Security audit

Prior Openclaw

Security checks for vulnerabilities and agentic risk

Overview

The skill performs its advertised Prior knowledge-search function, but it encourages chat-based API key sharing and broad automatic external searches that may send sensitive project context to a third party.

Review this skill before installing in private or regulated workspaces. Use only the private API key setup path, avoid pasting credentials into chat, and treat Prior searches as sending query text to an external service. Do not let the agent search raw logs, stack traces, paths, customer data, tokens, or proprietary code unless you have reviewed and sanitized the query.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:29
Finding: Broad Mandatory Instructions Hijack the Agent's Normal Workflow
Content: View full analysis
]` - `[Skipping Prior: ]` — should be rare ``` ```markdown ## Contributing — The Post-Task Check Before wrapping up any task, apply this test: **did I try something that didn't work before finding what did?** If yes — that's a contribution. **Ask the user**: "I had to try a few approaches on X before finding the fix — want me to contribute that to Prior so other agents skip the dead ends?" Don't contribute: project-specific details, secrets, file paths, trivially searchable info. Scrub PII before submitting. ### Completion summary After any work involving iteration, end with one of: - An offer to contribute: "I had to work through X — want me to contribute that to Prior?" - "No contribution needed — nothing required iteration." Don't wait for the user to ask. --- ## Visibility **Tell the user when Prior helps.** If a sear ...[truncated 2254 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:17
Finding: Setup Flow Encourages Users to Paste an API Key into the Conversation
Content: View full analysis
"}}}}'` - **Private:** Tell them to run: `openclaw config set skills.entries.prior.apiKey ` 3. Verify with a credits check (see API Reference below) ``` ### Technical Analysis The “Quick” setup path explicitly asks the user to paste a bearer credential into the conversation. This places the secret in the chat transcript and agent context before it is written into configuration. Depending on the hosting environment, it may also appear in provider logs, observability systems, tool-call records, debugging traces, or conversation exports. The alternative labeled “Private” is materially safer because it keeps the key outside the conversational context. However, presenting direct secret disclosure as the quick or convenient path encourages insecure credential handling. The subsequent API examples obtain the key from `process.env.PRIOR_API_KEY`, which is preferable to embedding it in commands. The vulnerability is specifically the conversational collection and tool-argument handling of the key. ### Attack Path 1. A user installs the Skill without an existing `PRIOR_API_KEY`. 2. The agent offers the documented quick setup flow. 3. The user pastes the API key into the conversation. 4. The key becomes part of the transcript and agent context. 5. The key is copied into a `gateway` configuration-patch tool call, potentially creating another logged representation. 6. A ...[truncated 807 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:109
Finding: Automatic Search Can Transmit Sensitive Error and Task Context to an External Service
Content: View full analysis
]` - `[Skipping Prior: ]` — should be rare ### How to search well - For errors: search the **error message**, not your goal. `"ECONNREFUSED 127.0.0.1:5432"` not `"how to connect to Postgres"` - For everything else: search the **specific task**. `"Ktor CORS configuration with credentials"` not `"how to set up CORS"` - Include framework/language name for better matches - Read `failed_approaches` FIRST — skip known dead ends ``` ```markdown ### Search ```js node -e "const https=require('https');const d=JSON.stringify({query:'ECONNREFUSED 127.0.0.1:5432',context:{runtime:'openclaw'}});const r=https.request({hostname:'api.cg3.io',path:'/v1/knowledge/search',method:'POST',headers:{'Authorization':'Bearer '+process.env.PRIOR_API_KEY,'Content-Type':'application/json','Content-Length':Buffer.byteLength(d)}},res=>{let b=' ...[truncated 3053 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README explicitly states that the skill will search a remote knowledge base, contribute solutions it discovers, and send feedback via API calls, but it does not clearly warn that error details, prompts, code snippets, or other sensitive troubleshooting context may be transmitted to a third-party service. In an agent environment, those payloads can easily include proprietary source code, secrets, internal paths, or customer data, creating a meaningful data exfiltration and privacy risk through normal operation rather than an obvious exploit.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The setup flow explicitly offers a 'Quick' option asking the user to paste their API key into chat so the agent can configure it. Secrets pasted into chat may be retained in logs, transcripts, analytics systems, or exposed to downstream tools, making this a credential-handling risk even if the intent is convenience.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This line specifically encourages the user to provide a live API credential directly in the conversation for agent-side use. That creates a straightforward secret disclosure path and can lead to account misuse if the key is logged, replayed, or accessed by other components in the agent environment.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to search Prior for a very wide range of routine situations, including setup, architecture choices, unfamiliar tools, and anything that 'feels tricky.' In practice this can drive near-constant third-party queries, increasing unnecessary data exposure, external dependency use, and cost/telemetry leakage beyond what a user likely expects.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.
md
**Tell the user when Prior helps.** If a search returns useful results, say so naturally — "Found a Prior entry that covers this" or "Prior flagged that approach as a dead end, skipping to the working solution." If Prior saves you work, make it visible. The user should see the value without asking. ---

Static analysis

No suspicious patterns detected.