Generate Travel Hospitality Ad Creative Brief

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:25 AM UTC
• Version: 1.0.0

Overview

This skill appears to be a simple travel ad brief generator, but it asks for command execution and local file-reading authority that its instructions do not justify.

Review this skill carefully before installing. Prefer the ClawHub-managed version or a pinned, verified release, and do not grant Bash or broad local file-read access unless the publisher documents exactly why it is needed and how it is constrained.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:15

Finding

Unnecessary Shell Execution and Local File Read Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15
Vulnerability Type: Excessive agent tool permissions
Risk Level: Medium

yaml

allowed-tools: Bash, Read

Technical Analysis

The Skill declares access to both Bash and Read, although its documented purpose is to generate travel and hospitality advertising briefs. The workflow in SKILL.md only requires gathering campaign requirements, producing content, optionally enriching assets, and refining the result. It does not document any need to execute operating-system commands or read arbitrary local files.

Granting these tools violates the principle of least privilege. Read can expose files available to the agent process, while Bash can execute commands with the privileges of that process. The declaration does not itself perform unauthorized actions, but it creates an unnecessary capability boundary that could be abused if the Skill instructions, external inputs, or upstream package are later compromised.

Attack Path

1. A user installs and loads the Skill, granting it the declared Bash and Read tools.
2. The Skill processes malicious campaign content, compromised instructions, or a malicious future version of the Skill.
3. Those instructions cause the agent to invoke Read against accessible local files or execute commands through Bash.
4. The resulting data could be disclosed through generated output, or commands could modify resources available to the agent account.

This exploitation path is conditional; the reviewed files contain no instruction that currently invokes these tools maliciously.

Impact Assessment

Successful abuse could read data accessible to the agent process and execute shell commands under the agent's operating-system identity. The precise scope depends on runtime sandboxing, filesystem permissions, command restrictions, and whether credentials or sensitive files are available to that identity. No privilege-e ...[truncated 98 chars]

Remediation

View remediation

Remediation Suggestions

Remove Bash and Read from allowed-tools because they are not required by the documented content-generation workflow. Grant only the chat and image-generation capabilities necessary for the Skill's stated purpose.

If local file access is genuinely required, replace unrestricted access with a narrowly scoped interface that:

• Allows reads only from explicitly approved input paths.
• Rejects traversal and symbolic-link escapes.
• Prevents access to credentials, configuration files, and unrelated user data.
• Records file-access events for review.

If command execution is essential, document the exact commands and arguments, use a strict allowlist, avoid shell interpretation, run the command in a sandbox with minimal filesystem and network access, and require explicit user approval before execution.

T08 · Insecure Dependencies

Warning

• Location: README.md:13

Finding

Installation from an Unpinned Mutable Git Repository

Content

View full analysis

Vulnerability Details

File Location: README.md:13-16
Vulnerability Type: Unverified and mutable installation source
Risk Level: Medium

bash

git clone https://github.com/qiaomucom/generate-travel-hospitality-ad-creative-brief.git
cp -r generate-travel-hospitality-ad-creative-brief ~/.openclaw/skills/generate-travel-hospitality-ad-creative-brief

Technical Analysis

The manual installation procedure clones the repository's current default branch and copies its contents directly into the user's OpenClaw Skill directory. It does not pin a reviewed commit or release and provides no signature or checksum verification.

Consequently, the artifact installed by a user can differ from the version covered by this audit. A later upstream change or repository compromise could add malicious Skill instructions, scripts, or expanded permissions. Copying the result into the active Skill directory would then place the changed content in a location from which the agent can load it.

The reviewed repository snapshot contains no embedded malicious scripts or executable payload. The risk arises from the mutable, unverified supply-chain installation procedure.

Attack Path

1. An attacker compromises the upstream repository or gains authority to publish a malicious change.
2. The attacker modifies the default branch after this version has been reviewed.
3. A user follows the README and clones the mutable default branch without selecting a known commit.
4. The user copies the unverified contents into ~/.openclaw/skills/.
5. OpenClaw loads the altered Skill with its declared permissions, allowing the newly introduced instructions or code to affect agent behavior.

Impact Assessment

The impact is determined by the contents of a malicious upstream revision and the permissions available to the Skill. Given the current declaration of Bash and Read, a compromised future version could potentially read files or e ...[truncated 155 chars]

Remediation

View remediation

Remediation Suggestions

Replace installation from the mutable default branch with a reproducible, integrity-verified process:

• Publish versioned releases and instruct users to install a specific reviewed version.
• Pin the source to an immutable commit hash or signed release tag.
• Publish a SHA-256 or stronger digest for the release artifact and require verification before installation.
• Sign releases using a verifiable maintainer identity.
• Prefer an installer that verifies provenance and integrity before writing into the active Skill directory.
• Advise users to review the manifest, permissions, instructions, and bundled scripts before activation.
• Treat updates as new artifacts requiring permission review rather than silently replacing an installed Skill.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The suggested prompt, "[Generate Travel Hospitality Ad Creative Brief] for my team," is generic enough to resemble ordinary workplace language and can be invoked unintentionally in normal conversation. In systems that auto-detect or trigger skills from user phrasing, this increases the risk of accidental activation, context hijacking, or routing a request into this skill when the user did not explicitly intend it.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.