Generate Restaurant Ad Creative Brief

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:33 AM UTC
• Version: 1.0.0

Overview

This skill is a simple restaurant ad brief generator, but it asks for broad shell and file-reading access that does not fit its stated creative-writing purpose.

Review this before installing because it grants more local authority than a restaurant ad planning skill appears to need. Prefer a version that removes Bash and Read or run it only in a sandbox without sensitive files or credentials available.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:7

Finding

Excessive Shell and Filesystem Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 7
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable Code:

yaml

allowed-tools: Bash, Read

Technical Analysis

The skill is designed to generate restaurant advertising creative briefs. Its documented workflow consists of gathering campaign requirements, drafting content, enriching supporting assets, and refining the output. This functionality does not inherently require arbitrary shell command execution or unrestricted access to local files.

Granting both Bash and Read violates the principle of least privilege. If untrusted campaign content, retrieved material, or prompt-injection text influences the agent, the available tools could be used to inspect local files or execute operating-system commands outside the legitimate scope of creative-brief generation.

Attack Path

1. A user supplies campaign material containing malicious or adversarial instructions, or such instructions enter through externally sourced supporting content.
2. The skill processes that content while retaining access to Read and Bash.
3. The adversarial instructions induce the agent to read local configuration, credential, or project files.
4. The agent may then invoke shell commands to enumerate the environment, process collected information, or perform other actions permitted by the host account.
5. The resulting access extends beyond the skill's advertised creative-planning purpose.

Exploitation depends on the agent following malicious instructions, but the unnecessary permissions materially increase the consequences of such an instruction-level compromise.

Impact Assessment

Successful exploitation could expose any local files readable by the account running the agent and allow command execution with that account's privileges. The precise scope depends on the host sandbox and operating-system permis ...[truncated 245 chars]

Remediation

View remediation

Remediation Suggestions

• Remove Bash and Read from allowed-tools because they are not required for the documented task.
• Permit only the narrowly scoped chat and image-generation capabilities necessary to produce the creative brief.
• If reading a user-provided asset becomes necessary, use a restricted file-reading capability limited to an explicitly approved file or workspace directory.
• Require explicit user confirmation before accessing local resources.
• Run the skill in a sandbox with no access to credentials, sensitive environment variables, or unrelated project files.
• Add tests confirming that untrusted campaign content cannot trigger filesystem access or shell execution.

T08 · Insecure Dependencies

Note

• Location: README.md:7

Finding

Installation Instructions Use Unpinned Remote Sources

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 7-14
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Low

Vulnerable Code:

bash

clawhub install qiaomu-generate-restaurant-ad-creative-brief

bash

git clone https://github.com/qiaomucom/generate-restaurant-ad-creative-brief.git
cp -r generate-restaurant-ad-creative-brief ~/.openclaw/skills/generate-restaurant-ad-creative-brief

Technical Analysis

Both documented installation methods retrieve mutable remote content without pinning an immutable package version, release tag, full Git commit hash, checksum, or signature. Consequently, the artifact installed in the future may differ from the files covered by this audit.

This is a supply-chain integrity weakness rather than evidence that the current remote sources are malicious. If the registry entry, repository, maintainer account, or publishing process is compromised, altered content can be delivered through otherwise legitimate-looking installation commands.

Attack Path

1. An attacker compromises the package publisher, registry entry, source repository, or maintainer credentials.
2. The attacker publishes a modified skill or changes the repository's default branch.
3. A user runs one of the documented unpinned installation commands.
4. The installer retrieves the attacker's modified content rather than the version reviewed in this audit.
5. OpenClaw loads the modified skill with whatever tools and privileges its manifest requests, allowing the substituted content to act in the user's environment.

Impact Assessment

The immediate project files contain no embedded executable payload, so no direct compromise is established. However, successful upstream substitution could introduce malicious instructions, scripts, broader tool permissions, or data-access behavior. The eventual impact would depend on the substituted package and the privileges granted by the Op ...[truncated 121 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the ClawHub installation command to a documented, immutable package version.
• For manual installation, check out a full audited Git commit hash instead of implicitly using the mutable default branch.
• Publish and verify a cryptographic checksum or signed release manifest before installation.
• Prefer signed release artifacts and document the expected signer identity and verification procedure.
• Enable protected release branches, multi-factor authentication, and restricted publishing permissions for upstream maintainer accounts.
• Repeat security review whenever the pinned version, commit, or checksum changes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.