idea-generator。超级深度思考-创意生成系统。通过多轮迭代筛选高分创意，每轮步骤：需求分析-信息搜集-洞察分析-创意生成-反馈-下一轮。项目集中了可视化的网页端。安装后在前端输入“启动创意工作台”即可启动服务。

• Outcome: Review
• Latest audit: May 28, 2026 · 8:39 AM UTC
• Version: 1.0.2

Overview

This appears to be an idea-generation workbench, but it gives the skill broader local service and OpenClaw task-control powers than the launcher description clearly discloses.

Install only if you are comfortable with a local web server that can start OpenClaw agent runs, perform web searches, and stop/cancel its stored OpenClaw tasks. Keep it on a trusted machine/network, review the server and startup scripts first, and avoid exposing port 50000 beyond localhost.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (21)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--delete-after-run",
            "--json"
        ]
        result = subprocess.run(cron_cmd, capture_output=True, text=True, timeout=10)
        if result.returncode == 0:
            cron_result = json.loads(result.stdout)
            wake_ok = True

• Confidence: 88% confidence
• Finding: The server launches an external openclaw cron task that causes autonomous agent execution, which exceeds the declared launcher-only behavior and can be triggered remotely through the HTTP API. Although subprocess is called without a shell, this still creates a powerful orchestration primitive that can start privileged actions and background sessions outside normal user review.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 3. 删除 cron 任务（防止任务还未启动就被触发）
    if cron_job_id:
        try:
            result = subprocess.run(
                ["openclaw", "cron", "rm", cron_job_id, "--json"],
                capture_output=True, text=True, timeout=5
            )

• Confidence: 77% confidence
• Finding: This command uses cron_job_id loaded from mutable state and passes it to an external task-management CLI without validating origin or ownership. A local or API-capable attacker who can influence state.json may be able to cancel arbitrary jobs known to the CLI, turning this endpoint into an unauthorized control channel.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# openclaw tasks cancel 接受 session key 作为 lookup
    if session_id:
        try:
            result = subprocess.run(
                ["openclaw", "tasks", "cancel", session_id],
                capture_output=True, text=True, timeout=10
            )

• Confidence: 81% confidence
• Finding: This cancellation command takes session_id from persisted state and uses it to control external agent tasks. If an attacker can alter state or call the unauthenticated API sequence that sets session identifiers, they may be able to terminate other sessions or interfere with unrelated workloads.

Tainted flow: 'req' from os.environ.get (line 366, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

},
                    method="POST"
                )
                resp = urllib.request.urlopen(req, timeout=3)
                wake_ok = resp.status == 200
                print(f"[info] wake hook fallback: ok={wake_ok}")
        except Exception as e2:

• Confidence: 91% confidence
• Finding: The code reads an authentication token from environment variables and uses it to perform an authenticated wake-hook request, enabling the skill to act with ambient platform credentials. In a skill that claims to only launch a workspace, this hidden capability materially expands authority and could be abused to trigger privileged agent behavior or external actions without user awareness.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The README materially overstates the skill’s behavior by claiming automatic web search and iterative content generation, while the metadata says the skill only launches a local workspace and returns a link. This kind of capability mismatch can mislead users and reviewers about what the agent will do, hide external network activity expectations, and create unsafe trust assumptions around autonomous actions.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The documented trigger phrases are much broader than the declared activation phrases and include ordinary brainstorming requests, which can cause unintended invocation of the skill. Broad undocumented activation surfaces increase the chance that normal conversation is interpreted as permission to launch services or initiate workflows the user did not explicitly request.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest claims the skill only starts a workstation and returns a link, but the instructions define a complete multi-round generation agent with external search and persistent logging. Hidden secondary behavior increases the risk of unintended automation, unanticipated data handling, and unsafe invocation under false assumptions.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The skill includes external web-search behavior that is not necessary for merely launching a local workstation. Unnecessary outbound browsing expands attack surface, can leak user intent or task context to third parties, and violates least privilege for the stated use case.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The document explicitly says activation ends after startup and no idea generation is performed, yet later mandates a full idea-generation flow by the same skill. Contradictory instructions are dangerous because they hide meaningful behavior and make it difficult for users, reviewers, and policy systems to understand what will actually happen.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The script's documented behavior and implementation allow it to directly create, send to, and abort chat sessions over the gateway, which exceeds the skill's stated purpose of only launching a workspace service and returning an access link. This creates an unnecessary privileged control path that could be abused to manipulate conversations or perform actions on behalf of the user without going through the expected web UI.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code reads a local gateway auth token from the user's home directory and uses it to authenticate direct WebSocket control of sessions. In the context of a launcher-only skill, harvesting local credentials to gain broader control is unjustified and increases the blast radius if the skill is triggered or modified maliciously.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The implementation does far more than launch a workspace and return a link: it creates tasks, wakes agents, manages iterations, validates searches, and updates workflow state. This scope mismatch is dangerous because users and reviewers may grant trust based on the benign description while the code performs autonomous orchestration with broader side effects.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The server can remove cron jobs and cancel agent tasks through external commands, capabilities that are unrelated to a simple workspace launcher. Hidden task-control powers increase the blast radius of any compromise and enable denial-of-service or workflow manipulation against other agent sessions.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The fallback logic reads gateway configuration and an auth token from the environment to make authenticated internal network calls, which is outside the stated launcher-only purpose. Even if intended as reliability logic, it quietly grants the skill broader integration power than users would expect from the metadata.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The module advertises itself as an idea-generation API server, directly contradicting the manifest statement that it only starts a workspace and returns an access link. This discrepancy is a trust and transparency problem that can conceal materially riskier behavior during review.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: Examples like general idea requests and brainstorming prompts are overly broad and likely to overlap with normal conversation, making accidental triggering more likely. In a skill that starts a service and opens a local dashboard, unintended activation can lead to surprise process launches, port binding, or user confusion about what actions were taken on their behalf.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README says the skill will search external sites such as Baidu and Bilibili but does not clearly warn users that the workflow may involve outbound network access. Missing disclosure undermines informed consent and can expose user prompts or business topics to third-party services unexpectedly.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The activation phrases '打开工作台' and '开启工作台' are broad and likely to overlap with ordinary conversation, increasing the chance of accidental activation. Because activation triggers process checks and potential service startup, false triggers can cause unintended local side effects.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill automatically executes shell commands to discover directories, change into a scripts folder, and launch a background Python server without warning the user. Silent process creation and log/file side effects are risky because they modify local runtime state and may persist beyond the user interaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script unconditionally kills whatever process is listening on the configured port, without verifying that it is the skill's own server. If the port file is stale, user-controlled, or collides with another local service, this can terminate unrelated applications and cause denial of service on the host.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The watchdog unconditionally kills whatever process is listening on port 50000, without verifying that it is the intended idea-generator server. If another local service binds that port, this script can terminate the wrong process, causing denial of service and unsafe process management.

Static analysis

No suspicious patterns detected.