clawdess

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:05 AM UTC
• Version: 1.0.14

Overview

This skill is a coherent AI media-generation companion, but it can send personal prompts and reference images to third-party providers under broad triggers without clear consent controls.

Review before installing. Use it only if you are comfortable sending prompts, reference image URLs, and voice text to the selected third-party AI provider, and avoid broad or automatic triggers unless each generation is confirmed. Be aware that generated photo and video files are cached locally under ~/.openclaw/media/clawdess and API usage may incur provider costs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents an end-user companion experience, but the supplied code chunk is infrastructure code for media/provider integration. It contains networking, file download/storage, and module discovery behavior that is not reflected in the declared purpose or permissions. While such helpers could support a media-based companion product, this specific code does not implement the described companion interactions themselves; its primary function is backend/provider orchestration and remote media retrieval, which is materially different from the user-facing description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents the skill as a conversational or relationship-style digital companion delivering photos, videos, and voice notes. The supplied code does not implement companion behavior, messaging, videos, or voice notes. Instead, it is a backend utility for image generation/editing: it validates prompt/image/api inputs, selects a photo provider, invokes provider.generate(), and downloads the resulting image into a cache. This is a materially different primary purpose from the declared companion experience, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents the skill as a virtual companion experience focused on relationship-style interactions and media sharing. The supplied code, however, is a backend image generation/editing utility that calls a third-party FAL API, submits an image and prompt, and polls for a generated image result. While photo generation could support the companion experience, this specific code's primary behavior is technical image-editing API integration, which is not accurately or explicitly represented by the declared description. This is a meaningful description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents the skill as an end-user digital companion offering photos, videos, and voice notes. The supplied code instead implements a specific backend image-generation utility: it submits a prompt and image URL to an external Volcengine/Huoshanyun API and returns a generated image URL. This is a materially different primary purpose from the declared companion experience, and it also involves undeclared external network access and API-key-based image generation capability. While media generation could support the broader product, this code chunk itself is not accurately represented by the declaration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents the skill as an end-user romantic/digital companion delivering photos, videos, and voice notes. The supplied code chunk does not implement companion interaction or messaging behavior; instead, it is infrastructure for generating a video from a prompt and input image using an external provider API, then downloading the result to local cache. This is a materially different primary purpose from the declared experience, and it introduces undeclared capabilities such as provider selection, API-key-based external service access, and file downloading/caching.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents the skill as a consumer-facing virtual companion experience centered on relational content. The supplied code chunk, however, is a narrow infrastructure component for generating videos from an image using the FAL service. It does not implement companion interaction, messaging, voice notes, or user-facing relationship features. While video content could support the broader product, this code’s actual purpose is materially different from the declared description and introduces a specific undeclared capability: third-party image-to-video generation through an external API.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents an end-user romantic companion experience, emphasizing relationship-like interaction and media messages. The supplied code does not implement companion behavior, messaging, photos, voice notes, or conversational features. Instead, it specifically performs backend video generation through the xAI API using a prompt and image, then polls for the resulting video URL. That is a materially different primary purpose from the declared description, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The description presents a broad virtual-companion experience centered on emotional interaction and media like photos, videos, and voice notes. The supplied code only implements a backend voice-generation command: it validates an API key and prompt, chooses a voice provider, invokes provider.generate(), and outputs a media URL. While voice notes are mentioned in the description, this code is materially narrower and different in purpose, with undeclared reliance on external provider APIs and no evidence of the advertised companion, photo, or video behavior. Therefore the declared description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents the skill as a full digital companion experience centered on photos, videos, and voice notes. The supplied code chunk only implements a text-to-speech provider that calls Aliyun's API to generate audio from text. While voice notes are mentioned in the description, this code is specifically an infrastructure component for TTS generation and does not reflect the broader declared purpose. The use of an external Aliyun service and the narrow backend function are not accurately represented by the description, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The description markets the skill as a virtual companion experience centered on emotional interaction and media like photos, videos, and voice notes. The supplied code chunk, however, is a narrow infrastructure component for generating speech audio from text via an external API. While TTS could support 'voice notes,' the actual code’s primary purpose is integration with a remote speech synthesis service, which is not clearly represented in the declared description. This is a meaningful description-behavior mismatch because the implemented capability is an undeclared external audio-generation backend rather than the companion behavior the user would expect from the description.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill asks for a reference image and user prompts but does not warn that these inputs and resulting media will be sent to third-party AI providers. Because reference images may contain sensitive biometric or intimate content, undisclosed external transmission creates a significant privacy and consent risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares executable behavior that uses environment variables, shell execution, file access, and networked APIs, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens reviewability and containment because a host may grant broader capabilities than users or reviewers expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases include common conversational prompts like 'what are you doing?' and 'how are you doing?', which can cause the skill to invoke during ordinary chat without clear user intent. In a skill that sends prompts and images to external providers, overbroad triggering can lead to unintended data transfer, surprise media generation, and unnecessary API use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The voice guidance says to use the skill in 'any situation where a voice message would be better than text,' which is highly subjective and leaves invocation boundaries undefined. This can trigger remote TTS generation when the user did not clearly request it, increasing privacy, cost, and consent risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation states that the default voice is "Chelsie" and explicitly identifies it as Chinese, but it does not offer users a language choice or require opt-in. This is a natural-language policy issue because it imposes a locale-specific output mode by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The scheduling tip suggests automated posting/generation without warning users about recurring remote processing, repeated data disclosure, or unattended system actions. Automation increases the blast radius of mistakes because a single configuration can repeatedly send content or incur charges without fresh review.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest promises a companion-style experience with daily photos, videos, and voice notes, implying an end-user interaction layer or persona behavior. In contrast, the code only exposes CLI subcommands to generate/edit media via external provider modules, which is a materially different function than being a 'digital companion.'

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The helper downloads arbitrary remote content directly to a user-local cache path without any validation of the source, file type, size, or explicit user disclosure. In this skill context, that behavior increases risk because media is a primary feature, so untrusted remote files may be fetched automatically and stored on disk, potentially exposing users to unwanted or malicious content and enabling disk-filling or unsafe downstream handling.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest frames the skill as a companion experience that provides media to the user, but this code accepts a reference image and prompt, calls a photo-generation provider, and saves the generated output. That is a materially different capability from simply delivering companion content, indicating the implementation includes image-editing functionality not reflected in the description.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

For a skill described as offering a playful companion with daily photos, videos, and voice notes, accepting a local image input, sending it to a provider, and generating edited media is a broader creative-processing capability. This looks more like a photo-editing/generation tool than an obvious implementation detail of a companion persona.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code transmits the user's prompt and reference image to a third-party provider without any visible consent notice, privacy warning, or minimization controls. Because images and prompts can contain sensitive personal data, silent off-platform transfer creates a meaningful privacy and compliance risk, especially for an intimate 'digital companion' product where users may share personal content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This function transmits the user-supplied prompt and image URL to a third-party image generation API, which creates a privacy and data-sharing risk if users are not clearly informed or have not consented. In this skill’s context, prompts and images may be intimate or highly personal, making external disclosure more sensitive than in a generic image-editing workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest frames the skill as a companion delivering photos, videos, and voice notes, suggesting an end-user relationship experience. This file instead exposes infrastructure-style logic for selecting external video providers, requiring an API key, generating media from prompts and images, and downloading outputs, which is broader and more implementation-centric than the stated companion behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code performs a file-writing operation by downloading the generated video into MEDIA_CACHE. Although the script logs generation status, it does not disclose that it will persist content to local storage, and there is no confirmation prompt, comment, or docstring warning about that write.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/video/xai.py (reported line 15)May include surrounding context.

python

"image": {"url": image_url},
    }
    headers = {"Authorization": f"Bearer {api_key}", "Content-Type": "application/json"}
    code, body = api_post("https://api.x.ai/v1/videos/generations", headers, payload)
    video_id = body.get("request_id")
    if not video_id:
        print(f"XAI video submit failed: {body}")

Static analysis

No suspicious patterns detected.