Generate Webinar Presentation Deck

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:25 AM UTC
• Version: 1.0.0

Overview

This is a simple webinar-deck generation skill, but it requests broad local Bash and file-read authority without explaining why that access is needed.

Review this skill before granting Bash or broad file-read access. Installing from a pinned, reviewed release is safer than cloning the current default branch, and generated deck content should be reviewed before publication.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:5

Finding

Unpinned Third-Party Skill Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 5-14
Vulnerability Type: Unverified and mutable third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown

## Installation

### Via ClawHub
```bash
clawhub install qiaomu-generate-webinar-presentation-deck

Manual Installation

bash

git clone https://github.com/qiaomucom/generate-webinar-presentation-deck.git
cp -r generate-webinar-presentation-deck ~/.openclaw/skills/generate-webinar-presentation-deck

text

### Technical Analysis

Both documented installation methods retrieve mutable third-party content without specifying an immutable package version, Git commit, checksum, or cryptographic signature. The manual procedure clones the repository's current default branch and copies it directly into the user's active OpenClaw skills directory.

Consequently, the installed content may differ from the version covered by this audit. If the ClawHub publisher account, source repository, release process, or associated credentials are compromised, an attacker could replace the reviewed content with malicious Skill instructions, scripts, or configuration.

This is a supply-chain weakness rather than evidence that the currently reviewed files are malicious. The audited project itself contains only `README.md` and `SKILL.md`; no embedded malicious script was identified.

### Attack Path

1. An attacker compromises the upstream ClawHub publisher account, GitHub repository, or release workflow.
2. The attacker publishes or commits a modified Skill containing malicious instructions, executable scripts, or unsafe tool usage.
3. A user follows the documented unpinned installation command.
4. The installer retrieves the attacker's current upstream version rather than the audited revision.
5. In the manual installation path, the unverified files are copied into `~/.openclaw/skills/generate-webinar-presentation-deck`.

...[truncated 948 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin ClawHub installation instructions to a specific, reviewed package version rather than implicitly installing the latest release.
2. Pin the manual installation to an immutable Git commit or signed release tag, for example by checking out a documented commit hash after cloning.
3. Publish a SHA-256 checksum for each reviewed release and require users to verify it before copying files into the active skills directory.
4. Cryptographically sign release artifacts and document signature verification using a trusted maintainer key.
5. Download and inspect the Skill in a staging directory before activation; do not copy mutable upstream content directly into ~/.openclaw/skills.
6. Configure OpenClaw to require explicit approval for newly installed or changed Skills, particularly before granting Bash access.
7. Add automated release checks that compare packaged files against the reviewed source revision and reject unexpected scripts, binaries, or permission changes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.