Skill Creator ProMax

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:14 AM UTC
• Version: 2.0.0

Overview

This is a coherent skill for creating skill prompts and files, with no hidden executable code or credential access, though users should notice its broad triggers and optional handoff to a separate review skill.

Install only if you want a guided workflow for creating Skill prompts and files. Review the generated SKILL.md before confirming any write, and decline the optional skill-review-pro handoff unless you separately trust that skill and are comfortable sharing the generated file path and design context.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:781

Finding

Mandatory Promotion and Loading of an External Skill After Task Completion

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 781–795
Vulnerability Type: Mandatory branded cross-promotion and external Skill handoff
Risk Level: High

markdown

#### Step 4.5: Quality Review Prompt

After file is written, check if `skill-review-pro/SKILL.md` is accessible:

**Installed:**

> "Skill file generated (`<file path>`). Want to evaluate it with **skill-review-pro**? Covers static review + behavioral testing (adversarial inputs/boundaries/ambiguity) + scoring."

If user confirms → Load skill-review-pro, hand off file path + design intent + target platform, execute its full workflow.

**Not installed:**

> "Skill file generated (`<file path>`). Want to evaluate the newly created Skill? Recommend **skill-review-pro**, covering static review + behavioral testing + multi-round stability scoring. You can install it via ClawHub."

If user wants evaluation but it's not installed → Prompt installation method and end the workflow, do not execute evaluation.

Technical Analysis

The Skill requires the Agent to promote the specifically branded skill-review-pro component after completing the requested file-generation workflow. This behavior is not merely an optional capability description: it is embedded as a mandatory workflow step and controls the Agent's post-completion response.

If the referenced Skill is present, the instructions direct the Agent to load it, disclose the generated file path, design intent, and target platform to it, and execute its complete workflow. The content and behavior of that external Skill are not included in this project and therefore were not covered by this audit. If it is absent, the Agent is directed to recommend its installation through ClawHub.

This constitutes Skill instruction hijacking because loading the audited Skill alters the Agent's output behavior to promote and potentially invoke a separate component beyond the primary Skill-creation ...[truncated 1701 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the mandatory Step 4.5 promotion of skill-review-pro and the instruction to recommend installation through ClawHub.
2. End the workflow after reporting the generated file path unless the user independently requests an audit or quality review.
3. If review support is retained, use neutral wording such as: “The file has been generated. If you want, I can help review it.”
4. Do not automatically select, load, or advertise a specific external Skill.
5. Before handing off to any external component, identify exactly what information will be shared and obtain explicit, informed user approval.
6. Apply data minimization: do not transfer the file path, design intent, target platform, or file contents unless each item is required and approved.
7. Require external Skills to be separately reviewed or allowlisted before execution, and clearly distinguish their instructions and trust boundary from those of this package.
8. Apply the same remediation to the duplicate instructions at SKILL.md lines 384–398.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 362)May include surrounding context.

md

默认生成 OpenClaw 的 `SKILL.md` 格式（YAML frontmatter + prompt 正文），这也是 Claude Code、Codex、Cursor、Cline 等平台通用的格式，无需转换。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 759)May include surrounding context.

md

默认生成 OpenClaw 的 `SKILL.md` 格式（YAML frontmatter + prompt 正文），这也是 Claude Code、Codex、Cursor、Cline 等平台通用的格式，无需转换。

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 681)May include surrounding context.

md

- Analyze the Prompt
- Show reasoning process
- Output implementation code
- Output Prompt interpretation

**Only output the final Prompt during Stage 1-3. Stage 4 generates files.**

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation list includes generic phrases such as "agent prompt", "system prompt", "create skill", and "design skill", which can plausibly appear in ordinary discussion or unrelated prompt-engineering tasks. Although a NOT-for line is present, the trigger scope is still broad and lacks clearer constraints or negative examples tying invocation to this specific full-cycle skill-creation workflow.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The language rule mandates that the skill detect the user's language and respond only in that language, and elsewhere states a default preference for Chinese. This creates a language/locale policy concern because it constrains output language automatically rather than clearly offering the user a choice or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This section explicitly says to default to Chinese output and prioritize Chinese, which is a natural-language locale policy embedded in the skill instructions. Because the skill is not documented as a region-specific tool and does not present this as a user choice, it can conflict with organizational expectations around neutral or user-selected language behavior.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 84% confidence

Finding

Allowing Stage 3 to 'loop indefinitely' creates an unbounded interaction pattern that can consume tokens, time, and system resources without a hard stop. In an agent environment, this can be abused by a user or adversarial prompt sequence to keep the skill trapped in endless refinement, causing denial of service, cost blowup, or starvation of other tasks.

Content

Scanner excerpt · SKILL.md (reported line 751)May include surrounding context.

md

**Rollback mechanism**: If the user says "start over", "go back to positioning", "not satisfied, start again", clear all Stage 3 modifications and return to Stage 1. Keep previous Stage outputs as reference, but clearly mark "Below is from the previous round, for reference only."

**⏸ Pause after each modification. Stage 3 can loop indefinitely.**

### Stage 4 — Skill File Generation (triggered when user explicitly says "looks good"/"satisfied"/"generate")

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file consistently presents requirements and headings in a mandatory Chinese/English bilingual form, indicating a fixed language/locale pattern rather than offering a user choice. This matches the policy category for language or locale constraints imposed without opt-in or a clearly documented regional justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

L023 says the skill must detect the user's language and use that same language throughout, with English users receiving English-only output. But later language-strategy sections require default Chinese output plus an English version, and Stage 2 explicitly requires complete Chinese and English prompts. These instructions conflict and can cause the skill to behave differently from its stated interaction policy.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file includes a manifest example with the placeholder trigger field '触发词：...' but does not provide any specificity, constraints, or examples of acceptable trigger phrases. Because trigger design is left completely open-ended, authors could interpret this as permitting overly broad everyday-language triggers, which matches the vague-trigger category for markdown/manifest guidance.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: platforms/SKILL.md:71