Article Summary Card

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:32 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent article-summary renderer, but its installer and URL/rendering paths have unsafe scope that users should review before installing.

Install only if you are comfortable reviewing or fixing the helper scripts first. Avoid running install_openclaw.py with a custom --dest, avoid summarizing sensitive local files or untrusted URLs, and prefer a sandboxed environment with restricted network access until URL validation, installer containment, and Chrome sandbox handling are improved.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/summarize_article.py:72

Finding

Unrestricted URL Retrieval Enables SSRF, Local File Access, and Curl Option Injection

Content

View full analysis

str: commands = [ [ "curl", "-L", "--silent", "--show-error", "-A", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36", url, ], [ "curl", "-L", "--silent", "--show-error", "--http1.1", "-A", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36", url, ], ] last_error = None for command in commands: try: result = subprocess.run(command, check=True, capture_output=True, text=True) return result.stdout except subprocess.CalledProcessError as exc: last_error = exc raise last_error ``` ```python def read_input(url: str | None, file_path: str | None): if url: raw_html = run_curl(url) title = extract_title(raw_html) text = extract_text(raw_html) return title, url, text ``` The primary extraction script imports and invokes this behavior: ```python parser.add_argument("--url", help="Article URL") ... title, source, article_text = read_input(args.url, args.file) ``` ### Technical Analysis The user-controlled URL is passed directly to `curl` without validating its scheme, destination host, resolved IP address, port, or redirect target. The use of `-L` automatically follows redirects, but redirected destinations are not revalidated. Consequently, the fetcher can potentially access: - Loopba ...[truncated 1781 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: references/prompts/plan-user.md:25

Finding

Untrusted Article Content Is Embedded into Agent Prompts Without Prompt-Injection Defenses

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install_openclaw.py:17

Finding

Installer Recursively Deletes an Unrestricted User-Supplied Destination

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/render_card.py:214

Finding

Headless Browser Rendering Disables the Chrome Sandbox

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.

md

- OpenClaw uses skill folders containing `SKILL.md`, so this same directory is portable.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 69% confidence

Finding

The skill instructs the agent to carry article contents through multiple prompt rounds in the current session, which increases retention and propagation of potentially sensitive source material. If the input is a local file or contains confidential data, that content can persist in context longer than necessary and may be echoed into derived outputs such as tags, summaries, HTML, and PNG artifacts.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

1. Read the input article from a URL or local file.
2. Extract the title and article body; remove obvious page chrome when possible.
3. In the current session, run two prompt rounds:
   - Round 1: create a summary plan that decides how the article should be divided into sections.
   - Round 1 must also generate 3 to 8 short tags for the article.
   - Round 2: write the final summary JSON according to that plan.
4. Use the unified renderer to export the final summary JSON as `Markdown`, `HTML`, and `PNG`.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown specifies that the one_sentence field should be 40-80 Chinese characters when possible, which imposes a language-specific output requirement. This is a natural-language policy concern because the file does not indicate user choice, opt-in, or a clearly documented region-specific justification for requiring Chinese.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The prompt explicitly states '你是中文科技长文编辑', which constrains the skill to Chinese. This is a natural-language locale policy issue because the file does not offer the user a language choice or explain a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Line L01 states the assistant is a Chinese technology content editor, which imposes a specific language/locale behavior. The file does not provide any user opt-in, alternative language option, or justification that this is a region-specific skill, so it conflicts with the language/locale policy guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The prompt requires all output fields to be written in Chinese, including explicit Chinese character-count constraints and Chinese labels. This imposes a specific language/locale without offering user choice or documenting a justified region-specific constraint, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The installer unconditionally deletes the resolved destination directory with shutil.rmtree(dest) if it already exists, without any confirmation, safety checks, or restriction that the path remain inside an expected workspace root. If a user supplies an unintended path via --dest, or if the default path resolves unexpectedly, the script can destroy arbitrary local data before copying files, making this a real destructive-file-operation risk.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render_card.py (reported line 246)May include surrounding context.

python

f"--virtual-time-budget=1500",
        html_path.resolve().as_uri(),
    ]
    subprocess.run(command, check=True, capture_output=True, text=True)


def crop_to_canvas(image_path: Path, target_height: int | None = None, target_width: int = PAGE_WIDTH):

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The markdown renderer emits fixed Chinese headings and labels such as "来源：" and "一句话总结" directly in the generated output. This enforces a specific language/locale behavior without any visible user opt-in or documented region-specific justification, which matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render_outputs.py (reported line 31)May include surrounding context.

python

html_out = out_stem.with_suffix(".html")
    png_out = out_stem.with_suffix(".png")

    subprocess.run(
        [sys.executable, str(markdown_script), "--summary", str(summary_path), "--out", str(markdown_out)],
        check=True,
    )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render_outputs.py (reported line 35)May include surrounding context.

python

[sys.executable, str(markdown_script), "--summary", str(summary_path), "--out", str(markdown_out)],
        check=True,
    )
    subprocess.run(
        [
            sys.executable,
            str(card_script),

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script accepts an arbitrary user-supplied URL and silently fetches it over the network, which can transmit user-provided targets to external systems without a clear warning or trust boundary. In an agent/skill context, this can enable unintended requests to attacker-controlled endpoints or internal resources, creating SSRF-like behavior and privacy leakage.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/render_card.py (reported line 227)May include surrounding context.

python

last_error = None
    for command in commands:
        try:
            result = subprocess.run(command, check=True, capture_output=True, text=True)
            return result.stdout
        except subprocess.CalledProcessError as exc:
            last_error = exc

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/summarize_article.py (reported line 97)May include surrounding context.

python

last_error = None
    for command in commands:
        try:
            result = subprocess.run(command, check=True, capture_output=True, text=True)
            return result.stdout
        except subprocess.CalledProcessError as exc:
            last_error = exc

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file describes reading input from a URL or local file and exporting Markdown, HTML, and PNG outputs, but it does not explicitly warn users that the skill will access local content and create files on disk. For a markdown skill description, data-affecting file reads/writes should be disclosed so users understand the impact before use.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The stylesheet sets the default font-family to "PingFang SC", which is a Simplified Chinese-oriented font choice. This is a natural-language/locale constraint embedded in the file and there is no indication of user choice or documented regional justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Multiple user-visible text classes such as .chip and .title specify font stacks centered on "Maple Mono NF CN" and related Chinese font variants. This enforces a locale-specific presentation without any visible opt-in or justification, which fits the language/locale policy category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The HTML root sets lang="zh-CN", which hard-codes a specific language/locale for all rendered output. Under the policy, locale constraints should either be user-selectable or clearly documented as a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction is written as a mandatory Chinese-language prompt ('请先为下面这篇文章设计一个…') and the required JSON field descriptions are all specified in Chinese, with no option for another language or locale. This creates a natural-language policy concern because it imposes a specific language without user opt-in or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.