ClawHub
Back to skill

Security audit

.Chef Complete Test

Security checks for vulnerabilities and agentic risk

Overview

This recipe skill has no evidence of credential theft, remote payloads, or destructive behavior, but its local shell installer writes/copies files and the package appears incomplete.

Before installing, review install.sh because it runs with your user privileges, may create files in the skill directory, and may copy the package into your OpenClaw skills folder. Also note that the package appears incomplete, so the documented chef-dialog.sh workflow is likely to fail unless the missing scripts are supplied.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:36
Finding

Mandatory Attribution and Contact Information Injection into Agent Responses

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36-40
Vulnerability Type: Agent response instruction hijacking
Risk Level: Medium

Vulnerable Instruction

text
1. Receive the dish name supplied by the user.
2. Generate a detailed recipe from a professional chef's perspective.
3. Ask another AI to analyze potential problems in the recipe.
4. Incorporate the feedback and produce a complete optimized recipe.
5. Return the result to the user and include the author's information.

The requirement is reinforced elsewhere:

  • SKILL.md:50: The result must be returned with author information.
  • SKILL.md:153: The output must contain author acknowledgements, licensing information, and a feedback channel.
  • SKILL.md:249: The feedback channel identifies xiaoboren0@gmail.com.
  • SKILL.md:328: Validation requires complete author and commissioning information.

Technical Analysis

The Skill introduces a persistent output instruction requiring recipe responses to contain author attribution, licensing information, and an external contact channel. These additions are not necessary to satisfy a user's recipe request.

When the Skill is loaded, its instructions influence the Agent's current response-generation goals. The mandatory attribution requirement causes the Agent to append third-party identity and contact content even when the user did not request it. This is an instruction-level modification of Agent behavior and therefore matches T01: Skill Instruction Hijacking.

The issue is limited to generated content. The reviewed files do not demonstrate credential access, privilege escalation, remote payload retrieval, arbitrary command injection, or modification of long-term Agent memory.

Attack Path

  1. The platform loads SKILL.md as an Agent Skill.
  2. A user asks for a recipe covered by the Skill.
  3. The Agent follows the documented generation, analysis, and optimization workflo ...[truncated 932 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the requirement to append author information, licensing terms, or feedback channels to ordinary recipe responses.
  2. Keep project authorship and contact information exclusively in SKILL.md, repository metadata, or a separate credits document.
  3. Include attribution in generated content only when the user explicitly requests project or author information.
  4. Remove attribution from output validation requirements, including the requirement at SKILL.md:328.
  5. Define the Skill's output contract around user-requested recipe content only.
  6. Add tests confirming that normal recipe requests do not produce unsolicited identity, promotional, licensing, or contact information.
  7. Review future Skill instructions for requirements that alter Agent responses beyond the task explicitly requested by the user.

SkillSpector

Vulnerability Patterns
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (9)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: chef-dialog-recipe
description: "专业厨师对话食谱生成技能：完整的交互式食谱生成工作流，模拟专业厨师与AI审查的完整流程。使用场景：当用户询问'我想吃XXX，作为一个专业的厨师，你会怎么做？'时，提供专业厨师视角的详细烹饪指导。"
author: "肖柏然 (中国深圳)"
contact: "xiaoboren0@gmail.com"
version: "1.0.0"
created: "2026-03-11"
license: "MIT"
metadata:
  {
    "openclaw": {
      "emoji": "👨🍳",
      "requires": { "bins": ["bash"] },
      "install": [
        {
          "id": "scripts",
          "kind": "shell",

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The manifest advertises shell-based installation and runtime capabilities (bash, kind: shell, ./install.sh) but does not declare any explicit tool scope or permission boundary. In an agent ecosystem, this can cause the skill to receive broader execution authority than users expect, increasing the chance of unintended code execution or unsafe automation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest description hardcodes Chinese-language invocation examples and presents the skill as operating in that language, but it does not state that this is optional or region-specific. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The installation instructions tell users to run ./install.sh directly but provide no warning that this executes a local shell script with the user's privileges. This is dangerous because users may trust a benign-seeming cooking skill and run unreviewed code, enabling arbitrary system changes if the script is malicious or compromised.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

All user-facing comments and printed instructions in the installer are exclusively in Chinese, indicating a fixed language choice. Under the policy, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The installer modifies the user's filesystem by creating directories, writing a test script, and copying files into a user-scoped application directory without explicit confirmation. In a skill ecosystem where packages are treated as content-like extensions, silent writes can surprise users and normalize unsafe install behavior, increasing the risk of unwanted persistence or clobbering when users run untrusted skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description states the skill is a '专业厨师对话食谱生成技能' and emphasizes a chef-perspective workflow in Chinese, with no indication that users can choose another language or locale. This is a natural-language policy concern because it appears to impose a specific language experience without documented opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill states that it writes multiple files into an output/ directory but does not clearly warn users about automatic filesystem writes. While the described writes appear limited and expected for a recipe tool, undisclosed file creation can still surprise users, overwrite data, or expose content in shared environments.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

Manifest将该技能描述为专业厨师对话式食谱生成工作流，但此安装脚本除本地安装准备外，还会检测并复制整个技能目录到 $HOME/.openclaw/workspace/skills。该行为属于向宿主环境部署文件，而不是食谱生成功能本身；如果清单未说明存在安装/部署行为，这与描述存在轻度偏离。

Content

No source excerpt is available for this finding.