Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Simple query | `SKILL.md` | weather lookup, unit conversion |
Security audit
skill-coach
Security checks for vulnerabilities and agentic risk
Overview
This is a Markdown-only coaching skill for creating OpenClaw skills, with no hidden code, persistence, credential access, or destructive behavior found.
Before installing, be aware that this coach may activate on generic phrases like “create skill” or “build skill,” and review any generated skill files, scripts, tool definitions, or trigger phrases before using them.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Simple query | `SKILL.md` | weather lookup, unit conversion |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Simple query | `SKILL.md` | weather lookup, unit conversion |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Simple query | `SKILL.md` | weather lookup, unit conversion |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | Simple query | `SKILL.md` | weather lookup, unit conversion |
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger phrase on this line is broad enough to overlap with ordinary user requests about creating or packaging a skill, which can cause the skill to activate unintentionally. In a skill-authoring assistant, unintended invocation can hijack unrelated conversations, inject the coach workflow where it was not requested, and increase the chance of prompt/skill interference.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The English triggers 'create skill' and 'build skill' are highly generic commands that are likely to appear in normal conversation, making accidental activation plausible. Because this skill steers the user into a structured authoring flow and influences generated output, unintended invocation can disrupt user intent and create prompt-routing ambiguity across other skills or assistants.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill instructs the agent to generate files and discusses scripts, tools, API calls, and database querying, but it does not require a user-facing safety notice or confirmation before external or filesystem-affecting actions. In context, this coach is specifically designed to produce artifacts and recommend integrations, so missing guardrails materially raises the risk of unintended writes or external operations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The template mandates three trigger keywords but does not require them to be specific, non-overlapping, or bounded by exclusion conditions. This increases the chance of unintended activation collisions with other normal user requests, especially because the same document also teaches broad trigger design patterns.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The trigger guidance explicitly recommends very broad phrases such as "generate report" and "analyze data" without requiring scoping qualifiers, exclusions, or confirmation rules. In a skill-routing environment, overly generic triggers can cause accidental invocation in unrelated conversations, leading the agent to enter a file-generation or tool-using workflow unexpectedly.
- Content
Static analysis
No suspicious patterns detected.