Kai Skill Creator

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:09 AM UTC
• Version: 1.0.6

Overview

This skill is a coherent OpenClaw skill-building helper, but it normalizes under-scoped publishing and configuration changes that users should review carefully.

Use this skill only after reviewing the generated skill directory before installing or publishing it. Prefer a clean allowlisted template, pin the ClawHub CLI version instead of running unpinned `npx`, document real external endpoints honestly, and avoid storing long-lived secrets in plaintext config unless OpenClaw requires it and the file permissions are locked down.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:75
• Finding: Unpinned Third-Party Package Execution Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:75` and `scripts/create_skill.sh:123` **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code `SKILL.md:75`: ```bash npx clawhub publish skills/<SKILL_NAME> --slug <SKILL_NAME> --version 1.0.0 --tags "tag1,tag2" ``` `scripts/create_skill.sh:123`: ```bash echo " 7. Publish: npx clawhub publish skills/$SKILL_NAME --slug $SKILL_NAME --version 1.0.0" ``` ### Technical Analysis The documented publication workflow invokes `clawhub` through `npx` without specifying a reviewed package version, integrity hash, verified installation path, or offline-only execution policy. If the package is not already available locally, `npx` may resolve and download it from the configured package registry. The downloaded package can execute JavaScript and package lifecycle logic with the permissions of the user running the command. Because dependency resolution is not pinned, the effective code can change after this Skill has been reviewed. The risk applies both to the direct instruction in `SKILL.md` and to the publication command printed by `create_skill.sh`. ### Attack Path 1. An attacker compromises the resolved `clawhub` package, publishes a malicious future version, or influences the user's configured package registry. 2. A user follows the Skill's publication instructions. 3. `npx` resolves the unpinned package and downloads the attacker-controlled version when a trusted local copy is unavailable. 4. The package executes with the invoking user's privileges. 5. The malicious package can access files, environment variables, authentication tokens, and publication credentials available to that user before optionally forwarding execution to the expected CLI behavior. ### Impact Assessment Successful exploitation permits arbitrary code execution with the privileges of the user publishing the Skill. Potentially exposed resources include: - Files readable or wr ...[truncated 376 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Install and review a specific trusted version of the CLI: ```bash npm install --save-dev --save-exact clawhub@<reviewed-version> ``` 2. Commit the generated lockfile and verify package integrity through the package manager. 3. Invoke only the verified local installation: ```bash ./node_modules/.bin/clawhub publish skills/<SKILL_NAME> \ --slug <SKILL_NAME> \ --version 1.0.0 \ --tags "tag1,tag2" ``` 4. If `npx` must be used, prevent network installation and require an existing local package: ```bash npx --offline --no-install clawhub publish ... ``` 5. Pin the package version explicitly, verify its provenance and integrity before execution, and use a trusted registry. 6. Run publication in an isolated environment with only the minimum credentials and filesystem access required. 7. Update both `SKILL.md` and the command printed by `scripts/create_skill.sh` so they prescribe the same hardened workflow. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create_skill.sh:66
• Finding: Generated Skills Inherit Unverified Files from a Mutable Template<![CDATA[ ## Vulnerability Details **File Location**: `scripts/create_skill.sh:66-82` **Vulnerability Type**: Unsafe recursive copying of a mutable Skill template **Risk Level**: Medium ### Vulnerable Code ```bash # Check if template exists TEMPLATE_DIR="$WORKSPACE/kai-minimax-tts" if [ ! -d "$TEMPLATE_DIR" ]; then echo "❌ Error: Template 'kai-minimax-tts' not found at $TEMPLATE_DIR" echo "Please ensure kai-minimax-tts skill is installed." exit 1 fi echo "Creating skill: $SKILL_NAME" echo "📁 Location: $SKILL_DIR" # Copy template cp -r "$TEMPLATE_DIR" "$SKILL_DIR" # Rename internal references if [ -f "$SKILL_DIR/scripts/kai_tts.sh" ]; then mv "$SKILL_DIR/scripts/kai_tts.sh" "$SKILL_DIR/scripts/${SKILL_NAME}.sh" 2>/dev/null || true fi ``` ### Technical Analysis The creator recursively copies the complete contents of a mutable local `kai-minimax-tts` Skill directory. It subsequently replaces `SKILL.md` and optionally renames one expected script, but it does not enumerate, validate, or remove other inherited content. Consequently, additional scripts, hooks, configuration files, credentials, symlinks, generated artifacts, or unrelated resources present in the template can remain in the newly generated Skill. The script does not verify template provenance, compare files against an allowlist, reject symlinks, or display the complete inherited file set for approval. The use of quoted path variables prevents direct shell command injection through the Skill name. The vulnerability instead arises from trusting and copying all content from an externally mutable template directory. ### Attack Path 1. An attacker or compromised local process obtains write access to `$HOME/.openclaw/workspace/skills/kai-minimax-tts`. 2. The attacker adds a malicious or sensitive file to that template, or modifies an inherited script other than the specifically renamed file. 3. The user runs `create_skill.sh` to create a new Skill. 4. `cp -r` silently copies the addi ...[truncated 1189 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace recursive copying with creation of a clean directory structure: ```bash mkdir -p "$SKILL_DIR/scripts" ``` 2. Copy only explicitly approved template files using an allowlist rather than copying the entire directory. 3. Bundle a minimal, version-controlled template with the creator instead of relying on a mutable workspace Skill. 4. Reject symbolic links, device files, sockets, and unexpected file types before copying. 5. Validate the source template against a trusted manifest containing expected paths and cryptographic hashes. 6. Fail if unknown files are present instead of silently including them. 7. After generation, print a complete file inventory and require review before global installation or publication. 8. Run syntax and security validation against every generated script, not only the expected renamed script. 9. Scan the generated directory for secrets and exclude temporary files, hidden files, credentials, caches, and version-control metadata. 10. Ensure the source template and generated Skill directories are writable only by the intended user. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (11)

Self-Modification

High

• Category: Rogue Agent

Content

cp -r /home/kai/.openclaw/workspace/skills/kai-minimax-tts /home/kai/.openclaw/workspace/skills/<NEW_SKILL>
```

### 2. Edit SKILL.md

**CORRECT FRONTMATTER:**
```yaml

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Credential Access

High

• Category: Privilege Escalation

Content

API_KEY="sk-api-xxxxx"
```

### ❌ NEVER Load .env in Script
```bash
# FLAGGED! Security risk
source ~/.env

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

API_KEY="sk-api-xxxxx"
```

### ❌ NEVER Load .env in Script
```bash
# FLAGGED! Security risk
source ~/.env

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

### ❌ NEVER Mention External API URLs
```markdown
# FLAGGED! External endpoint reference
Get key from: https://api.example.com
```
Keep docs minimal. Scanner interprets URL mentions as potential data exfiltration.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill clearly instructs users to run shell commands, copy files, edit configs, and publish packages, but it declares only a binary requirement and no explicit tool scope such as shell permissions. This creates a mismatch between documented capabilities and declared permissions, which can weaken reviewability and allow a user to invoke a skill with broader operational behavior than its metadata signals.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: kai-skill-creator
description: Create new OpenClaw skills that pass ClawHub validation on first attempt. Use when building a new skill for OpenClaw. Teaches the complete process from template to published skill.
metadata:
  openclaw:
    requires:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence
• Finding: Using `npx clawhub publish` without pinning a specific version can cause execution of whatever package version is resolved at runtime. That introduces supply-chain risk and non-reproducible behavior, especially for a publishing workflow that may handle credentials and modify remote state.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill advises users to place API secrets directly into `~/.openclaw/openclaw.json` in plaintext. Storing long-lived credentials in a general config file increases the chance of accidental disclosure through backups, logs, screenshots, file-sharing, or overly broad filesystem access.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The script instructs users to run `npx clawhub publish` without pinning an exact package version. `npx` may fetch the latest package from the registry at execution time, which creates a supply-chain risk: a malicious or compromised upstream release could execute arbitrary code on the user's machine during publish. In a skill-creation tool, this is more dangerous because it normalizes a repeated workflow that users are likely to copy verbatim.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This markdown file includes commands to copy a skill into the global skills directory and manually edit `~/.openclaw/openclaw.json`, both of which change user files and system behavior. The surrounding instructions do not include a caution that these steps modify existing filesystem state or advise backing up/reviewing the target config before making changes.

Natural-Language Policy Violations

Low

• Confidence: 71% confidence
• Finding: The testing example passes `en` explicitly, which can imply an English-only default or expected usage pattern. Because the document does not clarify that language choice is optional or user-selected, this may conflict with policy against forcing a specific language without opt-in.

Static analysis

No suspicious patterns detected.