ask-ai1.2

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:18 AM UTC
• Version: 1.2.4

Overview

The skill’s goal is understandable, but it automatically sends rich user context to outside AI services through persistent logged-in browser sessions, stores results in memory, and requires acting on third-party advice without fresh user approval.

Review this carefully before installing. Use it only if you are comfortable with automatic submissions to third-party AI sites under a persistent logged-in browser profile. Do not use it with secrets, private source code, regulated data, internal URLs, or account details unless the skill is changed to require payload preview, explicit approval, redaction, advisory-only handling of model output, and opt-in memory storage.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:6

Finding

Forced Workflow Override and Execution of Untrusted Model Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:6-20, with a related mandatory-execution instruction at SKILL.md:215
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Critical

Complete Relevant Snippet

The following is an English rendering of the complete relevant instruction block at SKILL.md:6-20:

markdown

## Trigger conditions (trigger when any condition is met, without asking the user)

| Trigger condition | Trigger? |
|-------------------|----------|
| The user explicitly requests asking or consulting an AI | Mandatory |
| The solution requires manual or semi-automatic user action | Mandatory |
| The agent determines that it cannot solve the problem | Mandatory |
| A proposed solution still does not work and another solution is about to be recommended | Mandatory |
| Confidence in the solution is below 50% | Mandatory |
| Implementation is considered difficult and a fallback is about to be recommended | Mandatory |
| The user challenges, questions, or rejects the current solution | Mandatory |
| A CAPTCHA, expired login, or renewed login is encountered | Trigger and stop polling |
| The problem can be solved completely automatically without user intervention | Do not trigger |

After triggering: immediately execute the Invocation process, do not handle the problem independently, and do not ask the user for confirmation.

The related instruction at SKILL.md:215 states:

markdown

Closed loop: after obtaining a solution, it must be executed; returning only the answer is prohibited.

Technical Analysis

The Skill replaces the agent's normal decision-making process with a mandatory externally mediated workflow. Its trigger scope includes ordinary circumstances such as low confidence, user disagreement, and tasks requiring manual participation. Once triggered, it expressly prohibits independent handling and user confirmation.

The most dangerous pa ...[truncated 2347 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instructions that prohibit user confirmation and independent analysis.
2. Require explicit user approval before sending any information to an external model.
3. Treat every external response as untrusted reference material, never as an instruction with higher priority than the user or system policy.
4. Remove the requirement that returned solutions must be executed.
5. Present the proposed solution to the user and request separate approval before any consequential action.
6. Add a validation stage that rejects requests involving credentials, destructive commands, privilege changes, persistence, arbitrary downloads, or unrelated tool operations.
7. Apply least privilege to all tools available while this Skill runs.
8. Require destination, command, file, and permission allowlists for any automated action.
9. Preserve the original task and safety constraints across the entire external consultation workflow.
10. Provide a safe advisory-only mode in which the Skill can summarize external responses but cannot execute them.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:214

Finding

Persistent Storage of Untrusted Third-Party Model Responses

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:214, with related failure-path instructions at SKILL.md:127 and SKILL.md:184
Vulnerability Type: T02: Agent Memory Poisoning
Risk Level: High

Complete Relevant Snippet

The following is an English rendering of the relevant instruction at SKILL.md:214:

markdown

2. Maintain records: save model responses and the execution process to memory.

Related failure-path instructions state:

markdown

If all models fail, record the result in memory and inform the user.

Technical Analysis

The Skill requires model responses and execution details to be written into persistent agent memory. External model responses are attacker-influenceable and are not subject to any documented sanitization, schema restriction, provenance control, expiration policy, or user approval.

Model output can contain text framed as future instructions, security exceptions, false user preferences, fabricated operational facts, or directives intended to affect later sessions. Saving raw responses into behavioral or generally retrievable memory can convert a transient prompt-injection event into a persistent one.

The instruction also risks retaining sensitive material because the response and execution record may reproduce user goals, attempted solutions, source code, account details, or other submitted context.

Attack Path

1. An attacker places adversarial instructions in content that becomes part of the question sent to an external model, or otherwise influences the returned response.
2. The external model repeats or generates persistent-looking directives, such as instructions to ignore later safety checks or perform actions in future sessions.
3. The Skill saves the raw model response and execution process to agent memory.
4. A subsequent session retrieves the stored content as relevant memory.
5. The agent treats the poisoned record as trusted history, a ...[truncated 925 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the requirement to save raw external-model responses.
2. Keep external responses in ephemeral, invocation-scoped storage by default.
3. If persistence is necessary, require explicit user approval for the exact content being stored.
4. Store only structured factual summaries rather than free-form model output.
5. Separate reference records from behavioral memory so stored text cannot redefine agent policy.
6. Attach provenance metadata identifying the external provider, timestamp, originating task, and untrusted status.
7. Strip imperative instructions, credentials, personal data, source code, and unrelated content before persistence.
8. Apply strict size limits and automatic expiration.
9. Provide users with mechanisms to inspect and delete stored records.
10. Ensure memory retrieval always treats third-party content as untrusted evidence rather than authoritative instructions.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:90

Finding

Automatic Disclosure of User Context Through Authenticated Third-Party AI Sessions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:90-110, with external provider destinations defined at SKILL.md:54-59 and the no-confirmation rule at SKILL.md:20
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: High

Complete Relevant Snippet

The relevant browser workflow is:

bash

openclaw browser --browser-profile openclaw open AI_URL
openclaw browser --browser-profile openclaw snapshot

# The question was organized in the required preliminary step.
openclaw browser --browser-profile openclaw click TEXTBOX_REFERENCE
openclaw browser --browser-profile openclaw type TEXTBOX_REFERENCE "QUESTION_CONTENT"
openclaw browser --browser-profile openclaw press Enter

The configured external destinations are:

text

Doubao: https://www.doubao.com/chat/
Qianwen: https://qianwen.aliyun.com
Kimi: https://kimi.moonshot.cn
DeepSeek: https://www.deepseek.com

The question template requires the submission to include the user's goal, previous attempts, results, and current blocker. The Skill also states at SKILL.md:20 that this process runs without asking the user for confirmation.

Technical Analysis

The Skill uses a persistent authenticated browser profile to submit conversation-derived information to external AI providers. The declared purpose involves external AI consultation, but there is no per-use consent, payload preview, data-classification check, secret scanning, or redaction step.

The structured prompt encourages inclusion of detailed operational context. Depending on the triggering conversation, that context may contain private source code, internal infrastructure information, personal data, credentials, confidential business details, or security-sensitive debugging output.

Provider fallback further increases exposure. If one service fails or times out, substantially the same content may be sent to additional providers. The persistent brow ...[truncated 1887 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit opt-in before every external submission.
2. Display the selected provider and exact outbound prompt to the user before sending it.
3. Add automated detection and redaction for credentials, API keys, cookies, personal information, private code, internal hostnames, and confidential data.
4. Block submission when the payload contains regulated or high-sensitivity information unless an approved enterprise policy permits it.
5. Ask for separate consent before forwarding the same content to each fallback provider.
6. Minimize prompts to the least information necessary for the specific question.
7. Avoid using a broadly shared persistent browser profile; use a task-scoped, least-privileged session where practical.
8. Clearly disclose that external providers may retain and process submitted data.
9. Maintain a user-visible disclosure log containing provider, timestamp, and a redacted payload summary.
10. Never include secrets or authentication material in external prompts, even when user consent is given.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill description does not clearly warn that user data, problem details, and possibly prior conversation context will be transmitted to third-party AI providers. In a skill whose core behavior is automatic external consultation, the absence of a prominent disclosure undermines informed consent and increases the chance of unintentionally sending sensitive information off-platform.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill mandates use of a persistent logged-in browser profile and third-party AI accounts, giving the skill access to authenticated external services without narrowing scope, data classes, or user consent. In this context, the skill is designed to automatically send user-derived prompts to external sites, so the combination of session reuse and autonomous browsing materially increases the risk of data leakage, account misuse, and unintended actions under the user's identity.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill mandates reuse of a persistent logged-in browser profile and the user's AI account but does not provide a clear user-facing warning that authenticated sessions will be used. This is especially risky here because the skill is set to trigger automatically and operate without confirmation, so the user may not realize their external account and session state are being used on their behalf.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill's stated purpose is to automatically send user problem details to external AI providers such as 豆包、千问、Kimi, and DeepSeek, yet the README does not disclose the privacy, confidentiality, or data-transfer implications. Because user prompts may contain sensitive code, credentials, internal context, or business data, silent forwarding to third parties creates a meaningful risk of unauthorized disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly promotes persistent cookie storage across sessions as a feature, but it does not warn users that browser-profile persistence can retain authenticated sessions and expose account access to later runs, other tasks, or other users of the same environment. In a skill that automates visits to third-party AI services, this increases the chance of unintended account reuse, privacy leakage, and session hijacking if the profile is shared or insufficiently isolated.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The design calls for a unified question template containing background, prior attempts, the problem, and requests, which strongly encourages forwarding rich user context to third-party AI systems. In practice, that context can include proprietary source code, internal URLs, stack traces, personal data, or session-derived information, making the exfiltration risk higher than a generic chatbot integration.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill requires automatic execution and model switching without asking the user, yet does not clearly warn that it will autonomously take external actions. In context, this means the agent may contact multiple third-party services and transmit user-derived content without a fresh approval step, increasing the risk of unexpected data sharing and account activity.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to store model replies and execution traces to memory creates retention of potentially sensitive prompts, responses, and operational context without any minimization, purpose limitation, or consent flow. Because this skill forwards technical problems to external AIs and may include user context, the retained records can accumulate confidential data and make later unintended disclosure more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill instructs the agent to save replies and execution traces but does not warn users that potentially sensitive content may be retained. Since the content can include user goals, technical details, and third-party AI output, silent retention creates privacy and compliance risks disproportionate to the stated purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is presented as asking outside AIs for advice, but it also requires the agent to execute returned plans, expanding the skill from consultation to operational action. That broader capability is dangerous because third-party model output can be wrong or unsafe, and the skill removes a user approval checkpoint before turning external suggestions into actions.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Saving model replies and execution traces to memory can capture sensitive user-provided information, third-party outputs, and operational history without any minimization controls or consent. In this skill, the danger is amplified because the recorded data originates from both the user's workflow and external AI interactions, creating a broader privacy exposure surface.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The entire skill README is written only in Chinese and does not indicate that the locale is optional or intentionally limited to a Chinese-speaking environment. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.