Security audit

Tolstoy MCP

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Tolstoy integration, but it gives an agent persistent access to publish, delete, and manage live commerce/social content without clear confirmation, scope, or revocation guidance.

Install only if you trust Tolstoy and intend to let OpenClaw act on the selected Tolstoy workspace. Treat publish, delete, store, social, ads, and analytics requests as sensitive; review outputs before sending anything live and know how to revoke the Tolstoy OAuth authorization if access is no longer needed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: PUBLISH.md:5
Finding: Unpinned Global Installation of the ClawHub Publishing CLI
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: PUBLISH.md:20
Finding: Predictable Shared Temporary Directory Used as the Publication Source
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · publish-to-clawhub.sh (reported line 14)May include surrounding context.
sh
rm -rf "$BUNDLE_DIR" mkdir -p "$BUNDLE_DIR" cp -r "$SKILL_DIR"/* "$BUNDLE_DIR"/ rm -rf "$BUNDLE_DIR/node_modules" 2>/dev/null || true echo "Publishing to ClawHub..." clawhub publish "$BUNDLE_DIR" \

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 9)May include surrounding context.
md
This skill configures OpenClaw to use Tolstoy's MCP (Model Context Protocol) server. Once installed and authenticated, you can use natural language to: - **Create and manage widgets** — Player widgets, shopper widgets, publish to your store - **Work with media** — Search your library, get assets, manage video content - **Product catalog** — Search products, list catalog, get product details - **AI Studio** — Generate images, animate images, text-to-video, edit videos

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill description says it can publish to Instagram, TikTok Shop, Shopify, and Meta Ads, which can affect user-owned external accounts and live storefronts. The README does not include any caution, confirmation expectation, or warning about the impact of these actions.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The skill states that the connection persists for future sessions after OAuth authorization, which implies ongoing access to a remote MCP server with content management and publishing privileges. Persistent authorization is not inherently unsafe, but without clear scoping, revocation, and user-awareness language, it increases the risk of later unintended use of previously granted capabilities.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: tolstoy-mcp description: Connect OpenClaw to Tolstoy's video commerce platform via MCP. Create widgets, manage media, generate AI videos, search products, and publish to Shopify/Instagram/TikTok. Use when the user wants to work with Tolstoy, create video widgets, manage e-commerce content, or integrate with Tolstoy's platform. triggers: tolstoy, video commerce, shopper widget, product video, AI video, Shopify widget, Tolstoy platform, gotolstoy ---

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger and description terms are broad enough that the skill may be invoked for loosely related e-commerce, video, or Shopify requests, not just explicit Tolstoy tasks. In a skill that can create, modify, and publish external content, over-broad activation increases the chance of unintended tool exposure and accidental destructive or externally visible actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill advertises publishing and content-modifying capabilities across third-party platforms such as Shopify, Instagram, and TikTok without clearly warning that these actions can make external, persistent changes. In this context, a user or agent could trigger real-world publication or modification of commerce assets without appreciating the scope or irreversibility of the action.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description grants very broad natural-language authority to create, manage, generate, and publish content across connected platforms without clearly constraining when those actions should occur. In an MCP/integration skill tied to e-commerce accounts, this can cause unsafe overreach, unintended destructive actions, or unauthorized publishing if an agent interprets vague prompts too aggressively.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest advertises publishing, content generation, and store-connected actions after OAuth authentication, but it does not warn that these operations can modify external accounts or push live content. In the context of Shopify, Instagram, TikTok Shop, and ad platforms, missing warnings and confirmation expectations materially increase the risk of accidental publication, reputational harm, and unwanted commercial changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The description states the skill can query store and performance data, which may expose business-sensitive analytics information. There is no accompanying notice that the skill accesses account data via the connected Tolstoy workspace.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.