Ai Intelligent Content Generation

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:48 AM UTC
• Version: 1.0.0

Overview

The skill is a content-generation description, but its install instructions tell users to clone and run mutable remote code that was not included in the reviewed artifact.

Review this carefully before installing. The visible skill package is only a markdown description; the actual application code would be pulled from GitHub at install time and run locally. Install only if you trust that repository and preferably after pinning an audited commit, using a virtual environment or container, and reviewing the dependency list and app code yourself.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:42

Finding

Unpinned Remote Payload Retrieval and Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42–47
Vulnerability Type: Remote, mutable code is retrieved and executed without integrity verification
Risk Level: High

bash

git clone https://github.com/openclaw-skills/ai-intelligent-content-generation
cd ai-intelligent-content-generation
pip install -r requirements.txt
python app.py

Technical Analysis

The installation instructions clone a remote Git repository without pinning a commit, tag, or cryptographically verified release. They then install dependencies from the remotely supplied requirements.txt and execute the remotely supplied app.py.

Because neither the referenced implementation nor its dependency manifest is included in the audited artifact, their behavior cannot be verified. The effective payload may change after this Skill has been reviewed. If the repository, its maintainer account, or an upstream dependency is compromised, following these instructions could execute attacker-controlled code.

The pip install step can itself execute code through package build and installation hooks. The subsequent python app.py command directly executes the cloned application. This creates two execution points for unverified remote content.

Attack Path

1. An attacker compromises the referenced repository, a maintainer account, or a dependency selected by its unpinned dependency manifest.
2. The attacker modifies requirements.txt, a dependency package, app.py, or another imported module to contain a malicious payload.
3. A user follows the installation instructions after the remote content has changed.
4. git clone retrieves the attacker-controlled content without checking it against an audited commit or expected digest.
5. pip install -r requirements.txt may execute malicious package installation hooks.
6. python app.py executes the downloaded application under the user's account.
7. The payload can act with the i ...[truncated 803 chars]

Remediation

View remediation

Remediation Suggestions

• Include the complete implementation and dependency metadata in the reviewed Skill package so that executable behavior is available during security review.
• Pin the source repository to a specific audited commit hash rather than cloning its mutable default branch.
• Distribute signed releases and verify the release signature and cryptographic digest before installation or execution.
• Pin every Python dependency to an exact reviewed version and use a lockfile containing hashes, such as hashes generated and enforced through pip --require-hashes.
• Review direct and transitive dependencies for dependency confusion, typosquatting, known vulnerabilities, and unexpected build hooks.
• Prefer prebuilt, provenance-verified artifacts and disable unnecessary source builds during dependency installation.
• Run installation and execution as a dedicated, unprivileged user inside an isolated virtual environment, container, or sandbox.
• Restrict filesystem, credential, and network access to only what the application requires.
• Add explicit verification steps to the documentation and fail closed if a commit, signature, or dependency hash does not match the reviewed value.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description is broad and underspecified, advertising multiple powerful capabilities such as article, image, video generation, and moderation without clear trigger conditions, scope boundaries, or operational constraints. In an agent ecosystem, ambiguous activation criteria can cause the skill to be invoked in unintended contexts, increasing the chance of unsafe content generation, misuse, or accidental policy-impacting actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation mentions automated content moderation but provides no warning about how moderation decisions are made, what content may be blocked or logged, or the possibility of false positives/negatives. This creates security and trust risks because users may unknowingly submit sensitive content or rely on opaque moderation outcomes in safety-critical publishing workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

All user-facing documentation in this file is presented only in Chinese, with no indication that the skill is region-specific or that users may choose another language. This can violate language/locale policy expectations when a skill is presented in a broader context without opt-in or justification for the locale restriction.

Content

No source excerpt is available for this finding.