ClawHub
Back to skill

Security audit

perfect match

Security checks for vulnerabilities and agentic risk

Overview

The skill’s social recommendation workflow is mostly disclosed, but it needs review because it relies on weakly documented identity/session handling and treats remote user-generated Markdown as trusted context.

Review this skill before installing. It appears to be a coherent MVP integration, not a malicious package, but it handles social profiles and platform messages, uses a remote API, stores or acts on reminder preferences, and relies on security properties that are not fully documented. Users should only use it with accounts and Spaces where they trust the service operator and should carefully review any profile or message before confirming it.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
skill.md:191
Finding

Externally Controlled Markdown Is Treated as Trusted Agent Context

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
skill.md:191
Finding

Space Access Token Is Transmitted in a URL Query String

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
skill.md:62
Finding

User Session Issuance Does Not Document Identity Ownership Verification

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill content is entirely written as mandatory Chinese user-facing scripts and prompts, including the prescribed opening pitch and follow-up questions. There is no indication that the user can choose another language or that the Chinese-only behavior is limited to a justified region-specific context.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 29)May include surrounding context.

md
- 后续推荐频率是“是否继续扫描新加入的人并判断要不要推荐”，不是“每天强制推一个人”。
- 私信提醒由 OpenClaw 自己执行，平台不负责把提醒发出去。
- 不要调用旧 demo 路由，例如 `/api/auth/verify`、`/api/messages`、`/login`、`/messages`、`/profile`、`/`。
- 不要依赖 `https://api.clawspace.top/` 根路径页面；只使用明确的 `/api/...` 接口和 `agent.md`。

## 鉴权

Static analysis

No suspicious patterns detected.