Riddle

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:49 AM UTC
• Version: 1.1.0

Overview

The skill is not shown to be malicious, but it asks users to install and allowlist a third-party browser plugin that can receive sensitive browser-session data.

Review this before installing. Use it only if you are comfortable sending target page content, screenshots, optional HAR network traces, and any supplied cookies, localStorage values, or headers to Riddle's hosted service. Prefer test or least-privileged credentials, avoid production or administrator sessions, pin and audit the exact plugin release where possible, and remove the allowlist entry and API key when no longer needed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Unpinned Third-Party Plugin Installation with Access to Sensitive Browser Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43–61; sensitive data capabilities are documented at lines 89–103
Vulnerability Type: Unpinned external dependency installation
Risk Level: Medium

Vulnerable Code

bash

# Install the plugin
openclaw plugins install @riddledc/openclaw-riddledc

# Allow the tools
openclaw config set tools.alsoAllow --json '["openclaw-riddledc"]'

# Set your API key
openclaw config set plugins.entries.openclaw-riddledc.config.apiKey "YOUR_RIDDLE_API_KEY"

bash

# See what you have
openclaw config get plugins.allow

# Add openclaw-riddledc to the array (or edit ~/.openclaw/openclaw.json directly)
jq '.plugins.allow += ["openclaw-riddledc"]' ~/.openclaw/openclaw.json > tmp && mv tmp ~/.openclaw/openclaw.json

# Restart
openclaw gateway restart

The resulting plugin is documented as handling sensitive browser data:

text

All tools return screenshots saved to `~/.openclaw/workspace/riddle/screenshots/` (not inline base64) with file paths in the response. Add `include: ["har"]` to also capture full network traffic.

text

Need to interact with a page behind login? Pass cookies, localStorage, or custom headers:

Screenshot https://app.example.com/dashboard with these cookies: [session=abc123]

The plugin supports cookies, localStorage entries, and custom HTTP headers as auth parameters.

Technical Analysis

The installation command does not specify an exact package version or integrity digest. It therefore installs whichever release the package registry resolves at installation time. The instructions subsequently add the plugin to OpenClaw's tool and plugin allowlists, configure an API key, and restart the gateway.

Only SKILL.md is present in the audited project. The plugin source, package lockfile, capability manifest, and checksums referenced by the document are not included. Consequently, claims concerning hardcoded network restrictions, filesystem confinement, context isolatio ...[truncated 2045 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to a reviewed, immutable version rather than installing the registry's current release:

   bash

   openclaw plugins install @riddledc/openclaw-riddledc@X.Y.Z
   

2. Publish an expected cryptographic integrity digest through a trusted channel and require verification before installation.
3. Include the exact plugin source, dependency lockfile, openclaw.plugin.json, SECURITY.md, and CHECKSUMS.txt in the auditable artifact.
4. Verify npm provenance and signatures for the exact pinned release rather than relying only on package-name-level instructions.
5. Enforce runtime egress restrictions independently of plugin code so the plugin process can communicate only with the required endpoint.
6. Use a narrowly scoped and revocable API key, and avoid placing reusable secrets directly in shell command arguments where command history or process inspection may expose them.
7. Use short-lived, least-privileged browser credentials. Warn users not to provide administrator sessions or broadly reusable authentication tokens.
8. Disable HAR capture by default. When it is required, redact authorization headers, cookies, tokens, request bodies, and sensitive query parameters before storage or transmission.
9. Require explicit user confirmation before transmitting cookies, localStorage values, custom headers, or authenticated page content to the hosted service.
10. Perform a separate source-code audit of the exact plugin release and its transitive dependencies before allowlisting it.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

## Install

**Step 1: Sign up** — Create a free account at [riddledc.com/register](https://riddledc.com/register). No credit card required. You get 5 minutes of browser time free.

**Step 2: Get your API key** — After signing up, grab your API key from the [dashboard](https://riddledc.com/dashboard).

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation advertises include: ["har"] to capture full network traffic without warning that HAR data commonly contains URLs, headers, cookies, tokens, request bodies, and response contents. Because this is a hosted browser service, enabling HAR capture can expose highly sensitive data to the provider and to local workspace artifacts if users are not explicitly cautioned.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly encourages passing cookies, localStorage entries, and custom headers to a hosted third-party browser service, but it does not clearly warn that these authentication artifacts may grant account access and will be transmitted off-machine. In this context, users may unknowingly send session secrets or sensitive app data to the service, creating privacy, account-takeover, and compliance risks if mishandled or logged.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.