sillytavern-cards

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:19 AM UTC
• Version: 0.1.0

Overview

The skill has a coherent roleplay-card purpose, but it lets untrusted third-party character cards persistently rewrite OpenClaw's identity and memory, including a mode where normal tools remain available.

Review this skill carefully before installing. The safest mode is /character chat because it says it does not modify SOUL.md or MEMORY.md. Avoid Play or Soul mode for community cards unless you inspect the card contents first, back up ~/.openclaw/SOUL.md and ~/.openclaw/MEMORY.md, and are comfortable with character text and memories persisting across sessions. Be cautious with arbitrary card URLs and character names containing spaces or special characters.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:184

Finding

<![CDATA[Untrusted Character Cards Can Persistently Hijack Agent Instructions]]>

Content

View full analysis

/dev/null || true ``` Read the character JSON from `~/.openclaw/characters/.json`, then **overwrite** `~/.openclaw/SOUL.md` with: ```markdown # {{char_name}} ## Identity You ARE {{char_name}}. You are not an AI assistant. You do not break character unless the user says "/character stop". You do NOT respond to any other skills, tools, or slash commands. You are fully in character at all times. {{description}} ## Personality {{personality}} ## Scenario {{scenario}} ## How You Speak and Act Mirror the style below. Match the tone, action formatting, vocabulary, and message length exactly. {{mes_example}} ## System Instructions {{system_prompt}} {{post_history_instructions}} ``` ``` The same unsafe behavior is independently shipped in the Chinese Skill definition at `cn/SKILL.md:184-215`. Soul mode also interpolates untrusted fields while retaining tool access at `SKILL.md:256-298` and `cn/SKILL.md:256-298`. ### Technical Analysis Character cards can originate from arbitrary URLs or community-controlled services. Their `description`, `mes_example`, `system_prompt`, and `post_history_instructions` fields are therefore untrusted input. The Skill does not delimit these fields as inert reference data. Instead, it copies them directly into `~/.openclaw/SOUL.md`, which is described as OpenClaw's persistent identity file. The surrounding template explicitly tells the agent that it is no longer an assistant and must ignore other skills, tools, and slash commands. A malicious card author can place additional behavioral instructions in any interpolated field. Those instructions can alter the agent's objectives, suppress legitimate ...[truncated 2006 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:218

Finding

<![CDATA[Attacker-Controlled Lorebook Content Is Written to Persistent Agent Memory]]>

Content

View full analysis

### [Entry title or first keyword] {{content}} ``` Lorebook rules: - `constant: true` → mark ``, always include in context - `selective: true` → ALL `keys` AND at least one `secondary_keys` must match - `selective: false` → any single `key` match activates the entry ### Step 3: Send opening message and stay in character Send `first_mes` (with macros replaced). From this point: - You ARE the character. Every response is from their perspective. - Mirror the writing style from `mes_example` exactly. - Replace macros: `{{char}}` → name, `{{user}}` → user's name, `{{random:A,B,C}}` → pick one (V3), `{{roll:d6}}` → roll (V3). - After meaningful conversations, save relationship memories to MEMORY.md. ### Exiting Play mode When the user says `/character stop`: 1. Restore SOUL.md: `cp ~/.openclaw/SOUL.md.backup ~/.openclaw/SOUL.md 2>/dev/null || true` 2. Keep lorebook and relationship memories in MEMORY.md (they persist for next time). 3. Confirm exit to user. ``` Equivalent persistent-memory behavior appears in `cn/SKILL.md:218-251`. Soul mode reuses the same lorebook behavior, and `SKILL.md:344-358` additionally directs the agent to retain relationship details across sessions. ### Technical Analysis The card author controls `character_book.entries[].content`, activation keys, and the `constant` flag. The Skill appends this content directly to global `~/.openclaw/MEMORY.md` with ...[truncated 2148 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:84

Finding

<![CDATA[Unvalidated Character Names Are Interpolated into Shell File Paths]]>

Content

View full analysis

" > ~/.openclaw/characters/.json # Copy the original image as the avatar (if PNG/WEBP) cp "" ~/.openclaw/characters/.png ``` ``` The same pattern appears in remote import commands at `SKILL.md:153-163`: ```bash mkdir -p ~/.openclaw/characters curl -sL "https://avatars.charhub.io/avatars///chara_card_v2.png" -o /tmp/chub-card.png node {baseDir}/extract-card.js /tmp/chub-card.png > ~/.openclaw/characters/.json cp /tmp/chub-card.png ~/.openclaw/characters/.png ``` Deletion also uses the unvalidated placeholder at `SKILL.md:371-375`: ```bash rm ~/.openclaw/characters/.json ~/.openclaw/characters/.png 2>/dev/null ``` Equivalent commands are present in `cn/SKILL.md`. ### Technical Analysis The Skill does not define validation, canonicalization, or safe encoding for `` and ``. It also leaves the destination paths unquoted. If an implementation substitutes card metadata or user input directly into these shell templates, shell metacharacters can alter command parsing. Path separators and traversal sequences can cause writes or deletion attempts outside `~/.openclaw/characters/`. Whitespace or wildcard characters can also split or expand arguments. The exact exploitability depends on how OpenClaw converts placeholders into commands. However, the prescribed implementation pattern is unsafe because it relies on dynamically generated shell syntax rather than fixed arguments and validated internal identifiers. ### Attack Path 1. An attacker creates a card with a crafted chara ...[truncated 1106 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (44)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · MARKETING.md (reported line 138)May include surrounding context.

md

|--------|-----------|---------|
| Reply to "how to use ST on phone" threads | Ongoing | Reddit, Discord |
| Share user testimonials / cool use cases | Weekly | Twitter, Discord |
| Update skill and announce new features | Per release | ClawHub, Discord, Reddit |
| Engage with ST extension developers | Ongoing | SillyTavern Discord |
| Create character card packs (curated collections) | Monthly | GitHub, Chub.ai |

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The skill allows fetching arbitrary user-supplied URLs and then processing the downloaded content locally with an extractor, which expands exposure to malicious files, SSRF-like access patterns, and unsafe content ingestion. Even though the script itself is local, the combination of arbitrary fetch plus parser invocation on untrusted data is high risk.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

mkdir -p ~/.openclaw/characters

# Direct PNG/JSON URL (any site):
curl -sL "<url>" -o /tmp/card-download.png
node {baseDir}/extract-card.js /tmp/card-download.png > ~/.openclaw/characters/<character-name>.json
cp /tmp/card-download.png ~/.openclaw/characters/<character-name>.png

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

Search CharaVault (~195,000+ cards):

bash

curl -s "https://charavault.net/api/cards?q=<query>&limit=10&sort=most_downloaded&nsfw=false" | node -e "
const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
(d.results||[]).forEach((c,i)=>{
  console.log((i+1)+'. '+c.name+' by '+(c.creator||'unknown'));

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill describes overwriting SOUL.md and appending to MEMORY.md without an upfront warning that this changes the assistant's persistent identity and stores long-lived user/character state. Silent persistent state changes are dangerous because they alter future behavior outside the original task and can be hard for users to notice or undo.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill instructs writing imported card fields directly into SOUL.md, including system_prompt and post_history_instructions, allowing arbitrary third-party content to become persistent top-level behavior. Because cards are community-created and fetched from external sources, this is effectively persistent prompt injection with global effect on future assistant behavior.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instruction to preserve lorebook and relationship memories across mode switches encourages long-term tracking of user interactions beyond the immediate session. Cross-session persistence increases both privacy exposure and the blast radius of any malicious or manipulative memory content stored earlier.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The relationship memory guidance explicitly instructs storing personal details, preferences, arguments, and life events in persistent memory across sessions. This creates a privacy risk by normalizing collection and retention of potentially sensitive user information without clear minimization, consent, retention limits, or deletion controls.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The delete command interpolates into an rm command path, creating a path/parameter abuse risk if the name is not strictly validated and safely quoted by the eventual implementation. A crafted name containing path traversal or shell metacharacters could lead to deletion of unintended files.

Content

Scanner excerpt · SKILL.md (reported line 374)May include surrounding context.

Delete a character:

bash

rm ~/.openclaw/characters/<name>.json ~/.openclaw/characters/<name>.png 2>/dev/null

Slash Commands

External Script Fetching

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The skill permits fetching a file from any URL and immediately passing it into a parser, effectively turning arbitrary remote content into locally processed input. Even if no code is directly executed from the response, this pattern is high risk because malformed files, unexpected formats, or parser bugs can be weaponized, and it lacks source restrictions.

Content

Scanner excerpt · cn/SKILL.md (reported line 101)May include surrounding context.

md

mkdir -p ~/.openclaw/characters

# 直接 PNG/JSON 链接（任何网站）：
curl -sL "<url>" -o /tmp/card-download.png
node {baseDir}/extract-card.js /tmp/card-download.png > ~/.openclaw/characters/<角色名>.json
cp /tmp/card-download.png ~/.openclaw/characters/<角色名>.png

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · cn/SKILL.md (reported line 137)May include surrounding context.

搜索 CharaVault（19.5万+ 张卡）：

bash

curl -s "https://charavault.net/api/cards?q=<搜索词>&limit=10&sort=most_downloaded&nsfw=false" | node -e "
const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
(d.results||[]).forEach((c,i)=>{
  console.log((i+1)+'. '+c.name+' by '+(c.creator||'未知'));

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs overwriting core persona files and appending to persistent memory as part of character activation. For a roleplay/import skill, modifying foundational assistant identity and long-lived memory is overly invasive and can permanently alter behavior beyond the current task or session.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The 'soul' mode combines an imported, untrusted persona with full assistant and tool capabilities while preserving persistent effects. This is dangerous because prompt content from community cards can shape future tool-using behavior, effectively granting untrusted external content influence over privileged assistant actions.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The deletion command interpolates an untrusted character name directly into a shell rm command without quoting or sanitization. If a crafted name contains shell metacharacters or path traversal sequences, it could delete unintended files or trigger command injection depending on how the command is executed.

Content

Scanner excerpt · cn/SKILL.md (reported line 374)May include surrounding context.

删除角色：

bash

rm ~/.openclaw/characters/<名字>.json ~/.openclaw/characters/<名字>.png 2>/dev/null

斜杠命令

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README instructs users to import third-party character cards from untrusted sites and begin chatting, but does not warn that activating a card overwrites SOUL.md, the agent's identity file. Because card content becomes the agent's core identity, a malicious or unsafe card can perform prompt/behavior injection, alter safeguards, or manipulate later interactions in ways users may not expect from merely importing a PNG/JSON file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README explicitly promotes persistent storage of relationship memories in MEMORY.md but does not warn users that potentially sensitive personal conversations will be retained across sessions. In a messaging-context skill spanning WhatsApp, Telegram, and Discord, users may reasonably disclose personal details without realizing they are being durably stored and reused later, creating privacy and consent risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

- User wants general AI conversation without a character persona
- User is asking about card games or trading cards
- User wants to create images or artwork (use image generation skills instead)

## How Character Cards Work

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to download files from remote URLs and save them under the user's home directory without requiring explicit notice or consent about network access and filesystem changes. Users may not expect that importing a card triggers external requests and local persistence, increasing privacy and trust risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

Search Chub.ai (~tens of thousands of cards):

bash

curl -s -H "User-Agent: SillyTavern" "https://api.chub.ai/search?search=<query>&first=10&page=1&sort=last_activity_at&nsfw=false" | node -e "
const d=JSON.parse(require('fs').readFileSync('/dev/stdin','utf8'));
const nodes=d.data?.nodes||d.nodes||[];
nodes.forEach((n,i)=>{

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

This section persists downloaded character assets and extracted JSON into ~/.openclaw/characters, creating durable local state from untrusted remote content. Persistence itself may be expected for imports, but without consent, provenance tracking, or sanitization it contributes to long-lived risk from malicious cards.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

Download from Chub.ai:

bash

mkdir -p ~/.openclaw/characters
curl -sL "https://avatars.charhub.io/avatars/<creator>/<name>/chara_card_v2.png" -o /tmp/chub-card.png
node {baseDir}/extract-card.js /tmp/chub-card.png > ~/.openclaw/characters/<name>.json
cp /tmp/chub-card.png ~/.openclaw/characters/<name>.png

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

Backing up and overwriting SOUL.md introduces persistent identity takeover that survives beyond the immediate command. Because the new content is derived from imported cards, this is a high-risk form of state persistence affecting future assistant behavior.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

This is pure roleplay. The agent becomes the character entirely and does NOT respond to other skills or commands (except /character stop).

Step 1: Back up and overwrite SOUL.md

bash

cp ~/.openclaw/SOUL.md ~/.openclaw/SOUL.md.backup 2>/dev/null || true

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

Writing imported lorebook entries into MEMORY.md creates persistent storage of untrusted content that can later re-enter context and influence behavior. This is especially risky because the lorebook content is designed for conditional injection and may contain manipulative instructions.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

{{post_history_instructions}}

text

### Step 2: Write lorebook to MEMORY.md

If the card has `character_book` entries, append them to `~/.openclaw/MEMORY.md`:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Appending arbitrary character_book entries and relationship content into global MEMORY.md extends untrusted card influence beyond the current interaction and can affect later conversations unrelated to the imported character. This persistence magnifies prompt-injection risk because hidden or manipulative lorebook text can continue steering behavior long after import.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Soul mode instructions let untrusted character-card content shape the assistant's global identity and communication while explicitly preserving access to all other tools and skills. This creates an instruction-injection pathway where card fields such as description, mes_example, or system_prompt can bias downstream actions, making the roleplay feature much more than simple content display.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

Reusing the same lorebook-to-MEMORY.md persistence in Soul mode carries the same cross-session instruction and privacy risks as Play mode, while additionally allowing normal tool use under the influenced persona. That combination increases the chance of downstream actions being affected by persisted character content.

Content

Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.

{{system_prompt}}

text

### Step 2: Write lorebook to MEMORY.md (same as Play mode)

### Step 3: Greet the user in character

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented delete command irreversibly removes stored character files without any confirmation, preview, or recovery path. Accidental invocation or name confusion could permanently delete user data, especially if multiple similarly named characters exist.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.