T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/build-claw-xiaoai-prompt.mjs:6- Finding
Raw User Requests Persisted in Plaintext Without Minimum-Permission Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
Claw Xiaoai
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent as a character selfie generator, but it quietly saves recent user request details locally and exposes broad file-write behavior that should be reviewed before install.
Install only if you are comfortable with a persona skill that sends image prompts to ModelScope, saves continuity state under ~/.openclaw, and may generate images from broad conversational triggers; prefer clearing the state file, using narrowly scoped output paths, and avoiding private details in selfie requests.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate-selfie.mjs:14- Finding
Unrestricted Output Path Allows Overwriting Arbitrary User-Writable Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md printf '%s' "<prompt>" | node scripts/generate-selfie.mjs --prompt-stdin --out /tmp/claw-xiaoai-selfie.jpg
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md printf '%s' "<prompt>" | node scripts/generate-selfie.mjs --prompt-stdin --out /tmp/claw-xiaoai-selfie.jpg
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md printf '%s' "<prompt>" | node scripts/generate-selfie.mjs --prompt-stdin --out /tmp/claw-xiaoai-selfie.jpg
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md printf '%s' "<prompt>" | node scripts/generate-selfie.mjs --prompt-stdin --out /tmp/claw-xiaoai-selfie.jpg
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
js const sceneTag=detectSceneTag(text); const mappedScene=sceneTag ? PROMPT_SCENE_BY_TAG[sceneTag] : undefined; if(mappedScene) return mappedScene; if(slotInfo.slot === 'weekend-day' && isWeekend) return PROMPT_SCENE_BY_TAG[resolveWeekendDaySceneTag(hour, text)]; if(hasRelativeInstruction(text)) return state.scene || slotInfo.scene; return slotInfo.scene; }
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The retry prompt hard-codes a protected/sensitive demographic attribute ('East Asian ethnicity') and gender constraints into image-generation instructions. This is dangerous because it bakes demographic profiling and identity coercion into outputs without user awareness, increasing the risk of biased, non-consensual, or discriminatory content generation, especially in a persona-based companion skill.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 94% confidence
- Finding
The skill documents access to environment variables, local config, and a network-backed image generation flow, but it does not declare an explicit tool/permission scope. That creates an authorization transparency gap: a host or reviewer cannot easily tell what capabilities the skill expects, making overbroad execution or accidental secret exposure more likely.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger mapping uses broad conversational phrases like 'What are you doing?' and 'Where are you?' to initiate photo/selfie behavior, which can cause the agent to generate and send images when the user may only want a text response. In a companion persona that simulates current activity, location, outfit, or mood, this increases the risk of unintended media generation and deceptive or privacy-sensitive behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The instruction to "Prefer clean English prompt blocks for persona definitions" imposes a language preference as a policy choice in the skill's natural-language guidance. The file does not offer the user a language choice or explain why English is required for a region-specific or technical reason.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The examples prescribe output captions entirely in Chinese, while the file presents them as the target caption style without any opt-in or alternative language handling. This creates a natural-language locale policy concern because the skill appears to enforce a specific language rather than letting the user choose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The prompt directs the persona to respond primarily in Chinese regardless of the user's language preference, which can override user intent and reduce transparency or safe use in multilingual contexts. While not a direct security exploit, hard-coded language behavior can degrade user control and make safety-critical guidance less accessible if the user expects another language.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The selfie trigger list is intentionally broad and maps ordinary phrases like 'what are you doing' or 'where are you' to image-generation behavior. In a live agent, this can cause unexpected modality switching and implicit consent issues, where normal conversational prompts are interpreted as requests for personal-looking images or location/context disclosures.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The code loads an API key-backed runtime and makes authenticated requests to a third-party image generation service. For a skill described only as an energetic intern companion, this networked media-generation capability is not an obvious or declared requirement.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest description presents the skill as a character-style companion, not as an image-generation utility. This script submits prompts to a remote image generation API, polls task status, downloads the generated image, and writes it locally, which is a materially different operational scope from a conversational companion description.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The script creates directories and writes the generated image to the filesystem, but provides no prior warning, confirmation, or explanatory comment/docstring about this file write behavior. Under the code-file criteria, file writes should have some visible disclosure unless clearly documented elsewhere in the skill description, which is not present in this file.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script persists conversational and inferred state to a file under the user's home directory without any user-facing notice, consent prompt, or protective controls. Because the saved state includes prior requests, scene, pose, clothing, and timestamps, it creates a privacy risk and unintended retention of potentially sensitive user interaction data on disk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script explicitly uses
Intl.DateTimeFormat('en-GB', ...), which imposes a specific language/locale choice in behavior. Under the policy, locale constraints should be user-selectable or clearly justified as region-specific; neither is indicated here.- Content