Security audit

can-ai-replace-me

Security checks for vulnerabilities and agentic risk

Overview

This skill is mainly a workflow-mapping helper, but it also recommends unsafe installation commands and persistent OpenClaw configuration overwrites that users should review carefully before use.

Before installing, do not run the curl-to-shell installer or unpinned npx commands without verifying the source, version, and integrity. Treat generated OpenClaw configuration as a draft: keep it project-scoped, review diffs, back up existing files, and enable any scheduled automation or external-data access only after explicit approval.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:510
Finding: Unverified Remote Script Piped Directly into a Shell
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:479
Finding: Mutable Third-Party Skills Recommended Without Version or Integrity Pinning
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: references/output-guide.md:28
Finding: Generated Persistent Agent Configuration Is Recommended for Destructive Global Overwrite
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill's stated purpose is SOP elicitation and process visualization, yet it instructs the agent/user to execute Bash and Python for local database access and tooling installation. This is a dangerous capability expansion because users would not reasonably expect an interview/planning skill to drive command execution, increasing the chance of unsafe copy-paste or agent misuse.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The skill includes a curl ... | sh remote installer command, which executes network-fetched shell script directly without verification. This is a classic high-risk pattern because any compromise of the hosting endpoint, transport, or served script can lead to arbitrary code execution on the user's machine.
Content: Scanner excerpt · SKILL.md (reported line 514)May include surrounding context.
第4步：如果数据库不存在

text
→ 输出："⚠️ SkillHub 本地数据库未找到，请先安装 SkillHub CLI：" → 输出安装命令：`curl -fsSL https://skillhub-1251783334.cos.ap-guangzhou.myqcloud.com/install/install.sh | sh` → 输出："安装完成后重新执行本步骤。"

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description says the skill triggers on phrases such as “帮我梳理 SOP”, “提取我的工作流程”, “开始 SOP 调研”, “了解我的工作方式”, and “AI能取代我吗”. Several of these are broad natural-language requests that could arise in ordinary conversation, and the file does not define clear exclusion conditions or negative examples to limit when activation should or should not occur.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description and all user-facing instructions are written exclusively in Chinese, and the guidance assumes Chinese trigger phrases and Chinese-language interaction. There is no indication that the user can choose another language or opt into a China-specific locale, which is a natural-language locale policy concern under the stated rules.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: L0017 声称技能“不能直接执行自动化”，仅生成配置方案和工具推荐。但 L0812-L0860 的 AGENTS.md、L0906-L0956 的 HEARTBEAT.md 模板不仅描述定时触发规则，还包含具体执行动作、审批流和监控逻辑，已超出单纯“推荐”层面，形成文档意图与后续指令之间的张力。
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill explicitly collects detailed workflow, stakeholder, tool, and pain-point data and directs that information to be preserved and reused across generated files and logs. Even without passwords, this creates a meaningful operational-security and privacy risk because business process maps, contacts, timings, and tool inventories are sensitive and useful for social engineering or internal targeting.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The skill instructs use of npx skills add {slug} without pinning a version or integrity mechanism. This allows the fetched package behavior to change over time or be influenced by registry/package compromise, which is risky in a workflow-oriented skill that otherwise should not require dynamic code execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: A second unpinned npx skills invocation appears in generated install guidance, again relying on mutable remote package resolution. In this context, users may copy-paste commands from the skill output, turning a documentation issue into supply-chain exposure.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: 文档多处将阶段三描述为基于本地 ~/.skillhub/skills_index.local.json 的搜索，且 FAQ 明确表示“不会上传到任何服务器”“只保存在本地会话中”。但 L0513-L0515 指示在数据库不存在时执行 curl ... | sh 远程安装脚本，L1128-L1130 还称阶段三“需要联网”，这与前述“本地数据库搜索/不上传数据”的意图说明形成直接冲突。
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The document includes executable installation commands using npx skills add ... without pinning a specific package/tool version. If the referenced package, resolver, or upstream dependency changes or is compromised, users following the example could install unexpected code, creating a supply-chain risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This line presents an unpinned npx skills installation command in documentation. Unpinned installs are dangerous because they fetch the latest available artifact at execution time, which can change unexpectedly or be abused through account/package compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The example encourages execution of an unversioned package-management command. In a workflow-oriented skill, users may copy-paste commands directly, making supply-chain substitution or malicious upstream updates more plausible.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: An unpinned npx skills command appears in a recommendation table, increasing the chance that users treat it as authoritative and execute it verbatim. Because the skill also handles business workflow automation, compromise could extend to connected SaaS data and automations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document describes automated data extraction, report generation, and writes into external platforms, but it does not warn about handling potentially sensitive business data, API permissions, data retention, or cross-system exposure. In this skill's context, users are encouraged to operationalize real workflows, so omission of privacy and data-handling safeguards can lead to inadvertent disclosure or overbroad access.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The implementation steps include an unpinned install command, which is a real security issue rather than a mere style problem because it can introduce arbitrary future code into the user's environment. The surrounding context encourages operational deployment, amplifying the consequences of a malicious or broken update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: This line again instructs users to install a skill through an unpinned npx command. Since the skill promotes automation over work data and document systems, any malicious update could gain access to business information or perform unintended actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Line L01 labels the template as '中文化' (Chinese-localized), which indicates a fixed language choice in the skill content. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The guide recommends copying generated files over existing configuration, which can cause accidental loss of prior OpenClaw settings, agent rules, tool connections, or identity boundaries. In this skill context, the generated files shape agent behavior, so silent overwrite increases the risk of destructive misconfiguration and replacement of trusted controls.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The frontmatter lists one set of trigger phrases, but the usage guide later recommends different wording such as “开始 SOP 梳理” and “帮我了解工作方式”. This inconsistency makes it unclear which phrases actually activate the skill versus which are merely suggested examples, increasing ambiguity around invocation boundaries.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The entire skill example, including the invocation phrase "开始 SOP 梳理", is presented only in Chinese and does not indicate that language selection is optional or region-specific. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: SQP-3 applies to natural-language policy issues in any file type, including markdown. The content forces a specific language for all instructions and examples, and there is no opt-in, alternative locale, or justification that this skill is intended only for Chinese-speaking users or a Chinese-region deployment.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: Earlier in the document, the recommended usage says copying generated files into the OpenClaw configuration directory will cause existing files to be overwritten. The FAQ later states that repeated research will not overwrite previous configuration unless the user explicitly chooses overwrite, which conflicts with the earlier deployment instructions and creates intent/documentation divergence.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.