Hotel Asset Marketer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:54 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned for HotelPost social-media publishing, but it needs review because it can publish or schedule real posts while storing powerful tokens in agent config and giving under-scoped shell/file handling guidance.

Review this skill before installing. Use it only for a HotelPost workspace where you are comfortable letting the agent draft, schedule, and publish to connected social accounts. Store hp_sk_* and uk_* values in a protected secret store when possible, rotate them if exposed, require explicit confirmation before every publish or schedule action, and avoid blindly downloading or forwarding image URLs returned by the MCP service.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:153

Finding

Unvalidated MCP-Provided Image URLs Can Access Local or Internal Resources

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/feishu-guide.md:54

Finding

Predictable Shared Temporary File Enables Symlink and Cross-Session Attacks

Content

View full analysis

/tmp/card.json << 'EOF' { "config": {"wide_screen_mode": true}, "header": {"title": {"tag": "plain_text", "content": "Card Title"}, "template": "blue"}, "elements": [ {"tag": "div", "text": {"tag": "plain_text", "content": "First paragraph content"}}, {"tag": "div", "text": {"tag": "plain_text", "content": "#tag1 #tag2"}} ] } EOF ``` The complete example later uses and deletes the same fixed path: ```bash feishu-send card "oc_demo_group_id" /tmp/card.json # 4. Clean up rm /tmp/card.json ``` ### Technical Analysis The guide creates card data at the fixed, globally predictable path `/tmp/card.json` using ordinary shell redirection. Shared temporary directories are commonly writable by other local users and processes. Shell redirection follows symbolic links. If another local process creates `/tmp/card.json` as a symbolic link before the command runs, the redirection can truncate and overwrite the link target with the privileges of the agent. No exclusive file creation, symlink protection, ownership verification, or restrictive file mode is required. The fixed filename also introduces a race between concurrent skill invocations. One invocation can overwrite or delete another invocation's card file between creation and transmission. This could send the wrong content or target-specific information to an unintended conversation. ### Attack Path 1. A local attacker predicts that the skill will use `/tmp/card.json`. 2. Before card creation, the attacker creates `/tmp/card.json` as a symbolic link to a file writable by the agent, or repeatedly replaces the path during execution. 3. The agent executes `cat > /tmp/card.json` with elevated privileges. 4. The shell follows the symboli ...[truncated 1148 chars]

Remediation

View remediation

"$card_file" <<'EOF' { "config": {"wide_screen_mode": true} } EOF feishu-send card "$target_id" "$card_file" ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/user-onboarding.md:67

Finding

Long-Lived Bearer Credentials Are Stored Directly in Agent Configuration

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/feishu-guide.md (reported line 133)May include surrounding context.

feishu-send image "oc_demo_group_id" /root/.openclaw/workspace/post3.png

4. Clean up

rm /tmp/card.json

text

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly forbids using curl/exec for MCP access, but elsewhere instructs the agent to invoke shell commands like curl and mkdir for image handling, creating contradictory execution guidance. In an agent environment, this kind of mixed instruction can cause the model to perform unintended local shell actions, expand attack surface to SSRF or unsafe file writes from untrusted image URLs, and bypass safer tool-mediated controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation criteria are broad enough to trigger on generic terms like hotel, post, publish, Instagram, or marketing, which can cause the skill to activate outside the user's intended HotelPost workflow. In a skill capable of drafting, scheduling, and publishing to external accounts, over-activation increases the chance of inappropriate tool use, confusion about authority, or unintended external side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill supports publish_post and schedule_post, which can create real, externally visible changes on connected social media accounts, but it does not prominently warn users about that risk or require a strong confirmation boundary. In this context, missing irreversible-action warnings materially increases the chance of accidental publication, reputational harm, and cross-account misuse within a workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example flow shows the assistant proceeding from account listing directly to publishing without an explicit user-facing warning that publishing is an external side effect and may be difficult or impossible to undo. In a skill that can post to real social media accounts via authenticated connections, this increases the risk of accidental or socially engineered unauthorized posting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The scheduled publishing example states that publishing is set and will occur automatically, but it does not clearly warn before scheduling that the action will execute later unless cancelled. Because the skill can act with workspace token and AgentAuth-backed social connections, a user may unintentionally authorize future external posting that happens out of band and is easier to forget or overlook.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide instructs users to obtain and paste a live AgentAuth user token into agent configuration, but it does not clearly warn that the token is a sensitive secret or explain the consequences of leakage. Because this skill operates through an MCP server and requires persistent header-based authentication, mishandling the token could expose user identity and enable unauthorized MCP requests in combination with a workspace token.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide tells users to create and paste a raw hp_sk_* workspace API key into MCP headers without a prominent warning that it grants workspace-scoped access and must be treated like a password. In this skill context, that is more dangerous because the token directly authorizes agent actions against social media workspace resources, so leakage could allow unauthorized posting, review actions, or access to workspace content.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.