Promify Creative Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:24 AM UTC
• Version: 1.0.9

Overview

This skill does what it says, but needs review because it asks users to paste an API key into chat and automatically sends fetched product information to Promify.

Install only if you are comfortable using Promify for ad generation. Configure the API key in local OpenClaw settings rather than pasting it into chat, and avoid using private, unpublished, internal, or sensitive product URLs because extracted details may be sent to Promify automatically.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:35

Finding

API Key Requested Through the Conversation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–55
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code:

markdown

If it is missing, stop and tell the user:

> **Welcome to Promify Creatives Generator!** 👋
>
> To generate ad creatives, you'll need a free Promify API Key.
>
> **Get started:**
>
> 1. **Sign up / Log in** → Visit **[https://promify.ai/login?redirect=/&from=openclaw](https://promify.ai/login?redirect=/&from=openclaw)** (free)
> 2. **Copy your API Key** → After logging in, your key appears on the API Key page.
> 3. Please paste your API Key here:

### 3.2 Configure OpenClaw
Edit the OpenClaw configuration file: `~/.openclaw/openclaw.json`

Add or merge the following structure:

```json
{
  "skills": {
    "entries": {
      "promify-creative-generator": {
        "env": {
          "PROMIFY_API_KEY": "your_actual_api_key_here"
        }
      }
    }
  }
}

text

### Technical Analysis

The Skill explicitly asks the user to paste a Promify API key into the conversation. API keys are authentication secrets and should not be entered into a conversational channel when protected local configuration is already available.

A key pasted into the conversation may become part of conversation history, model context, application telemetry, debugging records, or other logs. Components and personnel permitted to inspect those records could consequently gain access to the credential. The local OpenClaw configuration method documented immediately afterward is sufficient for the declared functionality, so disclosure through chat exceeds the minimum exposure necessary.

Sending the key as a bearer credential specifically to the declared Promify API is necessary authentication and is not, by itself, evidence of malicious exfiltration. The vulnerability is the unnecessary request to discl
...[truncated 1131 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the instruction asking users to paste the API key into the conversation.
• Direct users exclusively to a protected environment variable, secret manager, or local OpenClaw configuration.
• State explicitly that the key must never be printed, echoed, included in generated output, or retained in conversational memory.
• Validate only whether the configured value is present; avoid displaying its contents.
• Redact authorization headers and key-like values from diagnostics, errors, and tool logs.
• Apply restrictive filesystem permissions to the configuration file containing the key.
• If a key has already been pasted into chat, advise the user to revoke and rotate it.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:60

Finding

Unrestricted Fetching of User-Supplied Product URLs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60–74
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Medium

Vulnerable Code:

markdown

## Step 2: Fetch Product Info

Use the **WebFetch** tool or **curl** to retrieve the product page.

Extract and structure the following fields:

```json
{
  "name": "Product name (required)",
  "description": "50–200 word description (optional)",
  "price": "Numeric string, e.g. 29.99 (optional)",
  "imageUrl": "Product main image, must be https:// (required)",
  "language": "BCP 47 language code, e.g. en, zh-CN, ja, ko, ar — default en"
}

text

### Technical Analysis

The Skill directs the Agent to retrieve a user-provided product page through `WebFetch` or `curl` without imposing scheme, host, address-range, port, or redirect restrictions on the source URL. Although the extracted product image must use HTTPS, that constraint does not protect the initial product-page request.

If the execution environment permits access to internal resources, an attacker can supply a loopback, private-network, link-local, cloud metadata, or redirecting URL. This creates a server-side request forgery risk. Using `curl` can further broaden the reachable schemes and destinations unless strict options and validation are imposed.

Content retrieved from an internal destination could be parsed as product data, shown in the extraction summary, or included in the request subsequently sent to Promify. Actual exploitability depends on the network isolation and URL protections implemented by the underlying tools.

### Attack Path

1. An attacker asks the Skill to generate an advertisement from a URL under the attacker's control or from a direct internal address.
2. The URL points to localhost, a private service, a link-local metadata endpoint, or an external endpoint that redirects to one.
3. Following Step 2, the Agent invokes `WebFetch` or `curl` 
...[truncated 898 chars]

Remediation

View remediation

Remediation Suggestions

• Accept only absolute https:// URLs for product pages.
• Resolve the hostname before making the request and reject loopback, private, link-local, multicast, reserved, and unspecified IPv4 and IPv6 ranges.
• Explicitly block cloud metadata endpoints, including 169.254.169.254 and IPv6 equivalents.
• Restrict destination ports to expected HTTPS ports.
• Disable redirects where possible. If redirects are necessary, apply the same scheme, hostname, address, and port validation to every redirect target.
• Protect against DNS rebinding by validating resolved addresses and ensuring the connection uses the validated destination.
• Prefer a sandboxed WebFetch facility with enforced network policy over unrestricted curl.
• Limit response size and request duration, and avoid forwarding retrieved fields unless they match the expected product-data schema.
• Do not display or send content that appears to contain credentials, tokens, metadata, or internal-service responses.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are broad enough to match many generic requests about ads, marketing images, or creative help, causing the skill to activate outside clearly intended Promify use cases. That can route users into automatic external fetching and API submission when they may have expected only brainstorming or local assistance, increasing the chance of unintended data handling.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md

Generate ad creatives, marketing images, and advertising visuals using the Promify API.
  Use when the user wants to create, make, or produce ad images, banners, or marketing materials
  for Meta Ads, Facebook Ads, Instagram Ads, Google Ads, TikTok Ads, or other ad platforms.
  Triggers on: generate ad, create ad creative, make marketing image, produce ad banner,
  ad campaign visual, Facebook ad image, Instagram ad, Google ad creative.
metadata: { "openclaw": { "emoji": "🎨", "primaryEnv": "PROMIFY_API_KEY" } }
---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs automatic extraction of product data from a webpage and immediate submission of that data to Promify without an explicit user consent step or outbound-transfer warning. If the page contains sensitive business information, unpublished product details, or user-provided proprietary copy/images, this creates a real confidentiality and privacy risk through third-party disclosure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest frames the skill as generating ad creatives using the Promify API, but the documented workflow also directs the agent to fetch arbitrary third-party product URLs with WebFetch or curl. While product-page retrieval supports the workflow, this introduces a general web-access capability not disclosed in the manifest description and not inherently part of the Promify API operation itself.

Content

No source excerpt is available for this finding.