ClawHub
Back to skill

Security audit

WebsitePublisher

Security checks for vulnerabilities and agentic risk

Overview

This skill openly uses a WebsitePublisher.ai token to create and manage live website content, which matches its stated purpose.

Install only if you want an agent to publish and update content in your WebsitePublisher.ai project. Review pages, assets, dynamic records, and contact forms before asking for live changes; avoid putting secrets or private drafts into published pages or public MAPI records, and add appropriate privacy or consent language for forms that collect names, emails, or messages.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (18)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README promotes building and publishing live websites and configuring contact forms without any warning about real-world risks such as accidental public exposure, unsafe handling of user-submitted data, or unintended publication of unfinished content. In this skill context, omission matters because the advertised action has immediate external effects on a live URL and may collect personal data via forms.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
76% confidence
Finding

The README describes an agent creating pages, configuring a contact form, and publishing to a live URL, implying actions that may persist externally beyond the immediate session. In this context, persistence is security-relevant because the skill can create lasting public artifacts and data collection endpoints without documenting review gates, rollback expectations, or consent around retained content.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

md
**Example:**
> "Build a portfolio website for my photography business. I want a homepage, a gallery, and a contact page."

Your agent will create all three pages with proper HTML, configure a contact form, and give you a live URL — in minutes.

---

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 70)May include surrounding context.

Or manually place SKILL.md in:

text
~/.openclaw/skills/websitepublisher/SKILL.md

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill promotes publishing live websites and exposes that dynamic data can be served from public endpoints, but it does not clearly warn the user that created pages and some data may become publicly accessible on the internet. That omission can lead to accidental disclosure of sensitive business content, draft material, or structured data that the user did not intend to expose publicly.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

Step 1 — Check existing content

bash
curl -s \
  -H "Authorization: Bearer $WEBSITEPUBLISHER_TOKEN" \
  -H "Accept: application/json" \
  "https://api.websitepublisher.ai/papi/project/$WEBSITEPUBLISHER_PROJECT/status"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

curl -s
-H "Authorization: Bearer $WEBSITEPUBLISHER_TOKEN"
-H "Accept: application/json"
"https://api.websitepublisher.ai/papi/project/$WEBSITEPUBLISHER_PROJECT/status"

text

This returns the project URL, existing pages, and current status. Always do this first.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

curl -s
-H "Authorization: Bearer $WEBSITEPUBLISHER_TOKEN"
-H "Accept: application/json"
"https://api.websitepublisher.ai/papi/project/$WEBSITEPUBLISHER_PROJECT/status"

text

This returns the project URL, existing pages, and current status. Always do this first.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

curl -s
-H "Authorization: Bearer $WEBSITEPUBLISHER_TOKEN"
-H "Accept: application/json"
"https://api.websitepublisher.ai/papi/project/$WEBSITEPUBLISHER_PROJECT/status"

text

This returns the project URL, existing pages, and current status. Always do this first.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

curl -s
-H "Authorization: Bearer $WEBSITEPUBLISHER_TOKEN"
-H "Accept: application/json"
"https://api.websitepublisher.ai/papi/project/$WEBSITEPUBLISHER_PROJECT/status"

text

This returns the project URL, existing pages, and current status. Always do this first.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

curl -s
-H "Authorization: Bearer $WEBSITEPUBLISHER_TOKEN"
-H "Accept: application/json"
"https://api.websitepublisher.ai/papi/project/$WEBSITEPUBLISHER_PROJECT/status"

text

This returns the project URL, existing pages, and current status. Always do this first.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

curl -s
-H "Authorization: Bearer $WEBSITEPUBLISHER_TOKEN"
-H "Accept: application/json"
"https://api.websitepublisher.ai/papi/project/$WEBSITEPUBLISHER_PROJECT/status"

text

This returns the project URL, existing pages, and current status. Always do this first.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

curl -s
-H "Authorization: Bearer $WEBSITEPUBLISHER_TOKEN"
-H "Accept: application/json"
"https://api.websitepublisher.ai/papi/project/$WEBSITEPUBLISHER_PROJECT/status"

text

This returns the project URL, existing pages, and current status. Always do this first.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.

curl -s
-H "Authorization: Bearer $WEBSITEPUBLISHER_TOKEN"
-H "Accept: application/json"
"https://api.websitepublisher.ai/papi/project/$WEBSITEPUBLISHER_PROJECT/status"

text

This returns the project URL, existing pages, and current status. Always do this first.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.

curl -s
-H "Authorization: Bearer $WEBSITEPUBLISHER_TOKEN"
-H "Accept: application/json"
"https://api.websitepublisher.ai/papi/project/$WEBSITEPUBLISHER_PROJECT/status"

text

This returns the project URL, existing pages, and current status. Always do this first.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

Patch a page (partial update — send only changed HTML fragment):

bash
curl -s -X PATCH \
  -H "Authorization: Bearer $WEBSITEPUBLISHER_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

Create an entity (data model)

bash
curl -s -X POST \
  -H "Authorization: Bearer $WEBSITEPUBLISHER_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to configure and deploy a live contact form that collects user-submitted personal data and forwards notifications, but it provides no warning that submissions will be transmitted to a third-party service or become part of an internet-accessible workflow. This creates privacy/compliance risk because users may unknowingly publish a form that collects names, emails, and messages without consent language, retention guidance, or notice about external processing.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 265)May include surrounding context.

Step 1 — Configure the form

bash
curl -s -X POST \
  -H "Authorization: Bearer $WEBSITEPUBLISHER_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json" \

Static analysis

No suspicious patterns detected.