ClawHub
Back to skill

Security audit

Tweet Humanizer

Security checks for vulnerabilities and agentic risk

Overview

This is a text-only tweet editing skill with no executable payload, but its metadata is inconsistent about network access and Ollama use.

Reasonable to install for manual tweet editing, but review the metadata first: it should ideally have one authoritative front matter block and should not request general outbound network access unless the Ollama/local model behavior is clearly documented and scoped.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Note
Location
SKILL.md:1
Finding
Conflicting Metadata Grants Unnecessary Outbound Network Access<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:1-16` and `SKILL.md:36-62` **Vulnerability Type**: Excessive permission declaration and conflicting security metadata **Risk Level**: Low ### Vulnerable Code ```yaml --- name: tweet-humanizer version: 1.0.3 description: 'QA pass to catch and fix AI-pattern tells in tweets before publishing. Scans for: uniform sentence length, missing contractions, over-punctuation, and generic hooks. Use after Sara or any agent drafts tweet content.' metadata: openclaw: emoji: ✍️ network: outbound: true reason: May call local Ollama API for style checking. requires: bins: - ollama --- ``` A second metadata-like block contradicts the effective front matter: ```yaml --- name: tweet-humanizer version: 1.0.1 description: | Detect and fix AI-generated tweet patterns to make tweets sound like a real human typed them. Covers cadence uniformity, punchline addiction, missing casual markers, emoji absence, over-polished phrasing, and other tells specific to short-form social media. Works on single tweets or batches. Companion to the long-form "humanizer" skill. author: nissan homepage: https://github.com/reddinft/skill-tweet-humanizer license: MIT tags: - writing - social-media - twitter - humanizer - content requires: env: [] bins: [] metadata: openclaw: primaryEnv: none network: outbound: false --- ``` ### Technical Analysis The authoritative front matter at the beginning of the file declares unrestricted outbound network access and an Ollama binary requirement. The documented skill behavior only analyzes and rewrites supplied tweet text; it does not define an Ollama command, API endpoint, network protocol, or other operation that requires outbound connectivity. The stated reason refers to a local Ollama API. Communication with a service bound to the loopback interface does not justify general outbound network access. Granting broader ...[truncated 2176 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Consolidate all package metadata into a single authoritative YAML front matter block. 2. Set `metadata.openclaw.network.outbound` to `false`, because the documented tweet-rewriting workflow does not require external connectivity. 3. Remove the `ollama` binary requirement unless the skill implements and documents an actual Ollama integration. 4. If Ollama is legitimately required, replace unrestricted outbound permission with a runtime policy limited to loopback addresses and the exact Ollama port. 5. Document the precise API endpoint, request fields, response handling, timeout, and data transmitted to Ollama. 6. Ensure tweet content and other potentially sensitive input cannot be sent to external hosts. 7. Add automated validation that rejects duplicate metadata blocks and detects contradictions between declared dependencies and network permissions. 8. Keep the version number and all capability declarations consistent in the single canonical metadata block. ]]>

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Low
Confidence
90% confidence
Finding
The commented documentation states that Sara owns the insight-to-social and blog-to-social pipelines and that tweet-humanizer is not a pipeline step. This conflicts with the active manifest description, which presents the skill as a post-draft QA pass to use after another agent drafts tweet content.

Static analysis

No suspicious patterns detected.