Hotel Social Automator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:58 AM UTC
• Version: 1.0.1

Overview

The skill is purpose-aligned for social media publishing, but it gives agents unsafe command and credential-handling guidance around a high-impact posting workflow.

Review before installing. Use this only in a workspace where the configured tokens are allowed to publish for the intended brand, require a final human preview before publish or schedule actions, treat uk_* and hp_sk_* values as secrets, and avoid following the raw curl and /tmp examples without safer URL validation and unique private temp files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:153

Finding

Shell Command Injection Through Unquoted Remote Image URLs

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/feishu-guide.md:46

Finding

Predictable Shared Temporary File Enables Symlink and Race Attacks

Content

View full analysis

/tmp/card.json << 'EOF' { "config": {"wide_screen_mode": true}, "header": {"title": {"tag": "plain_text", "content": "Card Title"}, "template": "blue"}, "elements": [ {"tag": "div", "text": {"tag": "plain_text", "content": "First paragraph content"}}, {"tag": "div", "text": {"tag": "plain_text", "content": "#tag1 #tag2"}} ] } EOF ``` The generated file is subsequently consumed using the same predictable path: ```bash feishu-send card "oc_demo_group_id" /tmp/card.json feishu-send card "ou_demo_user_id" /tmp/card.json ``` The complete example later deletes it with: ```bash rm /tmp/card.json ``` ### Technical Analysis The guide uses a fixed filename, `/tmp/card.json`, in a shared temporary directory. Shell redirection does not securely create a new file; it opens the existing path and follows symbolic links where operating-system protections permit it. The predictable path creates several risks: - A local attacker may pre-create the path as a symbolic link to another file. - Another process or concurrent skill invocation may replace the file between creation and sending. - Multiple sessions may overwrite each other’s card content. - The file may be created with permissions affected by the process umask and remain readable longer than intended. - Cleanup using the same predictable path can remove a file created by another concurrent invocation. Some systems enable protected-symlink controls that reduce particular `/tmp` attacks, but the documentation does not require or verify those controls. Concurrent replacement and cross-session collision risks remain. ### Attack Path 1. An attacker with local access monitors or anticipates the skill invocation. 2. Before the card is created, the attacker places a symlink or conflicting file ...[truncated 1339 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/feishu-guide.md (reported line 133)May include surrounding context.

feishu-send image "oc_demo_group_id" /root/.openclaw/workspace/post3.png

4. Clean up

rm /tmp/card.json

text

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file states 'Must use mcporter to call MCP server tools — do NOT use exec/curl' and repeats that direct curl access to the MCP API is forbidden. Later guidance explicitly instructs use of curl and shell-style parallel execution for downloading images, creating a contradictory operational instruction set about tool usage.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation criteria are broad enough to trigger on generic terms like 'hotel', 'post', or platform names, which can cause unintended invocation. Over-broad activation can lead the agent to engage this skill in contexts the user did not intend, increasing the chance of unnecessary access to connected services or accidental publishing workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow includes publish_post and schedule_post to external social media accounts, but the description does not prominently warn that using the skill can create real external posts. Without a clear warning and confirmation step, users may unintentionally authorize reputationally sensitive, irreversible, or publicly visible actions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file states that zh is the default language and instructs using en only when the user requests English, which imposes a specific language choice by default. This is a locale/language policy issue because the skill does not ask for or offer a neutral user language preference before defaulting to Chinese.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs downloading external images and writing them to /root/.openclaw/workspace/, but does not prominently warn users about those side effects. This matters because remote downloads and privileged-path writes expand the attack surface, can expose the system to malicious file content, and may violate user expectations about local persistence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The examples normalize direct use of publish_post and schedule_post against real social accounts without showing a clear confirmation step or warning that these actions create external side effects. In an agent setting, example flows strongly influence implementation and model behavior, so this can lead to accidental posting, scheduling, or modification of public-facing brand content if the assistant follows the pattern too eagerly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The guide instructs agents to send cards and images to Feishu recipients but provides no warning or control guidance about recipient verification, data sensitivity, or external transmission risks. In a skill that publishes social media content through messaging infrastructure, this omission increases the chance of accidental disclosure of unpublished content, internal images, or messages sent to the wrong chat.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The onboarding guide instructs users to manually copy long-lived sensitive tokens and paste them directly into agent MCP configuration headers, but it does not clearly warn that these credentials are secrets or explain the risks of storing them in plaintext config, logs, screenshots, or shared workspaces. This increases the chance of accidental credential exposure, token reuse across contexts, and unauthorized workspace access if the config file or host environment is compromised.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The skill requires downloading remote images and writing temporary files under /root, but those capabilities are not clearly disclosed in the manifest description. Hidden filesystem and network side effects reduce user and platform visibility into what the skill can do, increasing the risk of unsafe execution and trust violations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest describes a skill centered on MCP-based social media content generation, review, and publishing. The added capability to invoke a separate Feishu notification tool introduces an IM/push-notification function outside that core purpose, and the manifest description does not mention notifications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.