Security audit

Skill Audit Pro

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real skill-security scanner, but it needs review because it runs recurring scans and prepares reports for all discovered messaging channels without clear recipient or disable controls.

Review before installing. Use this only if you are comfortable with recurring local scans and reports that may reveal installed skill names, file locations, and security findings to configured messaging channels. Prefer a version that lets you choose recipients, opt in to scheduling, disable the background task, and redact any sensitive match details.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill advertises capabilities to read installed skills, schedule scans, and send reports to external channels, which implies file access, network use, and potentially shell/process execution, yet no permissions are declared. This mismatch is dangerous because users and the platform cannot accurately understand or constrain what the skill can access, and the automatic exfiltration of scan results to all configured channels increases the risk of sensitive data disclosure.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The script reads local session and configuration files to enumerate active channels and recipient identifiers, which is broader data access than necessary for scanning installed skills. Even though it does not directly send the report itself, it exposes a list of messaging destinations in output metadata, increasing privacy risk and creating a pathway for unintended disclosure of internal communication targets.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The code prints the report plus an HTML comment containing serialized channel metadata, while comments imply OpenClaw will use this for delivery. If stdout is logged, forwarded, or shown to other tools, channel names and recipient identifiers may be exposed unintentionally, and the mismatch between comments and behavior obscures the real data flow for reviewers and operators.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The manual triggers include generic phrases such as 'scan skills', '安全扫描', and 'audit skills', which can overlap with normal user conversation and cause unintended invocation. In a skill that reads local skill content and automatically produces reports, accidental activation can trigger unexpected scanning and disclosure workflows without clear user intent.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Although the document mentions multi-channel pushing elsewhere, the top-level skill description does not clearly warn users that reports are automatically sent to all configured channels. Because scan reports may contain filenames, code excerpts, credential indicators, or other sensitive metadata, omitting this warning undermines informed consent and increases the likelihood of unintended data leakage to third-party messaging services.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/skill_audit.py:108