Content Research - MCB AI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:57 AM UTC
• Version: 1.0.0

Overview

The skill has a legitimate research purpose, but it uses an unsafe shell-based Tavily workflow that reads a shared secret file and interpolates user input into PowerShell.

Install only if you are comfortable with research queries going to Brave and Tavily, and avoid using the documented PowerShell template as written. Prefer a version-pinned installer, a managed Tavily secret, and a structured API call that passes the topic as data rather than executable shell text.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:110

Finding

PowerShell Command Injection Through an Untrusted Research Topic

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Mutable Unpinned Package Is Downloaded and Executed During Installation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:110

Finding

Skill Reads the Entire Shared OpenClaw Secret File to Obtain One API Key

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 46)May include surrounding context.

Tavily — thêm vào file .env của OpenClaw:

text

# File: ~/.openclaw/.env
TAVILY_API_KEY=tvly-your-key-here

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The PowerShell snippet reads TAVILY_API_KEY directly from a local .env file under the user's profile, which is explicit credential access. This unnecessarily teaches the skill to inspect local secret material and creates a path for broader secret harvesting or accidental leakage, especially because the credential is then used in an outbound API request.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

Query 1 — General:

powershell

$env:TAVILY_API_KEY = (Get-Content "$env:USERPROFILE\.openclaw\.env" | Select-String "TAVILY_API_KEY" | ForEach-Object { $_ -replace "TAVILY_API_KEY=", "" })

$body = @{
  api_key = $env:TAVILY_API_KEY.Trim()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README states that the skill sends searches to Brave Search and Tavily in parallel, but it does not warn users that their queries and possibly contextual data will be transmitted to third-party services. This creates a privacy and data-handling risk, especially if users research sensitive business, personal, or confidential topics assuming processing is local.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The invocation examples use broad, natural-language trigger phrases like 'Research chủ đề' and 'Tìm bài về...' without clearly constraining when the skill should activate or what user consent boundaries apply. In an agentic environment, vague activation criteria can cause over-triggering, unexpected web queries, and unintended disclosure of user topics to external search providers.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest says to use the skill whenever the user wants articles, news, blog posts, trending content, or wants to gather data before writing, and includes broad trigger phrases like "research topic" and "search for content." This trigger scope is expansive and lacks exclusion conditions or negative examples, increasing the chance of unintended invocation during ordinary content-planning conversations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill describes pulling an API key from a local env file and sending user queries to Tavily without an explicit user-facing disclosure about credential use and third-party transmission. This creates a transparency and consent gap and can surprise users or operators about where data goes and which secrets are being accessed.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

Tavily API Call

text

POST https://api.tavily.com/search
Headers: Content-Type: application/json
Body:
{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Tavily API Call

text

POST https://api.tavily.com/search
Headers: Content-Type: application/json
Body:
{

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

Tavily API Call

text

POST https://api.tavily.com/search
Headers: Content-Type: application/json
Body:
{

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md

- User wants to research a topic before writing content
- User needs to find recent articles, news, or data about a subject
- User wants to discover trending content sources for LinkedIn/social media
- User needs to curate sources for a toplist, POV, case study, or how-to post

## Core Workflow

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs reading a local secret file (~/.openclaw/.env) and moving the extracted API key into process environment state for use in outbound requests. For a content-research skill, direct local secret-file access is unnecessary and expands the skill's authority beyond user-supplied research actions, increasing the chance of credential exposure or misuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.