Security audit

Advanced Skill Creator

Security checks for vulnerabilities and agentic risk

Overview

This skill can help generate OpenClaw skills, but it needs review because it sends full requests to a third-party AI service and presents simulated research as completed verification.

Install only if you are comfortable sending skill requests to the SkillBoss API. Do not include secrets, private code, customer data, or internal system details in requests. Treat its research output as a draft, not verified official research, and review any generated system-prompt or memory instructions before publishing or installing generated skills.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:152
Finding: Mandatory Role-Changing Prompt Propagation into Generated Skills
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/advanced_skill_processor.py:18
Finding: Unredacted User Requests Are Transmitted to a Third-Party AI API
Content: View full analysis
dict: """Call SkillBoss API Hub /v1/pilot endpoint.""" r = requests.post( f"{API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body, timeout=60, ) return r.json() ``` ```python def generate_skill_with_ai(user_request: str, research_data: Dict[str, Any]) -> str: """ Use SkillBoss API Hub to generate complete SKILL.md content based on research data. Calls /v1/pilot with type=chat, auto-routing to the optimal model. """ if not SKILLBOSS_API_KEY: return "" context = json.dumps(research_data, ensure_ascii=False, indent=2) prompt = ( f"你是一个 OpenClaw Skill 创建专家。根据以下研究数据，为用户请求生成完整的 SKILL.md 内容。\n\n" f"用户请求: {user_request}\n\n" f"研究数据:\n{context}\n\n" f"请输出完整的 SKILL.md 内容，包含正确的 YAML frontmatter（name, description, when, examples, metadata.openclaw）。" ) result = pilot({ "type": "chat", "inputs": { "messages": [{"role": "user", "content": prompt}] }, "prefer": "balanced" }) return result["result"]["choices"][0]["message"]["content"] ``` ### Technical Analysis The complete `user_request` is interpolated into a prompt and sent to `https://api.heybossai.com/v1/pilot`. The generated research context is transmitted in the same request. No secret detection, redaction, data classification, size limitation, or per-request confirmation occurs before transmission. The API integration and required API key are disclosed in `SKILL.md` and `UPLOAD_INSTRUCTIONS.md`; therefore, the behavior is not ...[truncated 1915 chars]
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Warning

Location: scripts/advanced_skill_processor.py:34
Finding: Simulated Research Is Presented as Completed External Verification
Content: View full analysis
Dict[str, Any]: """ Step 1: Consult Official Documentation Access official documentation and extract key information. """ print("Step 1: Consulting official documentation...") documentation_sources = [ "https://docs.clawd.bot/tools/skills", "https://docs.openclaw.ai/tools/skills", "/tools/clawhub", "/tools/skills-config" ] extracted_info = { "format_requirements": "SKILL.md with YAML frontmatter", "frontmatter_fields": ["name", "description", "when", "examples", "metadata.openclaw.*", "requires"], "trigger_mechanisms": "Natural language triggers and when conditions", "tool_conventions": ["exec", "browser", "read", "write", "nodes", "MCP"], "loading_precedence": "workspace > ~/.openclaw/skills > bundled", "clawhub_methods": "Installation and usage methods", "breaking_changes": "Latest version migrations" } return { "status": "completed", "sources": documentation_sources, "extracted_info": extracted_info } ``` ```python def step_2_research_public_skills(keywords: List[str]) -> Dict[str, Any]: """ Step 2: Research Related Public Skills on ClawHub/ClawdHub Query ClawHub/ClawdHub for relevant skills based on keywords. """ print(f"Step 2: Researching public skills with keywords: {keywords}") # Simulate querying public skills selected_skills = [] for kw in keywords[:4]: # Select up to 4 skills skill_info = { "keyword": kw, "selected": True, "downloads": "high", "recent_update": True, "community_rating": "good", "analysis": { ...[truncated 4057 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (24)

Tainted flow: 'SKILLBOSS_API_KEY' from os.environ.get (line 18, credential/environment) → requests.post (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/advanced_skill_processor.py (reported line 24)May include surrounding context.
python
def pilot(body: dict) -> dict: """Call SkillBoss API Hub /v1/pilot endpoint.""" r = requests.post( f"{API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body,

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The top-level trigger condition is extremely broad and can activate on many generic requests related to writing or modifying skills. Overbroad auto-activation is dangerous because it can hijack unrelated conversations, cause unintended execution paths, and increase the chance that sensitive user content is processed by this skill and its external integrations.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill states that AI-assisted generation is powered by an external SkillBoss API endpoint but does not warn users that their prompts or project data may be transmitted off-platform. This creates a clear data-handling and consent issue, especially if users provide proprietary code, secrets, or internal requirements during skill creation.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.
md
- "SKILL.md" "when:" OR "metadata.openclaw" site:github.com

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The custom script description advertises automated documentation queries, public research, and external API-based generation without any privacy notice or data-minimization language. Because the workflow is designed to ingest user requests and potentially workspace context, silent external transmission could expose sensitive information beyond the user's expectations.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 86% confidence
Finding: The phrase 'automatically performs comprehensive research and generates properly structured skills' indicates autonomous multi-step behavior without any mention of user confirmation, approval gates, or bounded scope. In a skill-creation context, this can lead an agent to independently gather external information and produce or modify code-like artifacts, which raises the risk of overreach, unintended actions, and propagation of unsafe content into generated skills.
Content: Scanner excerpt · README.md (reported line 28)May include surrounding context.
md
## Usage When triggered, this skill automatically performs comprehensive research and generates properly structured skills that follow official standards and best practices.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The usage text says 'When triggered' without defining who or what triggers the skill, creating an ambiguous activation boundary. In an agent ecosystem, unclear invocation conditions can cause the skill to run in unintended contexts, increasing the chance of unnecessary external research, unintended modifications, or misuse by other components.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares access to environment variables, shell binaries, and implicitly networked API usage, but it does not define an explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it easier for the skill to gain broader execution capability than users or the host may expect.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.
md
--- name: advanced-skill-creator version: "1.0.0" description: Advanced OpenClaw skill creation handler that executes the official 5-step research flow with comprehensive analysis and best practices. Ensures proper methodology when users request to create or modify OpenClaw/Moltbot/ClawDBot skills following official standards. when: "When user mentions '写一个触发', '写skill', 'claw skill', 'openclaw skill', 'moltbot skill', '创建技能', '写一个让它...', or any request related to creating or modifying Claw系 skills" examples: - "写一个触发监控系统"

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The repeated 'when to use' guidance reinforces broad trigger matching without boundaries, which increases the likelihood of accidental invocation. In a skill that performs research and external API-backed generation, unnecessary activation expands both operational and privacy risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document requires outputs to use the exact headings '【最终推荐方案】, 【文件结构预览】, 【完整文件内容】', which imposes a Chinese output format regardless of user preference. No opt-in, multilingual alternative, or region-specific justification is provided.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: The file explicitly references an external API endpoint used for AI content generation, confirming that skill data may be transmitted to a third-party service. In this skill’s context, that is more sensitive because the tool is intended to process user requests and potentially synthesize skill content derived from local or user-provided material, which may expose proprietary or sensitive data externally.
Content: Scanner excerpt · UPLOAD_INSTRUCTIONS.md (reported line 7)May include surrounding context.
md
这是一个高级技能创建器，能够执行官方的5步研究流程来创建符合OpenClaw标准的技能。该技能确保在用户请求创建或修改OpenClaw/Moltbot/ClawDBot技能时遵循正确的方法论和官方标准。 AI 内容生成由 SkillBoss API Hub 提供支持，通过统一入口 `https://api.heybossai.com/v1/pilot` 自动路由最优模型。 ## 功能特性

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation states that content generation is handled through an external API and requires an API key, but it does not clearly warn users what data may be transmitted off-system. For a skill that processes user requests to create or modify skills, prompts, metadata, and possibly sensitive workspace content could be sent to a third party without informed consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented auto-trigger phrases are broad and overlap with ordinary user conversation, which can cause the skill to activate unintentionally. In a skill that may perform network-backed research and content generation, accidental invocation increases the chance of unnecessary data processing, confusing behavior, and unreviewed outbound requests.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/advanced_skill_processor.py (reported line 8)May include surrounding context.
python
This script implements the 5-step research flow for creating OpenClaw skills according to official standards and best practices. AI generation powered by SkillBoss API Hub via https://api.heybossai.com/v1/pilot """ import json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/advanced_skill_processor.py (reported line 19)May include surrounding context.
python
This script implements the 5-step research flow for creating OpenClaw skills according to official standards and best practices. AI generation powered by SkillBoss API Hub via https://api.heybossai.com/v1/pilot """ import json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: The code makes an outbound request to a third-party service, which is a genuine external-transmission behavior. In this skill's context, the request can carry user prompts and research data, making the network egress security-relevant because it may move sensitive content outside the local trust boundary.
Content: Scanner excerpt · scripts/advanced_skill_processor.py (reported line 24)May include surrounding context.
python
def pilot(body: dict) -> dict: """Call SkillBoss API Hub /v1/pilot endpoint.""" r = requests.post( f"{API_BASE}/pilot", headers={"Authorization": f"Bearer {SKILLBOSS_API_KEY}", "Content-Type": "application/json"}, json=body,

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest and module docstring describe a handler that executes the official 5-step research flow with comprehensive analysis, but steps 1-3 do not fetch or inspect external documentation or public skills. Instead, they return hard-coded sources, extracted information, and mock research results, so the implemented behavior is a template generator with canned data rather than an actual research workflow.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The docstrings for steps 1 and 2 explicitly say the code will access official documentation and query ClawHub/ClawdHub, but the implementation only constructs static lists and fabricated analysis objects. This is an active contradiction between the inline intent documentation and what the code actually does.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest says the skill handles requests to create or modify OpenClaw/Moltbot/ClawDBot skills, yet the code only produces generated SKILL.md content in memory and prints it. There is no code to inspect an existing skill, diff it, or apply modifications to existing files, so the actual capability is narrower than the stated behavior.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: User-supplied requests are embedded verbatim into a prompt sent to a third-party LLM, and the resulting content is printed back to stdout. This creates a straightforward natural-language exfiltration path for sensitive content provided by the user, and the skill context increases risk because skill requests may include internal scripts, credentials pasted for debugging, or proprietary workflow details.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The hard-coded prompt text is entirely in Chinese and instructs the model in that language regardless of the user's preference or locale. This imposes a specific language choice without offering an opt-in or selection mechanism.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script transmits the user's request and aggregated research context to an external LLM service without an explicit user-facing disclosure or consent at the call site. In a skill-creation context, user requests may contain proprietary code, internal architecture, secrets, or sensitive business requirements, so silent exfiltration to a third party creates a real confidentiality risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file presents all user-facing instructions in Chinese, which effectively forces a specific language for users reading or following the skill documentation. The document does not offer an alternative language, opt-in choice, or explain that the skill is intentionally limited to a Chinese-speaking audience.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.