Security audit

qqbot

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a legitimate QQ bot/OpenClaw integration, but it ships a credential-like secret and stores chat messages and user identifiers in plaintext without enough disclosure or safeguards.

Review before installing. Replace and rotate any QQ AppSecret that matches the packaged example, keep bot secrets out of source-controlled files, and run the bot only in an account/workspace where plaintext QQ messages and logs are acceptable. Consider adding restrictive file permissions, log redaction/rotation, dependency pinning, and explicit consent before processing private or group chat content.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: config.example.json:3
Finding: Credential-Like QQ Bot Secret Committed in Example Configuration
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: install.sh:10
Finding: Unpinned Python Dependencies Installed at Runtime
Content: View full analysis
/dev/null if [ $? -ne 0 ]; then echo "Installing dependencies..." pip3 install requests aiohttp websockets --user -q fi ``` The same unpinned installation command is also recommended in `SKILL.md:164-166`. ### Technical Analysis The installer retrieves the latest package versions matching the names `requests`, `aiohttp`, and `websockets`. It does not use exact version constraints, artifact hashes, a lock file, or an isolated virtual environment. As a result, the code executed by a future installation is not necessarily the code that was available when the Skill was audited. A compromised upstream release, package-index account, dependency of one of these packages, or unexpected incompatible version could introduce malicious or unsafe behavior. The `--user` option limits installation to the current user's Python environment, but packages installed there still execute with that user's privileges when the bot starts. They can therefore access the bot source, configured credentials, QQ messages, and user-readable OpenClaw workspace data. ### Attack Path 1. One or more required Python modules are absent from the user's environment. 2. The user runs `install.sh`. 3. The script invokes `pip3` against its configured package index and resolves mutable package versions. 4. A compromised or malicious resolved package executes installation or import-time code as the current user. 5. The package reads or alters user-accessible files, bot credentials, messages, or application behavior. ### Impact Assessment A compromised dependency would execute with the privileges of the user running the installer or bot. It could access the QQ App Secret stored in the Python script, intercept access tokens and messages, modify ...[truncated 168 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: qq_official_bot.py:247
Finding: QQ Message Contents and User Identifiers Stored in Plaintext Queue Files
Content: View full analysis
"$LOG_FILE" 2>&1 & ``` ### Technical Analysis The bot writes the QQ user identifier, username, complete message body, and timestamp to a predictable directory under the OpenClaw workspace. The directory and files are created without explicitly enforcing restrictive permissions such as `0700` for the directory and `0600` for files. The files are normally deleted after receiving a response or reaching a timeout, but plaintext data remains present while processing. It may remain longer if the process crashes, is terminated, encounters a cleanup error, or loses access to the expected response flow. The cleanup exceptions are suppressed, so failed deletion is not surfaced. The bot also prints received message content and identifiers. When started through the daemon script, standard output and errors are redirected to a persistent plaintext log. No rotation, redaction, retention limit, or explicit permission hardening is configured. ### Attack Path 1. A QQ user sends a priva ...[truncated 936 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (32)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · qq_bot_daemon.sh (reported line 69)May include surrounding context.
sh
tail -20 "$LOG_FILE" else echo "⚠️ QQ Bot 未运行" [ -f "$PID_FILE" ] && rm -f "$PID_FILE" fi ;;

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · qq_official_bot.py (reported line 46)May include surrounding context.
python
self.heartbeat_task = None def get_access_token(self): """获取 Access Token""" payload = { "appId": APP_ID, "clientSecret": APP_SECRET

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · qq_official_bot.py (reported line 57)May include surrounding context.
python
self.heartbeat_task = None def get_access_token(self): """获取 Access Token""" payload = { "appId": APP_ID, "clientSecret": APP_SECRET

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · qq_official_bot.py (reported line 445)May include surrounding context.
python
self.heartbeat_task = None def get_access_token(self): """获取 Access Token""" payload = { "appId": APP_ID, "clientSecret": APP_SECRET

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The guide instructs users to place the QQ AppSecret directly into JSON and Python files under a local workspace, which encourages long-lived plaintext credential storage in locations that may be backed up, logged, synced, or accidentally committed to version control. In the context of a bot integration skill, this increases the chance of credential disclosure and unauthorized use of the QQ bot account/API.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This plain-text guide instructs the publisher to use Chinese-language metadata and description content throughout, including fixed text to paste into the listing. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern unless the locale restriction is explicitly justified, which it is not here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code contains multiple user-facing console messages and form content entirely in Chinese, which effectively forces a specific language for operation. The file does not provide any opt-in, fallback, or justification that the skill is intended only for a Chinese-language or region-specific audience.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script automatically selects and uploads a local ZIP file from the user's Desktop to an external website without an explicit confirmation step at the moment of exfiltration. Even though the target path is hard-coded and the site is visible in the browser, this still creates a data-transfer risk because a local file is sent off-device based solely on script logic, and users may not realize exactly which file is being uploaded.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: All user-facing messages and instructions in the script are presented only in Chinese, with no indication that another language is available or that Chinese is required for a documented regional reason. This can violate language/locale policy when a skill imposes a language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script's console messages and the prefilled published description are written in Chinese, which imposes a specific language on the user and on the generated listing content. The file does not offer any user opt-in, language selection, or documented justification that this skill is intended only for a Chinese-language environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script directs the user to upload a local ZIP archive to an external site and provides no warning to verify the archive contents, sensitivity of included data, or trustworthiness of the destination. In a skill distribution context, this can lead to accidental disclosure of source code, secrets, private data, or proprietary artifacts if the ZIP was prepared incorrectly or the publication target is inappropriate.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script's prompts, instructions, and labels are consistently presented in Chinese, including all user interaction text. This creates a language/locale policy concern because the skill does not offer an opt-in choice or explain that it is intended only for Chinese-speaking or region-specific users.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 65% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · qq_bot_daemon.sh (reported line 19)May include surrounding context.
sh
echo "🚀 启动 QQ 官方机器人 (后台运行)..." echo "📄 日志文件: $LOG_FILE" nohup python3 -u qq_official_bot.py > "$LOG_FILE" 2>&1 & echo $! > "$PID_FILE" sleep 2

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The top-level docstring presents the file as a QQ official bot WebSocket connection example with complete functionality. However, the implementation additionally persists incoming user content under ~/.openclaw/workspace/qq_queue and integrates with a separate OpenClaw AI response mechanism, which is a materially different behavior from a pure connection example.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · qq_official_bot.py (reported line 20)May include surrounding context.
python
# API 地址 TOKEN_URL = "https://bots.qq.com/app/getAppAccessToken" GATEWAY_URL = "https://api.sgroup.qq.com/gateway" API_BASE = "https://api.sgroup.qq.com" # 订阅的事件意图 (INTENTS)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 80% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · qq_official_bot.py (reported line 52)May include surrounding context.
python
"clientSecret": APP_SECRET } try: response = requests.post(TOKEN_URL, json=payload, timeout=10) if response.status_code == 200: data = response.json() self.token = data.get("access_token")

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Incoming user messages, usernames, and user IDs are written to disk for downstream processing without any user notice, consent, or minimization. In a chat bot context this creates a privacy and data-governance issue because potentially sensitive private or group conversations are persisted locally and may be accessible to other local processes or users.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The bot persists natural-language messages plus identifiers into predictable files under the user's home directory for another component to consume. This creates a clear data leakage path: private message contents and metadata can be exposed to other local users, malware, backups, logs, or unintended downstream consumers, especially because the data is stored unencrypted and cleanup is best-effort only.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This plain-text skill instruction file presents all operational guidance and copied metadata in Chinese, and does not indicate that the user can choose another language or locale. Under the policy for natural-language violations, forcing a specific language without user opt-in is reportable unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script's console output and form content are written entirely in Chinese, and there is no option for the user to choose a language or locale. This can violate language/locale policy when a skill imposes one language by default without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script's console messages are written in Chinese, starting with the launch message on L006, and this continues throughout the file. For a general-purpose publishing automation script, this imposes a specific language on users without any documented opt-in or locale selection.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script automatically runs pip3 install requests aiohttp websockets --user -q when imports fail, without prompting the user or clearly disclosing that it will modify the local Python environment. This is risky because it performs network-based package installation during setup, which can surprise users, affect reproducibility, and expose them to dependency or supply-chain risk if package resolution is compromised.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description states the skill/package includes configuration steps and troubleshooting in Chinese, with no indication that users can choose another language or that the package is intentionally limited to a Chinese-speaking context. This is a natural-language locale policy concern because it appears to impose a specific language without opt-in.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: Using a caret range for Playwright allows newer minor/patch releases to be installed, which can make builds non-reproducible and may unexpectedly pull in a vulnerable or breaking version. In a skill context that automates browser actions, dependency drift increases supply-chain risk because the installed browser automation stack may change over time without review.
Content: Scanner excerpt · package.json (reported line 14)May include surrounding context.
json
"license": "ISC", "type": "commonjs", "dependencies": { "playwright": "^1.58.2" } }

Unverifiable Dependency: playwright has 1 known advisory(ies) (CVE-2025-59288 (Playwright downloads and installs browsers without verifying the authenticity of)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: The manifest includes Playwright while static analysis notes a known advisory affecting some releases, and the version is not pinned exactly, so it is unclear whether installation will resolve to an affected version. Because Playwright downloads browser binaries as part of its workflow, an authenticity-verification weakness can expand supply-chain exposure beyond a typical library dependency.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.