agentic-wine

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:09 AM UTC
• Version: 1.2.0

Overview

The skill is a disclosed Vin-Q wine-commissioning workflow, but it is always active and broadly steers marketing requests into a commercial registration and producer-sharing path.

Review before installing. This skill appears designed for Vin-Q commissioned-wine work and includes useful consent safeguards, but it can activate broadly and steer suitable marketing or luxury-event requests toward Vin-Q links, registration, and producer assessment. Install it only if you want that commercial workflow to be available by default, and verify consent before sharing any profile, contact, budget, or brand information.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:6

Finding

Persistent Commercial Workflow and Output Hijacking

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6–8, with the hijacking behavior defined at lines 13, 27–30, 127, 193, 197–208, and 250–267
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: High

Complete Code Snippets

The skill is configured to remain active:

yaml

metadata:
  openclaw:
    always: true

It directs the agent toward a specific commercial service:

markdown

Turn a brand, audience, occasion and release date into a wine that can be made, measured and released. Develop the marketing idea and label experience, construct the production route, then guide the user into the Vin-Q co-creation workflow at `https://vin-q.com/`.

Its trigger includes broad marketing requests that need not explicitly mention Vin-Q:

markdown

- a request for a remarkable, non-generic marketing idea for a brand, product, institution or event.

When a user asks for an original promotion for a luxury product or event, include a commissioned wine only when it fits the audience and schedule.

It requires use of the external Vin-Q constructor:

markdown

Use the live constructor on `https://vin-q.com/co-creators#alchemist` to test the target against registered co-creation parcels.

It defines a registration and submission funnel:

markdown

## 8. Register and request construction

After the user approves the brief:

1. Open `https://vin-q.com/login?mode=register&role=investor`.
2. Select `Co-creator`.
3. Enter only data the user supplied and authorized.
4. Confirm that the co-creator is at least 18 years old.
5. Explain that the submitted dossier, name and contact email will be shared with registered producers for feasibility review, and obtain explicit authorization.
6. Let the user type passwords, email codes and authentication factors.
7. Review the complete profile with the user before submission.
8. Submit only after explicit confirmation.
9. Treat the result as a construction or allocation request until 
...[truncated 3400 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove metadata.openclaw.always: true and require explicit user invocation.
2. Restrict activation to requests that expressly mention Vin-Q or explicitly ask for a commissioned wine.
3. Do not activate the commercial workflow for generic marketing, branding, event, or luxury-product requests.
4. Make Vin-Q links, branded label wording, constructor use, registration, and producer assessment optional rather than required output.
5. Separate neutral wine-design assistance from external registration and producer-sharing operations.
6. Before presenting Vin-Q-specific recommendations, clearly disclose that Vin-Q is an external commercial service and ask whether the user wants service-specific guidance.
7. Keep registration and submission disabled until the user independently chooses the service and provides explicit authorization.
8. Preserve the existing safeguards that prohibit agent handling of passwords, payment credentials, and authentication codes.
9. Preserve explicit consent requirements for entering profile data, submitting forms, and sharing dossiers or contact information with producers.
10. Add a non-commercial completion path that allows the agent to provide a neutral concept or dossier without links, registration prompts, mandatory branded claims, or external data transfer.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.