Skill Combo Recommender

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 6:29 AM UTC
• Version: 1.0.0

Overview

This skill is a local workflow recommender that does not itself access accounts, files, networks, credentials, or external APIs.

Install only from a directory you trust, and avoid setting OPENCLAW_SKILLS_DIR to a broad or sensitive path because the installer overwrites the existing same-named skill folder. Treat recommended downstream skills separately: proxy, social-publishing, financial, and file-organization tools may have their own account, compliance, or data-loss risks.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The script deletes a directory using rm -rf with a path derived in part from the environment variable OPENCLAW_SKILLS_DIR. Although the path components are quoted, an attacker or unsafe caller can point OPENCLAW_SKILLS_DIR at an unintended location, causing destructive deletion of arbitrary directories matching the appended skill name during installation.

Content

Scanner excerpt · install.sh (reported line 29)May include surrounding context.

sh

if [ -d "$OPENCLAW_SKILLS_DIR/$SKILL_NAME" ]; then
    echo "⚠️  技能已存在，将覆盖..."
    rm -rf "$OPENCLAW_SKILLS_DIR/$SKILL_NAME"
fi

cp -r "$SKILL_DIR" "$OPENCLAW_SKILLS_DIR/$SKILL_NAME"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README recommends a workflow that includes setting proxy IPs for social-media operations without any disclosure of network, account, privacy, or policy risks. Even though this is documentation rather than executable code, it normalizes potentially sensitive operational behavior and may lead users to perform privacy- or compliance-impacting actions without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file-organization workflow describes automated handling of downloads, photos, and other files without warning that user files may be moved, renamed, or reorganized. This can cause data loss, confusion, or unintended modification if users assume the workflow is risk-free.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file presents nearly all substantive instructions, examples, and usage guidance in Chinese, while not stating that the skill is intentionally limited to Chinese-speaking users or offering an alternative language. That creates a natural-language policy concern because the skill effectively forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This shell script presents all user-facing instructions and status messages in Chinese, which effectively forces a specific language for installation and usage guidance. Under the policy, language-specific behavior should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description is written entirely in Chinese and presents the skill in that language without any indication that users can choose another language or that the skill is intended only for a Chinese-speaking audience. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This Python skill presents its title, description, workflow names, examples, and user-facing CLI help/output in Chinese, but it does not offer an opt-in language selection or explain that the tool is intentionally limited to a Chinese-speaking context. That creates a natural-language locale policy issue because the skill effectively enforces one language for all users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The skill documentation is written entirely in Chinese and does not indicate any option for users to choose another language or locale. Under the policy, forcing a specific language without opt-in can be a natural-language policy issue unless the locale restriction is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The comments in this requirements file are written only in Chinese, which imposes a specific language choice in the skill's natural-language content. The file does not offer an alternative language, user choice, or any justification that the skill is intended for a Chinese-only audience.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 50% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

# 本技能使用 Python 标准库，无需额外依赖

# Python 版本要求
python>=3.8

Static analysis

No suspicious patterns detected.