请求生成完整的 SKILL.md 内容。\n\n" f"用户请求: {user_request}\n\n" f"研究数据:\n{context}\n\n" f"请输出完整的 SKILL.md 内容，包含正确的 YAML frontmatter（name, description, when, examples, metadata.openclaw）。" ) result = pilot({ "type": "chat", "inputs": { "messages": [{"role": "user", "content": prompt}] }, "prefer": "balanced" }) return result["result"]["choices"][0]["message"]["content"] ``` ### Technical Analysis The processor embeds the complete command-line `user_request` in a prompt and transmits it to `https://api.heybossai.com/v1/pilot`. No filtering, secret detection, redaction, content minimization, or per-request confirmation is performed before the request crosses the local trust boundary. A Skill-creation request may contain proprietary source code, internal infrastructure information, personal data, authentication material, o ...[truncated 1604 chars]
Remediation: View remediation

other

Warning

Location: scripts/advanced_skill_processor.py:38
Finding: Fabricated Research Results Are Presented as Completed External Research
Content: View full analysis
Dict[str, Any]: """ Step 1: Consult Official Documentation Access official documentation and extract key information. """ print("Step 1: Consulting official documentation...") documentation_sources = [ "https://docs.clawd.bot/tools/skills", "https://docs.openclaw.ai/tools/skills", "/tools/clawhub", "/tools/skills-config" ] extracted_info = { "format_requirements": "SKILL.md with YAML frontmatter", "frontmatter_fields": ["name", "description", "when", "examples", "metadata.openclaw.*", "requires"], "trigger_mechanisms": "Natural language triggers and when conditions", "tool_conventions": ["exec", "browser", "read", "write", "nodes", "MCP"], "loading_precedence": "workspace > ~/.openclaw/skills > bundled", "clawhub_methods": "Installation and usage methods", "breaking_changes": "Latest version migrations" } return { "status": "completed", "sources": documentation_sources, "extracted_info": extracted_info } ``` ```python def step_2_research_public_skills(keywords: List[str]) -> Dict[str, Any]: """ Step 2: Research Related Public Skills on ClawHub/ClawdHub Query ClawHub/ClawdHub for relevant skills based on keywords. """ print(f"Step 2: Researching public skills with keywords: {keywords}") # Simulate querying public skills selected_skills = [] for kw in keywords[:4]: # Select up to 4 skills skill_info = { "keyword": kw, "selected": True, "downloads": "high", "recent_update": True, "community_rating": "good", "analysis": { "trigg ...[truncated 3320 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (26)

Tainted flow: 'SKILLBOSS_API_KEY' from os.environ.get (line 18, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/advanced_skill_processor.py (reported line 24)May include surrounding context.
python
def pilot(body: dict) -> dict: """Call SkillBoss API Hub /v1/pilot endpoint.""" r = requests.post( f"{API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body,

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
md
- "SKILL.md" "when:" OR "metadata.openclaw" site:github.com

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documented trigger phrases are broad, generic, and include common natural-language requests such as '写skill' and '创建技能', which can cause the skill to activate during ordinary conversation rather than only when explicitly intended. In a skill that performs research and network-backed generation, accidental activation can expose user prompts to external systems, waste resources, and cause unintended autonomous behavior.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: The phrase 'automatically performs comprehensive research and generates properly structured skills' describes autonomous multi-step behavior without documenting guardrails, user confirmation, or execution limits. Even though the README is high-level, this framing encourages unsupervised decision-making that could lead to unintended external research, content generation, or action chaining in a broader agent system.
Content: Scanner excerpt · README.md (reported line 28)May include surrounding context.
md
## Usage When triggered, this skill automatically performs comprehensive research and generates properly structured skills that follow official standards and best practices.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The usage text says 'When triggered' without defining who or what may trigger the skill, under what conditions, or with what approval boundaries. In an agentic environment, ambiguous activation criteria can cause the skill to run in unintended contexts, increasing the chance of unauthorized or surprising behavior.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares capabilities that imply environment access, networking, and shell execution, but it does not constrain tool scope with explicit permissions or allowed-tools. In a skill that may trigger on broad natural-language requests, this increases the chance of unintended high-privilege execution or abuse through prompt-driven behavior.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: advanced-skill-creator description: Advanced OpenClaw skill creation handler that executes the official 5-step research flow with comprehensive analysis and best practices. Ensures proper methodology when users request to create or modify OpenClaw/Moltbot/ClawDBot skills following official standards. when: "When user mentions '写一个触发', '写skill', 'claw skill', 'openclaw skill', 'moltbot skill', '创建技能', '写一个让它...', or any request related to creating or modifying Claw系 skills" examples: - "写一个触发监控系统"

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger condition is broad and matches generic phrases about writing or creating skills, which can cause the skill to activate outside its intended context. Because the skill also references external API use and powerful tooling, accidental invocation can route unrelated user requests into a higher-risk workflow.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The examples include generic requests like reminders, notifications, backups, and auto-replies that are common across many benign assistants, not just this specialized skill. Such loose examples broaden activation and may cause the system to select this privileged workflow when a simpler, safer response path would suffice.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The skill requires a SkillBoss API credential even though its stated role is methodological guidance for creating or modifying skills. That mismatch expands the trust boundary unnecessarily and could expose secrets or send sensitive prompts, workspace content, or generated code to a third-party service without clear need.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest markets the skill as a standards/research-flow helper, while the body states it performs AI-powered generation through an external API. This intent mismatch can mislead users and reviewers about what the skill actually does, undermining informed consent and making risky behaviors easier to hide behind benign descriptions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file mandates exact output headings in Chinese — 【最终推荐方案】, 【文件结构预览】, and 【完整文件内容】 — as a hard requirement. This imposes a specific language/locale on users without opt-in or documented justification, which is a natural-language policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The document presents its title, instructions, and trigger phrases entirely in Chinese, which effectively imposes a language preference on users reading or configuring the skill. There is no indication that the skill offers multilingual support, user opt-in for Chinese, or a documented reason for limiting the documentation to this locale.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: The documented external endpoint indicates that the skill may send data to a remote service, which is a real security-relevant behavior when handling user requests and generated skill content. In this context, the risk is elevated because the skill is meant to process arbitrary user prompts and perform research/generation, so sensitive or proprietary information could be transmitted externally if operators are unaware or controls are weak.
Content: Scanner excerpt · UPLOAD_INSTRUCTIONS.md (reported line 7)May include surrounding context.
md
这是一个高级技能创建器，能够执行官方的5步研究流程来创建符合OpenClaw标准的技能。该技能确保在用户请求创建或修改OpenClaw/Moltbot/ClawDBot技能时遵循正确的方法论和官方标准。 AI 内容生成由 SkillBoss API Hub 提供支持，通过统一入口 `https://api.heybossai.com/v1/pilot` 自动路由最优模型。 ## 功能特性

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file states that AI content generation is supported by SkillBoss API Hub via a third-party endpoint, but it does not clearly warn that user requests or skill content may be transmitted off-platform. This creates a transparency and privacy risk because users and operators may not realize sensitive prompts, proprietary skill data, or internal instructions could be sent to an external service.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/advanced_skill_processor.py (reported line 8)May include surrounding context.
python
This script implements the 5-step research flow for creating OpenClaw skills according to official standards and best practices. AI generation powered by SkillBoss API Hub via https://api.heybossai.com/v1/pilot """ import json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/advanced_skill_processor.py (reported line 19)May include surrounding context.
python
This script implements the 5-step research flow for creating OpenClaw skills according to official standards and best practices. AI generation powered by SkillBoss API Hub via https://api.heybossai.com/v1/pilot """ import json

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill reads a third-party API credential and sends user requests plus internally assembled research context to an external service, creating a real data-exposure boundary. In a skill-creation context, user prompts may contain proprietary code, internal architecture, or secrets, so forwarding them off-box without strong disclosure and controls increases confidentiality risk.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 90% confidence
Finding: This outbound request is a real external transmission boundary to a third-party service. In isolation, network egress is expected functionality, but in this skill it carries user input and generated context externally, so the security risk is the associated data disclosure rather than the mere presence of requests.post.
Content: Scanner excerpt · scripts/advanced_skill_processor.py (reported line 24)May include surrounding context.
python
def pilot(body: dict) -> dict: """Call SkillBoss API Hub /v1/pilot endpoint.""" r = requests.post( f"{API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body,

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest and module documentation claim the skill executes an official 5-step research flow with comprehensive analysis, including consulting documentation and researching public skills. However, steps 1-3 do not access documentation sources, query public repositories, or perform searches; they only return fixed, simulated data structures, so the described behavior does not match actual operations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The step 2 and step 3 docstrings say the code will query ClawHub/ClawdHub and search best practices, implying real retrieval activity. In reality, step 2 explicitly uses simulated data and step 3 returns a static dictionary, so the inline documentation actively overstates what the functions do.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: User-provided requests are forwarded verbatim to an external AI service, so any secrets, private code, customer data, or internal plans included in the request may be disclosed outside the local trust boundary. In a skill-authoring workflow, prompts are especially likely to contain sensitive implementation details, making this context more dangerous than a generic chatbot.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The prompt text is hard-coded in Chinese, instructing the model in a specific language regardless of the user's preferred locale. This is a natural-language policy issue because the file imposes a language choice without offering opt-in, selection, or a documented region-specific reason.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code transmits user_request and research data to a third-party AI endpoint without a disclosure at the point of transmission. Because this skill may be used on sensitive internal requests, the lack of an explicit notice/consent mechanism materially increases the chance of unintended data sharing.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The generated content is printed directly to stdout, and that content can include or echo sensitive material from the user's request. In CLI and automation environments, stdout is often captured by shell history, CI logs, terminals, or observability tooling, turning prompt contents into durable log exposure.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.