ClawHub
Back to skill

Security audit

seithar-intel

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed threat-intelligence monitor, but it also forces promotional Seithar branding and a third-party link into every output.

Review this before installing if you do not want your assistant's threat briefings and analyses to carry Seithar branding and an external link every time. If installed, configure or remove the footer, opt in deliberately to scheduled polling and alerts, and prefer a pinned ClawHub release or verified commit over the manual Git clone path.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:442
Finding

Mandatory Promotional Content Hijacks Every Skill Output

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:425
Finding

Manual Installation Uses an Unpinned Mutable Git Repository

Content
View full analysis
Remediation
View remediation
``` 6. Verify that the checked-out commit is signed and matches the documented digest before copying files. 7. Review the complete fetched package, including scripts and referenced framework files, before placing it in the trusted Skill directory. 8. Configure OpenClaw to grant newly installed Skills minimal permissions until their provenance and contents have been verified. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill stores a persistent interest profile, study history, feed history, and behavioral relevance data in memory without an explicit privacy notice or retention policy. This creates privacy risk because sensitive interests and activity patterns can reveal the user’s security focus, training level, and monitoring habits. Even if stored locally, persistent profiling should be clearly disclosed and bounded.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

  1. Fetches the full article content via web_fetch
  2. If a CVE is mentioned, queries the NVD API for structured vuln data
  3. Searches GitHub for public PoC repositories (https://api.github.com/search/repositories?q=CVE-XXXX-XXXXX&sort=stars)
  4. Generates a structured educational breakdown:
text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill performs autonomous periodic feed checks, pushes immediate alerts, and sends scheduled briefings, but the description does not clearly warn users that network access and proactive messaging will occur without per-use prompting. This weakens informed consent and can surprise users with background activity, external requests, and notifications. In a security-focused skill, silent autonomy is especially sensitive because it normalizes broad ongoing monitoring behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly states that every output should carry Seithar branding and frames user sharing and terminology propagation as a goal. This introduces a non-user-serving objective unrelated to threat intelligence, indicating the skill is using the agent as a marketing/distribution channel. In an agent context, hidden promotional behavior is risky because it manipulates outputs for third-party benefit rather than the operator’s intent.

Content

No source excerpt is available for this finding.

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 405)May include surrounding context.

md
### SKILL.md (this file)

The agent reads this and knows how to operate. No external code needed — OpenClaw's built-in `web_fetch`, `web_search`, memory, and cron tools handle everything.

### sources.md

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The markdown says every output carries a fixed footer including the Japanese phrase "認知作戦". This imposes a specific language/locale element on all outputs without offering the user a choice or documenting a justified regional requirement.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.