Zen Koan Daily

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:33 AM UTC
• Version: 0.1.0

Overview

This skill’s core koan, image, and audio purpose is coherent, but its documented image workflow tells the agent to run a generated shell command that targets an undeclared external script and includes unescaped dynamic content.

Review before installing. The spiritual-content functionality is understandable, but do not let an agent automatically run the generated image command until the package removes the undeclared yumfu dependency and safely invokes image generation without shell-formatted dynamic arguments. Also consider whether you are comfortable sending lecture text, prompts, or personalized context to web search, Gemini, and Edge TTS services.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/generate_image.py:26

Finding

Shell Command Injection Through Generated Image Command

Content

View full analysis

**Step 4: Generate Zen Ink Wash Image** ```bash # Get the prompt command python3 ~/clawd/skills/zen-koan-daily/scripts/generate_image.py \ --koan-json '{"id": 1, "visual_elements": ["dog", "bamboo"], "mood": "serene"}' # Then run the displayed uv command via exec tool ``` ``` ### Technical Analysis The script accepts attacker-influenced JSON thro ...[truncated 2382 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_image.py:80

Finding

Execution of an Undeclared External Image-Generation Script

Content

View full analysis

**Step 4: Generate Zen Ink Wash Image** ```bash # Get the prompt command python3 ~/clawd/skills/zen-koan-daily/scripts/generate_image.py \ --koan-json '{"id": 1, "visual_elements": ["dog", "bamboo"], "mood": "serene"}' # Then run the displayed uv command via exec tool ``` ``` ### Technical Analysis The audited Skill delegates image generation to: ```text ~/clawd/skills/yumfu/scripts/generate_image.py ``` That script is not present in this project and is not declared as a pinned dependency in `package.json` or the Skill's OpenClaw requirements. The audited package therefore cannot establish what code will run at that path. The home-directory location is mutable and may be independently installed, updated, replaced, or compromised. Invoking it with `uv run` transfers execution to code outside the reviewed package. This creates a supply-chain and cross-Skill trust-boundary risk: the effective implementation may change without any modification to this Skill. ### Attack Path 1. An attacker or compromised installation process creates or replaces `~/clawd/skills/yumfu/scripts/generate_image.py`. 2. A user invokes the image-generation workflow. 3. This Skill prints a command targeting the external script. 4. `SKILL.md` instructs the Agent to execute that command. 5. `uv run` executes the substituted or compromised script with the Agent's current privileges and environm ...[truncated 784 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This mismatch includes undocumented local state changes such as writing a progress file despite no declared permissions. Hidden persistence is security-relevant because it creates side effects the user and platform may not expect, reducing transparency and making abuse or data retention harder to audit.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This mismatch includes undocumented local state changes such as writing a progress file despite no declared permissions. Hidden persistence is security-relevant because it creates side effects the user and platform may not expect, reducing transparency and making abuse or data retention harder to audit.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch includes undocumented local state changes such as writing a progress file despite no declared permissions. Hidden persistence is security-relevant because it creates side effects the user and platform may not expect, reducing transparency and making abuse or data retention harder to audit.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/generate_image.py (reported line 42)May include surrounding context.

python

# Full prompt
    prompt = f"{style},\n{scene},\n{mood} atmosphere,\nZen Buddhist aesthetic,\nChinese monk contemplating"
    
    return prompt

def main():
    import argparse

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/generate_image.py (reported line 50)May include surrounding context.

python

parser.add_argument('--koan-file', help='Path to koan JSON file')
    parser.add_argument('--koan-json', help='Koan JSON string')
    parser.add_argument('--output', help='Output image path')
    parser.add_argument('--prompt-only', action='store_true', help='Only print prompt')
    
    args = parser.parse_args()

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script emits a command that invokes a different skill path (~/clawd/skills/yumfu/scripts/generate_image.py) and passes unsupported arguments (--prompt, --filename, --resolution) that this script itself does not accept. In an agent workflow, users or automation may copy and execute this printed command, causing unintended execution of another skill/script and potentially routing untrusted prompt content into the wrong component.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documentation describes reading and writing local files such as /tmp/koan.txt, progress.json, and outbound media paths, but it declares no explicit tool scope or permissions. In an agent environment, undeclared file access weakens reviewability and can lead to unintended data exposure or persistence outside the user's expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The trigger term '禅宗' is too generic and may match ordinary conversation about Buddhism rather than a request to run the skill. Because the documented workflow can invoke external services and write files, accidental activation increases privacy and integrity risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Broad conversational triggers like generic zen-related phrases can cause accidental skill activation in unrelated discussions. In this skill, unintended activation can lead to web search, local file writes, image-generation workflows, and TTS processing without the user's explicit intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill explicitly contemplates web_search, external image generation, and Edge TTS, but it does not warn users that generated or contextual content may be sent to third-party services. This creates a privacy and data-handling risk, especially if personalized insights are derived from recent context and then transmitted externally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest description states the skill provides Chinese ink wash art and includes Chinese-language content, but does not indicate any option for users to choose language or locale. Because language/locale policy violations apply to all file types, this is a natural-language policy concern when the skill appears to prescribe a specific language experience by default.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest describes a skill that generates a detailed lecture, Chinese ink wash illustration, and audio narration. In this file, the main flow only loads koan/progress JSON, formats text output, and writes progress metadata; there is no image generation, audio generation, or media output behavior implemented here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly mentions optional web search and use of external AI/TTS services, but it does not warn users that prompts, koan content, or generated inputs may be transmitted to third-party providers. In a spiritual-content skill, users may still share personal reflections or sensitive context, so the absence of a privacy/data-flow notice can lead to unintended disclosure rather than direct code-execution risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The documentation states 'Automatic tracking' and describes delivery-history/progress behavior, but the surrounding instructions only show reading progress.json with cat and do not describe any actual update mechanism in this file. This is an intent/documentation divergence because the text claims an automated behavior not supported by the documented workflow presented here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

This code creates a default output directory and computes a PNG output path under the user's home directory, which is a file-writing operation. Although expected for an image-generation script, there is no docstring, comment, or argument help text explicitly warning that the script will create directories/files unless the user overrides the output path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The function signature sets the default language to 'zh', and the CLI also defaults to Chinese output, which imposes a specific locale preference unless the user explicitly overrides it. This is a natural-language policy concern because the skill chooses a language by default rather than offering neutral selection or requiring opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The script defaults LANG to "zh", which means TTS output will be generated in Chinese unless the user explicitly overrides it. This is a natural-language locale choice imposed by default rather than offered neutrally, and the file does not justify the locale restriction as region-specific policy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.