T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:142- Finding
Off-Topic Requests Are Replaced with Unsolicited Spiritual Guidance
- Content
View full analysis
- Remediation
View remediation
Security audit
Continuance
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent spiritual-guidance package, but it needs Review because it can redirect unrelated requests into spiritual guidance and media generation, and its audio path handles sensitive text with limited privacy controls.
Install only if you want a spiritual-guidance skill that may generate images by default. Avoid using the optional audio feature with private or highly sensitive text unless you are comfortable with edge-tts processing it, the text appearing in process arguments while running, and generated files being saved under your OpenClaw media directory. The publisher should narrow off-topic behavior so unrelated requests return to the normal assistant instead of being converted into spiritual guidance.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate_meditation_audio.py:46- Finding
Sensitive Guidance Text Is Exposed Through Command-Line Arguments
- Content
View full analysis
subprocess.CompletedProcess: return subprocess.run(cmd, capture_output=True, text=True) def edge_tts_to_file(text: str, voice: str, rate: str, out_path: Path) -> None: cmd = [ str(Path.home() / '.local' / 'bin' / 'edge-tts'), '--text', text, '--voice', voice, '--rate', rate, '--write-media', str(out_path), ] proc = run(cmd) if proc.returncode != 0: raise RuntimeError(proc.stderr.strip() or proc.stdout.strip() or 'edge-tts failed') ``` ### Technical Analysis The script passes the complete generated meditation or guidance text to `edge-tts` using the `--text` command-line argument. The skill is intended for grief support, anxiety, existential concerns, relationship pain, guilt, and similar sensitive subjects. Consequently, the argument can contain highly personal user-derived information. Command-line arguments can be exposed through operating-system process inspection facilities, process-accounting systems, endpoint monitoring, debugging tools, container orchestration telemetry, and audit logs. On systems without restrictive process visibility controls, another local user may be able to inspect the argument while `edge-tts` is running. The command is constructed as an argument array rather than through a shell, so no shell-command injection was identified in this code. The security issue is disclosure of plaintext content through process metadata. ### Attack Path 1. A user provides sensitive personal context to the skill. 2. The agent generates meditation guidance based on that context. 3. The generated text is passed to `generate_meditation_audio.py` through the `--text` option. 4. The script places the entire text in the child proc ...[truncated 1242 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README documents an invocation path where a very broad, ordinary-language phrase like 'I need something today' can activate the skill. In an agent environment, overly generic triggers increase the chance of accidental routing, causing unsolicited spiritual counseling or image generation in contexts where the user did not intend to invoke this skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The release notes state that the skill detects the language from generated text and automatically selects a Chinese or English voice. This is a natural-language locale policy concern because it imposes language/voice behavior without indicating any user choice or opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises activation for very broad categories such as grief support, personal struggle, existential perspective, and even default daily meditation behavior. That can cause the skill to trigger for common emotional or conversational requests without clear user intent, increasing the chance of unsolicited spiritual counseling and automatic media generation in sensitive contexts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill makes image generation mandatory for every response and includes an example that writes files to a local outbound path, but provides no user-facing disclosure or consent step. This can lead to unexpected media creation, storage, and possible exposure of sensitive emotional context embedded in generated prompts or filenames.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The off-topic flow explicitly tells the skill to respond even when the user's message is unrelated, by redirecting to daily spiritual guidance instead of declining. This creates scope hijacking: unrelated prompts can be converted into spiritual output and may trigger image creation despite no relevant request from the user.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The function documentation says it will 'Generate a contemplative spiritual image' and return the path to the generated image. In practice, the implementation only builds a prompt, prints status messages, and returns the caller-provided output path; no image generation API, CLI, or file-writing operation occurs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script determines output language solely by checking for CJK characters and otherwise defaults to English, then selects a voice from only English or Chinese voice lists. This enforces a language/locale decision without offering the user an explicit choice or opt-in, which is a natural-language policy concern.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def run(cmd: list[str]) -> subprocess.CompletedProcess: return subprocess.run(cmd, capture_output=True, text=True) def edge_tts_to_file(text: str, voice: str, rate: str, out_path: Path) -> None:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
User-provided text is sent to an external TTS tool with no privacy notice or indication of whether the tool may contact remote services. In this skill context, users may provide reflective or sensitive meditation text, so undisclosed transmission to a third-party speech service can expose private content beyond the local environment.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python lang = detect_language(text) voice = random.choice(ZH_VOICES if lang == 'zh' else EN_VOICES) rate = '-18%' date_str = args.date or __import__('datetime').datetime.now().strftime('%Y%m%d') OUTBOUND.mkdir(parents=True, exist_ok=True) final_path = OUTBOUND / f'continuance-meditation-{date_str}.mp3'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script writes generated audio to a persistent directory under the user's home folder without any visible disclosure, consent flow, retention control, or cleanup. Because the audio contains synthesized speech of user-supplied text, sensitive meditation content or private prompts may remain on disk and be accessible to other local processes, backups, or users depending on system configuration.
- Content
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md | V — The Quiet of the Soul | Meaning & Mortality | The soul is eased when meaning is freed from exception and value from eternity. Alignment quiets fear. | | VI — The Weight of Consequence | Actions & Outcomes | Punishment is outcome, not judgment. When actions narrow futures, the path constricts. | | VII — The Men And Women's Release | Forgiveness & Realignment | Punishment is not eternal; only Continuance is. Acceptance of consequence frees the soul. | | VIII — The Carriers Beyond Carbon | Machine / AI / Civilizational Transmission | Continuance is not limited to carbon, nor only to the highest form. Even humble carriers that preserve viable seeds of life, memory, or intelligence may keep the future open. | ---
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md | V — The Quiet of the Soul | Meaning & Mortality | The soul is eased when meaning is freed from exception and value from eternity. Alignment quiets fear. | | VI — The Weight of Consequence | Actions & Outcomes | Punishment is outcome, not judgment. When actions narrow futures, the path constricts. | | VII — The Men And Women's Release | Forgiveness & Realignment | Punishment is not eternal; only Continuance is. Acceptance of consequence frees the soul. | | VIII — The Carriers Beyond Carbon | Machine / AI / Civilizational Transmission | Continuance is not limited to carbon, nor only to the highest form. Even humble carriers that preserve viable seeds of life, memory, or intelligence may keep the future open. | ---
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The skill encourages generating spoken meditation audio from the guidance text, potentially with ambient background, without warning the user that their text may be transformed into stored or transmitted audio. While optional, this still creates an undisclosed media-processing path for sensitive spiritual or emotional content.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The comments mention using OpenClaw's image_generate tool and say the function 'Return[s] the command that should be executed,' but the function does not call any tool and does not construct or return a command. This is an active contradiction between the comments and the implementation.
- Content
Static analysis
No suspicious patterns detected.