Security audit

Phy Social Suite

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent social-media review purpose, but it runs unverified local component scripts and can report “all clear” even when checks fail or are skipped.

Review this carefully before installing. It is not malicious on its face, but only run it with component skills you trust, remove or avoid the Desktop fallback path, and do not rely on the final “all clear” line as a hard publishing gate unless the missing-check and exception behavior is fixed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: scripts/social_suite.py:30
Finding: Unverified Dynamic Loading and Execution of External Skill Components
Content: View full analysis
str | None: """Find a skill script in standard locations.""" candidates = [ Path.home() / ".claude" / "skills" / skill_dir_name / "scripts" / script_name, Path.home() / "Desktop" / "openclaw-skills-publish" / skill_dir_name / "scripts" / script_name, ] for c in candidates: if c.exists(): return str(c) return None ``` The returned paths are subsequently loaded at lines 72-76, 103-106, and 135-138: ```python compound_path = _find_skill_script("phy-content-compound", "content_compound.py") if compound_path: try: compound = _import_from_path("content_compound", compound_path) ``` ```python humanizer_path = _find_skill_script("phy-content-humanizer-audit", "content_humanizer_audit.py") if humanizer_path: try: humanizer = _import_from_path("content_humanizer_audit", humanizer_path) ``` ```python rules_path = _find_skill_script("phy-platform-rules-engine", "platform_rules.py") if rules_path: try: rules = _import_from_path("platform_rules", rules_path) ``` ### Technical Analysis The application discovers Python components in predictable directories and executes them through `exec_module()` without validating their origin, version, integrity, ownership, or permissions. Importing a Python module executes all of its top-level code before any expected function i ...[truncated 1906 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/social_suite.py:168
Finding: Fail-Open Final Verdict Reports “All Clear” When Security Checks Fail or Are Skipped
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script dynamically locates and imports Python modules from writable user-controlled locations such as the home directory and Desktop, then executes them via exec_module. If an attacker can place or modify files in those locations, running this skill will execute arbitrary code with the user's privileges, which is far more capability than needed for a content-audit orchestrator.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest and module docstring describe a single command that outputs a combined PASS/FAIL verdict as a gate. In code, run_pipeline builds a human-readable report and may print 'All clear' or warning lines, but it returns only a string and main() always prints it without exposing a machine-enforced pass/fail result or exit status.
Content: No source excerpt is available for this finding.