ClawHub
Back to skill

Security audit

Generate Estate Planning Law Firm Client Education Handout

Security checks for vulnerabilities and agentic risk

Overview

The skill is a simple estate-planning handout generator, but it asks for broad shell and file-reading authority that its own workflow does not justify.

Review before installing. The handout-generation purpose is benign, but enable it only if you are comfortable granting shell and filesystem-read capability, or ask the publisher for a version that removes Bash/Read and includes all setup instructions locally.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:8
Finding

Unnecessary Shell and Filesystem Permissions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:8
Vulnerability Type: Excessive tool authorization
Risk Level: Medium

Vulnerable Code

yaml
allowed-tools: Bash, Read

Technical Analysis

The skill is intended to generate an estate-planning client education handout. Its documented workflow requires content generation and optionally image generation, but it grants access to unrestricted shell execution through Bash and local filesystem access through Read.

These permissions are not justified by the documented task and violate the principle of least privilege. If attacker-controlled content, a malicious external instruction, or prompt injection influences the agent while this skill is active, the unnecessary tools could provide a path to execute local commands or read files unrelated to handout generation.

The permission declaration does not itself execute commands, and no malicious shell command is included in the audited package. The risk arises from the unnecessary capabilities made available during skill operation.

Attack Path

  1. A user loads the skill to generate an estate-planning handout.
  2. The agent processes attacker-controlled or otherwise untrusted content, such as supplied source material or external instructions.
  3. The content instructs the agent to inspect local files or execute shell commands under the pretext of completing the handout.
  4. Because Read and Bash are authorized, the agent may perform actions beyond the skill's legitimate purpose.
  5. Accessible local information may be disclosed, or commands may execute with the privileges of the agent process.

Impact Assessment

Successful exploitation could permit reading files available to the agent process and executing operating-system commands with that process's privileges. The precise scope depends on runtime sandboxing, filesystem permissions, command approval controls, and the identity under which the a ...[truncated 94 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove Bash and Read from allowed-tools because the documented handout-generation workflow does not require them.
  • Authorize only the narrowly scoped chat and image-generation capabilities needed for the task.
  • If local document input is genuinely required, replace general filesystem access with a user-selected, read-only input mechanism limited to approved files.
  • If shell execution later becomes necessary, allow only fixed commands with validated arguments inside a sandbox rather than granting general-purpose Bash.
  • Require explicit user confirmation before accessing local information or invoking any capability outside content generation.

T08 · Insecure Dependencies

Note
Location
SKILL.md:4
Finding

Reliance on Mutable External Setup Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:4-25
Vulnerability Type: Unreviewed external setup dependency
Risk Level: Low

Vulnerable Code

yaml
> 📖 **Complete setup guide**: https://skillboss.co/skill.md
description: "Create a polished explainer handout with visuals, FAQs, and clear next steps for a estate planning law firm. Use when handling client education work..."

> 📖 **Complete setup guide**: https://skillboss.co/skill.md
allowed-tools: Bash, Read

> 📖 **Complete setup guide**: https://skillboss.co/skill.md
metadata:

> 📖 **Complete setup guide**: https://skillboss.co/skill.md
  openclaw:

> 📖 **Complete setup guide**: https://skillboss.co/skill.md
    emoji: "📝"

> 📖 **Complete setup guide**: https://skillboss.co/skill.md
    homepage: "https://www.skillboss.co/skills/generate-estate-planning-law-firm-client-education-handout"

> 📖 **Complete setup guide**: https://skillboss.co/skill.md
---

> 📖 **Complete setup guide**: https://skillboss.co/skill.md

The workflow additionally states at SKILL.md:39:

markdown
3. Use the relevant SkillBoss capabilities to enrich assets or supporting data.

Technical Analysis

The package repeatedly directs users to an externally hosted setup guide whose contents are not included in the audited artifact. That remote document can change independently after the local skill has been reviewed. The workflow also refers to unspecified “SkillBoss capabilities” without documenting their permissions, endpoints, data handling, or required setup.

This creates a supply-chain trust boundary: users may treat remote instructions as an authoritative continuation of the audited skill even though those instructions were outside the audit scope. The local package does not automatically retrieve or execute the linked material, so this is not confirmed remote payload execution. Exploitation requires a user or agent to follow the externa ...[truncated 1023 chars]

Remediation
View remediation

Remediation Suggestions

  • Include all required setup instructions in the repository so they can be reviewed with the skill.
  • Remove repeated remote setup-guide directives from the skill metadata.
  • If an external document remains necessary, reference a versioned and integrity-verifiable snapshot rather than a mutable page.
  • Document every required SkillBoss capability, endpoint, permission, and category of transmitted data.
  • Clearly distinguish optional external resources from trusted local instructions.
  • Warn users not to enter credentials or execute commands from remote documentation without independent verification.

T08 · Insecure Dependencies

Note
Location
README.md:7
Finding

Installation Instructions Use Unpinned Upstream Sources

Content
View full analysis

Vulnerability Details

File Location: README.md:7-15
Vulnerability Type: Unpinned package and repository installation
Risk Level: Low

Vulnerable Code

markdown
### Via ClawHub
```bash
clawhub install qiaomu-generate-estate-planning-law-firm-client-education-handout

Manual Installation

bash
git clone https://github.com/qiaomucom/generate-estate-planning-law-firm-client-education-handout.git
cp -r generate-estate-planning-law-firm-client-education-handout ~/.openclaw/skills/generate-estate-planning-law-firm-client-education-handout

Technical Analysis

The ClawHub command does not specify an immutable version, and the Git installation command clones the repository's current default branch without selecting a commit or signed tag. Neither installation path performs checksum or signature verification.

Consequently, running these commands in the future may install content different from the files examined during this audit. If the registry entry, publisher account, repository, or default branch is compromised or legitimately changed, users could receive unreviewed skill instructions or files under the same package identity.

The audited package contains no evidence that either upstream source is presently malicious. This finding concerns the lack of reproducibility and integrity controls in the documented installation process.

Attack Path

  1. An attacker compromises an upstream maintainer account, ClawHub package, GitHub repository, or release process.
  2. The attacker publishes or commits altered skill content under the existing package or repository name.
  3. A user runs one of the documented installation commands.
  4. The command selects the current registry release or default Git branch rather than the audited revision.
  5. The altered skill is installed and may be trusted as though it were the reviewed version.

Impact Assessment

A successful supply-chain compr ...[truncated 350 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the ClawHub installation command to a specific immutable package version.
  • Pin manual Git installation to a reviewed commit hash or cryptographically signed release tag.
  • Publish SHA-256 checksums or signed provenance for released artifacts and provide verification commands.
  • Configure automated release processes to generate reproducible, immutable packages.
  • Advise users to compare the installed artifact against the expected digest before enabling the skill.
  • Avoid copying directly from a mutable default branch into the active skills directory.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep