Generate Roofing Contractor Client Education Handout

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:57 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a simple roofing handout generator, but it requests broad shell and file-reading authority that is not explained by its content-generation purpose.

Review this skill before installing. Its content instructions are ordinary, but the declared Bash and Read permissions are broader than needed for generating a handout; install only if you trust the publisher and your OpenClaw environment limits or prompts for those tools. Also verify the intended repository/source because the README and package metadata do not name the same GitHub owner.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:1

Finding

Unnecessary Shell and Filesystem Capabilities Violate Least Privilege

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:1-5
Vulnerability Type: Excessive agent tool permissions
Risk Level: Medium

Vulnerable Configuration:

yaml

---
name: Generate Roofing Contractor Client Education Handout
description: "Create a polished explainer handout with visuals, FAQs, and clear next steps for a roofing contractor. Use when handling client education work for..."
allowed-tools: Bash, Read
metadata:

Technical Analysis

The skill explicitly authorizes the Bash and Read tools, while its documented purpose and workflow are limited to generating and refining a roofing client-education handout. The listed workflow does not identify any operation that requires shell command execution or access to local files.

Granting Bash unnecessarily expands the skill's authority from content generation to arbitrary command execution within the permissions of the hosting agent process. Granting Read similarly exposes locally readable files without a documented functional requirement. This violates the principle of least privilege and increases the consequences of prompt injection, malicious source material, or accidental tool invocation.

The configuration does not itself contain a malicious command, and exploitation depends on untrusted instructions or model behavior causing the authorized tools to be invoked.

Attack Path

1. A user activates the skill to prepare a roofing handout.
2. The skill is loaded with Bash and Read authorization.
3. The agent processes attacker-controlled or otherwise untrusted content, such as copied roofing information or instructions embedded in source material.
4. That content attempts to induce the agent to read local files or issue shell commands.
5. Because the unnecessary tools are authorized, the agent may execute the requested operation within its runtime permission boundary.
6. Any resulting access is limited by the operating-system pri ...[truncated 567 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove Bash and Read from allowed-tools because neither capability is required by the documented workflow.
2. Permit only the content-generation interfaces needed for the skill, such as the declared chat and image-generation capabilities.
3. If local file input is later required, expose a narrowly scoped read interface restricted to user-selected files rather than general filesystem access.
4. If shell execution becomes necessary for a future feature, use an explicit command allowlist, argument validation, sandboxing, and per-invocation user approval.
5. Add a permissions review to release checks so that every authorized tool maps to a documented workflow requirement.

T08 · Insecure Dependencies

Warning

• Location: README.md:6

Finding

Mutable and Inconsistent Installation Sources Create Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: README.md:6-12 and package.json:8-10
Vulnerability Type: Unpinned remote installation source and repository identity mismatch
Risk Level: Medium

Installation Instructions:

markdown

### Via ClawHub
```bash
clawhub install qiaomu-generate-roofing-contractor-client-education-handout

Manual Installation

bash

git clone https://github.com/qiaomucom/generate-roofing-contractor-client-education-handout.git

Package Repository Metadata:

json

"repository": {
  "type": "git",
  "url": "https://github.com/TobeyRebecca/generate-roofing-contractor-client-education-handout.git"
}

Technical Analysis

The documented installation methods retrieve mutable remote content without pinning a version, commit identifier, checksum, or cryptographic signature. Consequently, the content installed later is not guaranteed to match the artifact reviewed during this audit.

The project also identifies two different GitHub owners. The manual installation instructions reference qiaomucom, while package.json references TobeyRebecca. The ClawHub package name uses a third owner-like prefix, qiaomu. This inconsistency makes it difficult for users to determine which source is authoritative and increases the likelihood of installing content from the wrong repository.

No malicious dependency, install script, or remote payload execution logic was present in the audited files. The risk arises if one of the mutable external sources is compromised, transferred, replaced, or incorrectly trusted.

Attack Path

1. An attacker compromises or gains control of one of the referenced repositories or the corresponding registry entry, or takes advantage of user confusion concerning the authoritative project owner.
2. The attacker modifies the remote skill content while retaining the expected project name.
3. A user follows the README and installs the l ...[truncated 975 chars]

Remediation

View remediation

Remediation Suggestions

1. Establish one authoritative repository owner and update README.md, package.json, ClawHub metadata, and the external project listing to use the same identity.
2. Pin installation instructions to a signed release tag or immutable commit hash rather than the current default branch.
3. Publish a SHA-256 checksum or cryptographic signature for each released artifact and document how users must verify it before installation.
4. Protect the repository and registry accounts with multi-factor authentication, restricted release permissions, and branch protection.
5. Use reproducible release archives so users can verify that registry artifacts correspond exactly to the tagged source.
6. Document the canonical source and explicitly warn users not to install similarly named packages or repositories.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The phrases "Use when handling client education work for..." and "Use this skill for client education work for roofing owners, home service operators" are broad and underspecified. They do not clearly define boundaries, exclusions, or concrete trigger phrases, which could cause the skill to be invoked for a wide range of general content tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.