Security audit

Skill Package

Security checks for vulnerabilities and agentic risk

Overview

This skill’s sales automation purpose is clear, but it asks users to run mutable external code with credentials and scheduled cold-email/public-deployment automation without enough guardrails.

Review carefully before installing. Use a pinned, reviewed commit; install in an isolated environment; configure least-privilege API keys only after install; keep Google service-account keys protected; require manual approval before public deployments and each email batch; set strict sending limits; and document how to disable cron/systemd jobs and delete lead/generated-site data.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T06 · System Persistence

Error

Location: SKILL.md:115
Finding: Unattended Cross-Session Execution Through Scheduled Tasks or System Services
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:81
Finding: Mutable External Code Retrieval and Unverified Dependency Installation
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:36
Finding: Broad Disclosure of Lead and Contact Data to Multiple External Services
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill performs potentially sensitive and externally visible actions—scraping business websites, storing lead artifacts, deploying generated demo sites publicly, and sending automated cold outreach—but the description does not prominently warn users about these behaviors or their operational/compliance implications. This increases the chance of uninformed use, accidental data collection, reputational harm, or policy/legal violations because an operator may enable the pipeline without understanding its reach and automation level.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest explicitly advertises automated cold-email outreach but provides no warning, consent boundary, or acknowledgment of privacy, compliance, and reputation risks from contacting external parties. In this skill context, the capability is central to the workflow, which makes accidental misuse, spam complaints, and unauthorized outreach more likely rather than hypothetical.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/google-sheet-setup.md (reported line 31)May include surrounding context.
md
## Service Account Access 1. Create a GCP project and enable the Sheets API 2. Create a service account and download the JSON key 3. Share your sheet with the service account email (Editor access) 4. Save the JSON key to `~/.openclaw/workspace/gcp-service-account.json`

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document instructs users to download a Google service-account JSON key and store it at a fixed local path without any warning about the sensitivity of the credential, file-permission restrictions, rotation, or safer secret-management alternatives. Service-account keys are long-lived credentials; if the workstation, home directory, backups, or the workspace path are exposed, an attacker could use the key to access and modify the linked Google Sheet with the granted permissions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The description implies end-to-end automated outreach to businesses, yet there is no indication that users can review or control language, locale, or regional targeting before messages are generated and sent. In a cold-outreach pipeline, this increases the chance of inappropriate, noncompliant, or misleading messaging to recipients in the wrong language or jurisdiction.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.