Security audit
Security checks for vulnerabilities and agentic risk
The advertised chapter-lead writer itself is local and mostly purpose-aligned, but the package also ships broader pipeline routing and orchestration code that is not clearly disclosed by the narrow skill description.
Treat this as more than a simple lead-paragraph helper unless your OpenClaw environment only loads SKILL.md and scripts/run.py. Install it only in workspaces where broad research-pipeline files and local workspace status/report mutation are acceptable, and review auto-routing behavior before enabling it globally.
Validation of drafts, reviews, protocol files, LaTeX/PDF outputs, and other artifacts far exceeds the permissions implied by a chapter-lead writer. Such overreach can expose sensitive repository contents and alter or block workflow outcomes under a misleadingly benign interface.
Validation of drafts, reviews, protocol files, LaTeX/PDF outputs, and other artifacts far exceeds the permissions implied by a chapter-lead writer. Such overreach can expose sensitive repository contents and alter or block workflow outcomes under a misleadingly benign interface.
Validation of drafts, reviews, protocol files, LaTeX/PDF outputs, and other artifacts far exceeds the permissions implied by a chapter-lead writer. Such overreach can expose sensitive repository contents and alter or block workflow outcomes under a misleadingly benign interface.
Validation of drafts, reviews, protocol files, LaTeX/PDF outputs, and other artifacts far exceeds the permissions implied by a chapter-lead writer. Such overreach can expose sensitive repository contents and alter or block workflow outcomes under a misleadingly benign interface.
Validation of drafts, reviews, protocol files, LaTeX/PDF outputs, and other artifacts far exceeds the permissions implied by a chapter-lead writer. Such overreach can expose sensitive repository contents and alter or block workflow outcomes under a misleadingly benign interface.
Validation of drafts, reviews, protocol files, LaTeX/PDF outputs, and other artifacts far exceeds the permissions implied by a chapter-lead writer. Such overreach can expose sensitive repository contents and alter or block workflow outcomes under a misleadingly benign interface.
Validation of drafts, reviews, protocol files, LaTeX/PDF outputs, and other artifacts far exceeds the permissions implied by a chapter-lead writer. Such overreach can expose sensitive repository contents and alter or block workflow outcomes under a misleadingly benign interface.
Validation of drafts, reviews, protocol files, LaTeX/PDF outputs, and other artifacts far exceeds the permissions implied by a chapter-lead writer. Such overreach can expose sensitive repository contents and alter or block workflow outcomes under a misleadingly benign interface.
Referenced artifact was not completely inspected
This `SKILL.md` is now the **package router**, not the full method manual.
Referenced artifact was not completely inspected
This `SKILL.md` is now the **package router**, not the full method manual.
Referenced artifact was not completely inspected
- `scripts/run.py` remains in **compatibility mode** for active generation.
Referenced artifact was not completely inspected
- `scripts/run.py` remains in **compatibility mode** for active generation.
Referenced artifact was not completely inspected
- `scripts/run.py` remains in **compatibility mode** for active generation.
Referenced artifact was not completely inspected
- `scripts/run.py` remains in **compatibility mode** for active generation.
Referenced artifact was not completely inspected
- `scripts/run.py` remains in **compatibility mode** for active generation.
Referenced artifact was not completely inspected
- `scripts/run.py` remains in **compatibility mode** for active generation.
Referenced artifact was not completely inspected
- `scripts/run.py` remains in **compatibility mode** for active generation.
Referenced artifact was not completely inspected
- `scripts/run.py` remains in **compatibility mode** for active generation.
The code writes to broad control-plane files such as RUN_ERRORS.md, STATUS.md, UNITS.csv, DECISIONS.md, and other pipeline state, despite the manifest describing only generation of section lead markdown. In the context of a narrowly scoped writing skill, this hidden write authority is dangerous because it enables workflow tampering, misleading status updates, and persistence of unintended state changes.
The file is an orchestration executor for arbitrary pipeline units, not a narrowly scoped chapter-lead writer. That mismatch is dangerous because a user invoking a seemingly harmless writing skill may actually trigger broad workflow control, state mutation, and delegated code execution, violating least privilege and creating a substantial scope-expansion risk.
Subprocess execution is not justified by the manifest's stated purpose of drafting chapter lead paragraphs with no network and no new facts. In this context, embedding execution capability materially increases the attack surface because the skill can run arbitrary repository logic under the user's environment while appearing to be a simple content-generation helper.
This file implements a full research-ideation and memo-generation pipeline, including signal extraction, direction-card generation, scoring, ranking, and report production, which is materially unrelated to the declared skill of writing H2 chapter lead blocks. In an agent-skill setting, this is dangerous because it expands capability and output scope far beyond user expectations, increasing the risk of unauthorized file generation, prompt/goal drift, and misuse of workspace data under a misleading manifest.
The scoring and prioritization logic gives the skill decision-making power over research directions that is unjustified for a chapter-lead-writing tool. Even without network access or code execution, this hidden capability can steer agent behavior, alter downstream outputs, and cause unauthorized analytical work product to be created under the guise of a simple editorial skill.
The skill advertises no explicit tool scope, yet the package metadata and instructions indicate shell execution and broad file access through scripts/run.py. Without a declared allowlist, an agent may grant the skill more filesystem and command execution capability than users expect, increasing the blast radius if the script or router behavior is abused.
The pipeline advertises broad review-related routing hints and also sets itself as the default route, which can cause it to activate for loosely related or ambiguous user requests. In an agent system, that misrouting can trigger a large, high-cost, multi-stage workflow and generate inappropriate artifacts when a simpler or different skill should have been selected.
No suspicious patterns detected.