Public Relations Manager

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 7:47 AM UTC
• Version: 1.0.0

Overview

This PR assistant is purpose-aligned and disclosed, but users should treat its unpinned external install instructions and journalist contact data handling with normal caution.

Install in a virtual environment from a source you trust, prefer pinned versions or reviewed commits, and avoid storing unnecessary journalist personal data. Review generated pitches before sending and choose output filenames deliberately.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:84

Finding

Unpinned External Dependencies Are Installed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:84-96, SKILL.md:373, SKILL-CLAWHUB.md:84-96, and SKILL-CLAWHUB.md:373
Vulnerability Type: Supply-chain exposure through mutable, unverified external dependencies
Risk Level: Medium

Vulnerable Code Snippet

bash

pip install openclaw-public-relations-manager

bash

clawhub install public-relations-manager

bash

git clone https://github.com/ZhenRobotics/openclaw-public-relations-manager
cd openclaw-public-relations-manager
pip install -e .

The final installation instruction is also repeated as:

bash

clawhub install public-relations-manager

Technical Analysis

The audited artifact contains only two duplicate documentation files and does not include the package implementation, dependency lockfile, package hashes, signed release metadata, or a pinned Git commit. The installation instructions therefore cause users to trust mutable content obtained from PyPI, ClawHub, or the repository's current default branch.

The pip install instruction does not pin an exact package version or verify an artifact hash. The Git installation procedure similarly checks out the mutable default branch rather than a reviewed commit. Moreover, Python package installation can execute attacker-controlled build backend logic or installation hooks. The effective code executed by users may consequently differ from the content available when the skill documentation was audited.

This finding establishes a supply-chain weakness, not evidence that the referenced upstream package is currently malicious. The absent implementation also prevents local verification of the claims that the package contains 27 modules and 4,078 lines of code.

Attack Path

1. An attacker compromises the referenced PyPI or ClawHub publisher account, gains control of the upstream repository, or otherwise causes a malicious release to be distributed under the expect ...[truncated 1255 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete executable source code in the reviewed skill artifact so that installed behavior can be audited together with its documentation.
2. Pin the Python package to an exact reviewed version rather than installing the latest available release.
3. Provide a hash-locked requirements file and require hash verification, for example through pip install --require-hashes.
4. Pin Git-based installation instructions to a specific reviewed commit SHA rather than the mutable default branch.
5. Publish signed release artifacts and document signature or provenance verification.
6. Provide a dependency lockfile containing exact transitive dependency versions and integrity hashes.
7. Avoid editable installations in production guidance. Build a reproducible wheel from a verified source revision and install that immutable artifact instead.
8. Recommend installation inside an isolated virtual environment or container using a non-privileged account.
9. Add automated supply-chain controls such as dependency scanning, release provenance generation, protected publisher accounts, and continuous verification that published artifacts match the reviewed source.
10. Apply the corrected instructions consistently to both duplicate documentation files and to the repeated installation command at line 373.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly manages journalist profiles, contact information, response rates, and interaction history, which are forms of personal and behavioral data. Presenting these capabilities without any privacy notice, retention guidance, lawful-basis warning, or safe-handling instructions can lead users to collect, store, and process personal data in ways that violate privacy expectations or regulatory requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file includes an example that saves a generated press release to press_release.md, which affects user data on disk. The surrounding documentation does not provide any user-facing warning or note that the example performs a file write, so users may not realize it creates or overwrites a local file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.