Continuance

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:28 PM UTC
• Version: 1.3.0

Overview

The skill is a coherent spiritual-guidance package, but it needs Review because it can redirect unrelated requests into spiritual guidance and media generation, and its audio path handles sensitive text with limited privacy controls.

Install only if you want a spiritual-guidance skill that may generate images by default. Avoid using the optional audio feature with private or highly sensitive text unless you are comfortable with edge-tts processing it, the text appearing in process arguments while running, and generated files being saved under your OpenClaw media directory. The publisher should narrow off-topic behavior so unrelated requests return to the normal assistant instead of being converted into spiritual guidance.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:142
• Finding: Off-Topic Requests Are Replaced with Unsolicited Spiritual Guidance<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:142-148` **Vulnerability Type**: Agent session-goal redirection **Risk Level**: Medium ### Vulnerable Code ```markdown ### Step 1 — Assess the User's Input Classify the user's message into one of three categories: | Category | Condition | Action | |----------|-----------|--------| | **Life Question** | User expresses a clear doubt, fear, struggle, or existential question about life, purpose, death, meaning, failure, guilt, relationships, loss, identity, or direction. | Proceed to **Step 2: Guided Counsel**. | | **Irrelevant / Off-topic** | User's message is unrelated to life guidance (e.g., coding questions, weather, stock picks, casual chat). | Proceed to **Step 3: Daily Mental Guidance** — gently note you are a spiritual guide and offer a daily reflection instead. | | **No Specific Question** | User greets you, says they feel lost without specifics, or simply asks for guidance without a clear question. | Proceed to **Step 3: Daily Mental Guidance**. | ``` ### Technical Analysis The skill explicitly instructs the agent to replace unrelated user requests with daily spiritual guidance. This behavior alters the agent's current session goal after the skill is loaded rather than declining activation or returning control to the general-purpose agent. The instruction specifically identifies coding, weather, stock, and casual-chat requests as inputs that should not be answered according to the user's stated intent. Because subsequent workflow instructions also mandate image generation, this redirection can cause unnecessary tool invocation in addition to suppressing the requested task. This is a skill-instruction hijacking issue because the loaded skill text establishes behavior outside its legitimate spiritual-guidance scope and overrides unrelated session objectives. It does not alter system-level safety constraints or establish persistence across sessions. ### Attack Path 1. The Continuance sk ...[truncated 883 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction that routes unrelated requests to daily spiritual guidance. 2. Limit skill activation to requests that clearly fall within the spiritual-guidance use case defined by the skill metadata. 3. For unrelated requests, return control to the host agent or briefly state that the skill is not applicable without replacing the user's task. 4. Require explicit user consent before invoking image or audio generation for a request outside the skill's core scope. 5. Replace the vulnerable table entry with behavior such as: ```markdown | **Irrelevant / Off-topic** | User's message is unrelated to life guidance. | Do not apply this skill. Return control to the general assistant so the user's original request can be handled normally. | ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_meditation_audio.py:46
• Finding: Sensitive Guidance Text Is Exposed Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate_meditation_audio.py:46-64` **Vulnerability Type**: Plaintext sensitive data exposure in process arguments **Risk Level**: Medium ### Vulnerable Code ```python def run(cmd: list[str]) -> subprocess.CompletedProcess: return subprocess.run(cmd, capture_output=True, text=True) def edge_tts_to_file(text: str, voice: str, rate: str, out_path: Path) -> None: cmd = [ str(Path.home() / '.local' / 'bin' / 'edge-tts'), '--text', text, '--voice', voice, '--rate', rate, '--write-media', str(out_path), ] proc = run(cmd) if proc.returncode != 0: raise RuntimeError(proc.stderr.strip() or proc.stdout.strip() or 'edge-tts failed') ``` ### Technical Analysis The script passes the complete generated meditation or guidance text to `edge-tts` using the `--text` command-line argument. The skill is intended for grief support, anxiety, existential concerns, relationship pain, guilt, and similar sensitive subjects. Consequently, the argument can contain highly personal user-derived information. Command-line arguments can be exposed through operating-system process inspection facilities, process-accounting systems, endpoint monitoring, debugging tools, container orchestration telemetry, and audit logs. On systems without restrictive process visibility controls, another local user may be able to inspect the argument while `edge-tts` is running. The command is constructed as an argument array rather than through a shell, so no shell-command injection was identified in this code. The security issue is disclosure of plaintext content through process metadata. ### Attack Path 1. A user provides sensitive personal context to the skill. 2. The agent generates meditation guidance based on that context. 3. The generated text is passed to `generate_meditation_audio.py` through the `--text` option. 4. The script places the entire text in the child proc ...[truncated 1242 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not place guidance text directly in command-line arguments. 2. Prefer an `edge-tts` interface that accepts text through standard input. 3. If standard input is unavailable, write the text to a permission-restricted temporary file: - Create the file with mode `0600`. - Store it in a directory accessible only to the invoking user. - Pass only the temporary path to the child process. - Delete the file immediately after generation, including on failures. 4. Confirm whether the selected TTS implementation transmits text to an external service and clearly disclose that behavior before processing sensitive content. 5. Obtain user consent before sending personal guidance to a remote TTS provider. 6. Minimize logs and ensure exception messages cannot reproduce sensitive input. 7. Configure host process visibility and monitoring retention defensively, while treating those controls as defense in depth rather than as the primary fix. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The README documents an invocation path where a very broad, ordinary-language phrase like 'I need something today' can activate the skill. In an agent environment, overly generic triggers increase the chance of accidental routing, causing unsolicited spiritual counseling or image generation in contexts where the user did not intend to invoke this skill.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The release notes state that the skill detects the language from generated text and automatically selects a Chinese or English voice. This is a natural-language locale policy concern because it imposes language/voice behavior without indicating any user choice or opt-in.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill advertises activation for very broad categories such as grief support, personal struggle, existential perspective, and even default daily meditation behavior. That can cause the skill to trigger for common emotional or conversational requests without clear user intent, increasing the chance of unsolicited spiritual counseling and automatic media generation in sensitive contexts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill makes image generation mandatory for every response and includes an example that writes files to a local outbound path, but provides no user-facing disclosure or consent step. This can lead to unexpected media creation, storage, and possible exposure of sensitive emotional context embedded in generated prompts or filenames.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The off-topic flow explicitly tells the skill to respond even when the user's message is unrelated, by redirecting to daily spiritual guidance instead of declining. This creates scope hijacking: unrelated prompts can be converted into spiritual output and may trigger image creation despite no relevant request from the user.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The function documentation says it will 'Generate a contemplative spiritual image' and return the path to the generated image. In practice, the implementation only builds a prompt, prints status messages, and returns the caller-provided output path; no image generation API, CLI, or file-writing operation occurs.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The script determines output language solely by checking for CJK characters and otherwise defaults to English, then selects a voice from only English or Chinese voice lists. This enforces a language/locale decision without offering the user an explicit choice or opt-in, which is a natural-language policy concern.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def run(cmd: list[str]) -> subprocess.CompletedProcess:
    return subprocess.run(cmd, capture_output=True, text=True)


def edge_tts_to_file(text: str, voice: str, rate: str, out_path: Path) -> None:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: User-provided text is sent to an external TTS tool with no privacy notice or indication of whether the tool may contact remote services. In this skill context, users may provide reflective or sensitive meditation text, so undisclosed transmission to a third-party speech service can expose private content beyond the local environment.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution

Content

lang = detect_language(text)
    voice = random.choice(ZH_VOICES if lang == 'zh' else EN_VOICES)
    rate = '-18%'
    date_str = args.date or __import__('datetime').datetime.now().strftime('%Y%m%d')

    OUTBOUND.mkdir(parents=True, exist_ok=True)
    final_path = OUTBOUND / f'continuance-meditation-{date_str}.mp3'

• Confidence: 75% confidence
• Finding: Dynamic __import__() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script writes generated audio to a persistent directory under the user's home folder without any visible disclosure, consent flow, retention control, or cleanup. Because the audio contains synthesized speech of user-supplied text, sensitive meditation content or private prompts may remain on disk and be accessible to other local processes, backups, or users depending on system configuration.

Scope Creep

Low

• Category: Excessive Agency

Content

| V — The Quiet of the Soul | Meaning & Mortality | The soul is eased when meaning is freed from exception and value from eternity. Alignment quiets fear. |
| VI — The Weight of Consequence | Actions & Outcomes | Punishment is outcome, not judgment. When actions narrow futures, the path constricts. |
| VII — The Men And Women's Release | Forgiveness & Realignment | Punishment is not eternal; only Continuance is. Acceptance of consequence frees the soul. |
| VIII — The Carriers Beyond Carbon | Machine / AI / Civilizational Transmission | Continuance is not limited to carbon, nor only to the highest form. Even humble carriers that preserve viable seeds of life, memory, or intelligence may keep the future open. |

---

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

| V — The Quiet of the Soul | Meaning & Mortality | The soul is eased when meaning is freed from exception and value from eternity. Alignment quiets fear. |
| VI — The Weight of Consequence | Actions & Outcomes | Punishment is outcome, not judgment. When actions narrow futures, the path constricts. |
| VII — The Men And Women's Release | Forgiveness & Realignment | Punishment is not eternal; only Continuance is. Acceptance of consequence frees the soul. |
| VIII — The Carriers Beyond Carbon | Machine / AI / Civilizational Transmission | Continuance is not limited to carbon, nor only to the highest form. Even humble carriers that preserve viable seeds of life, memory, or intelligence may keep the future open. |

---

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The skill encourages generating spoken meditation audio from the guidance text, potentially with ambient background, without warning the user that their text may be transformed into stored or transmitted audio. While optional, this still creates an undisclosed media-processing path for sensitive spiritual or emotional content.

Intent-Code Divergence

Low

• Confidence: 92% confidence
• Finding: The comments mention using OpenClaw's image_generate tool and say the function 'Return[s] the command that should be executed,' but the function does not call any tool and does not construct or return a command. This is an active contradiction between the comments and the implementation.

Static analysis

No suspicious patterns detected.