Security audit

writing-coach-pro

Security checks across malware telemetry and agentic risk

Overview

This writing coach is purpose-aligned, but it keeps long-term writing data and can sync writing statistics to a dashboard by default without enough clear consent or retention controls.

Review this before installing if you handle confidential drafts. Use it only if you are comfortable with local writing-history storage, check whether dashboard sync can be disabled, and inspect or clear ~/.openclaw/skills/writing-coach-pro/data when needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill exposes shell-script execution hooks (`export-report.sh` and `style-check.sh`) even though the skill is primarily a writing-analysis tool. If those commands are invoked on untrusted input or implemented unsafely, they expand the attack surface from text processing into local command execution and file-system access.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger phrase "review this" is very broad and likely to appear in ordinary conversation, which can cause the skill to activate unintentionally. In an agent environment, accidental activation can expose user text to processing, trigger unexpected rewrites or memory updates, and create privacy or integrity issues even without malicious intent.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README advertises persistent learning of user preferences over time but does not disclose what data is stored, how long it is retained, or whether users can inspect or delete it. In a writing assistant context, stored preferences may include sensitive writing patterns, project terminology, or document-derived content, making silent persistence a meaningful privacy and compliance risk.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The suggested activations like "review this," "full review," and "rewrite this" are extremely common conversational phrases and do not establish clear skill-routing boundaries. In an agent ecosystem, broad triggers can cause unintended invocation on unrelated user content, increasing the chance of accidental processing or tool use when the user did not specifically intend to activate this skill.

Vague Triggers

Low

Confidence: 82% confidence
Finding: The phrase "set up my writing profile" is still fairly generic and could overlap with normal conversation, especially in systems where skills are selected by natural-language matching. While less risky than the other examples, it lacks explicit activation boundaries and could lead to unintended profile modification or onboarding flows.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide states that the product tracks which suggestions users accept or reject and adapts over time, but it does not provide any clear notice about data retention, storage location, consent, or how this behavioral data is used. Because writing content and editing preferences may be sensitive, silent tracking creates privacy and transparency risks.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Automatic integration with the dashboard is presented as a default behavior without clearly warning users that writing statistics will be shared with another component. Even if only metadata is sent, automatic cross-component disclosure without informed consent can expose sensitive usage patterns or derived writing information.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs persistent storage of a user writing profile in a fixed path without a clear upfront disclosure, consent flow, retention policy, or deletion guidance. Because writing preferences and inferred style patterns can reveal behavioral traits, silent cross-session retention creates a privacy and data exposure risk.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The learning loop tracks acceptance/rejection behavior, issue history, and session metrics over time, effectively building a behavioral profile without clearly warning the user. This can expose sensitive writing habits, preferences, and longitudinal activity patterns if accessed by other skills, local users, or logs.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The dashboard integration writes detailed writing-analysis data to additional tables and another component without explicit disclosure or consent. This broadens data sharing beyond the core skill, increasing the chance of unintended access, correlation across sessions, and exposure of sensitive writing-derived metadata.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to persist detailed session history, profile changes, issue logs, and longitudinal summaries across interactions. This creates a natural-language data retention surface where sensitive user writing characteristics and activity history may be leaked through storage, reporting, or other integrations.

Ssd 4

Medium

Confidence: 90% confidence
Finding: The skill explicitly recommends delaying the discovery flow until after showing value, then encouraging ongoing profile customization and long-term adaptation. That gradual engagement pattern weakens informed consent because users may be profiled and nudged into persistent tracking after initial use without a prominent upfront privacy decision.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: SECURITY.md:37

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: SETUP-PROMPT.md:90