openclaw-skill-ideation

• Analyzed: May 12, 2026, 4:20 AM
• Findings: 1
• Version: 0.1.0
• Hash: 13bc922861130d5f275c41934af5e9ecdb88509d0335ffd51ba174b5f83f111c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `SKILL.md` file instructs the AI agent to perform 'file reading and search' across the existing codebase to understand project structure and relevant code. While this capability is plausible for the skill's stated purpose of generating implementation artifacts based on an existing project, it grants broad file system access. This presents a significant prompt injection vulnerability, as a malicious user could potentially trick the agent into reading sensitive files (e.g., configuration, credentials) and incorporating their content into generated outputs or agent responses, leading to information disclosure. Additionally, the `spec-template.md` includes example `bash` validation commands, which, if maliciously generated by the agent (via prompt injection) and executed by a user, could lead to remote code execution.