Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly a coherent content-template tool, but it needs Review because it can render stored Jinja2 templates with unsandboxed Python power and send rich business context to external LLM routing without clear user-facing controls.
Install only if you trust the templates and the local shared OpenClaw modules it imports. Treat Jinja2 template content as executable-risk input, and do not pass confidential brand profiles, persona data, or knowledge-base excerpts to the generate action unless your tenant policy allows those details to be sent through the configured LLM providers.
The skill advertises template management and polishing, but also sends rich user and tenant context to external LLM providers to generate full content. This expands the trust boundary significantly and can leak proprietary brand profiles, persona data, knowledge-base excerpts, and operational context to third-party services without the narrower scope implied by the skill description.
The template skill invokes a separate script for polish operations, creating an additional execution boundary and increasing attack surface. Even without shell injection, this design makes security depend on another executable component's argument handling, output parsing, timeout behavior, and any network or model calls it performs.
No suspicious patterns detected.
