Security audit

Content Pipeline Provisioner

Security checks across malware telemetry and agentic risk

Overview

This skill matches its content-automation purpose, but it needs review because it combines persistent public posting with broad local secrets and unclear Supabase/Xero data-flow documentation.

Review before installing. Use dedicated low-privilege accounts and keys, restrict and never commit ~/.openclaw/.env, verify what the included Xero AI Supabase schema is for, review the separate Larry dependency, and only run go-live after confirming the exact accounts, channels, schedule, and test outputs.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The skill metadata uses broad natural-language trigger phrases like 'set up content pipeline', 'run my content engine', and 'start posting for [product]', which can overlap with normal user requests and cause unintended invocation. In this skill's context, accidental activation is more dangerous because execution provisions automation, reads local credentials, creates persistent files, and prepares public multi-channel posting.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to read sensitive credentials from ~/.openclaw/.env, but the user-facing description does not clearly disclose this behavior before activation. This is risky because users may invoke the skill without realizing it will access local API secrets for OpenAI, Postiz, MailerLite, and Telegram, increasing the chance of unauthorized or unexpected secret use.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The 'go live' step flips the system from dry-run to PUBLIC posting across TikTok, Twitter/X, newsletter, blog, and Telegram, but the skill description does not prominently warn that this enables autonomous external publishing. This is especially dangerous here because the skill sets up recurring cron-driven actions, so a single approval can lead to continuous public output on multiple linked accounts.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document instructs users to place a Supabase service-role key in a local env file but does not clearly warn that this key is highly privileged and must never be exposed to client-side code, logs, repos, or shared environments. In the context of an automated content pipeline that writes blog content, compromise of this key could allow unauthorized reads/writes or broader database abuse depending on Supabase permissions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The checklist directs users to collect and store multiple sensitive credentials locally, including a Supabase service role key, bot tokens, and API secrets, but provides no guidance on least privilege, file permissions, secret managers, rotation, or avoiding accidental disclosure. In a skill that automates publishing across several external services, concentrating all credentials in local config materially increases blast radius if the workstation, repo, or logs are exposed.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The documentation explicitly instructs operators to use a Supabase service role key from local secrets without any warning or constraint on secure handling. A service role key typically bypasses RLS and grants broad database access; in this skill, that is especially dangerous because the table contains client PII and API keys, so mishandling could expose or modify sensitive tenant data at scale.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.