OATDA List Models

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:48 AM UTC
• Version: 1.0.4

Overview

This skill coherently lists OATDA models using a disclosed API key and does not show hidden, destructive, or persistent behavior.

Install this only if you use OATDA and are comfortable with the agent reading your OATDA API key from the environment or ~/.oatda/credentials.json to make GET requests to oatda.com. Avoid using it for general model advice unless you specifically want OATDA model availability.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

"openclaw":
      {
        "emoji": "📋",
        "requires": { "bins": ["curl", "jq"], "env": ["OATDA_API_KEY"], "config": ["~/.oatda/credentials.json"] },
        "primaryEnv": "OATDA_API_KEY",
      },
  }

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

"openclaw":
      {
        "emoji": "📋",
        "requires": { "bins": ["curl", "jq"], "env": ["OATDA_API_KEY"], "config": ["~/.oatda/credentials.json"] },
        "primaryEnv": "OATDA_API_KEY",
      },
  }

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

"openclaw":
      {
        "emoji": "📋",
        "requires": { "bins": ["curl", "jq"], "env": ["OATDA_API_KEY"], "config": ["~/.oatda/credentials.json"] },
        "primaryEnv": "OATDA_API_KEY",
      },
  }

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description says the skill triggers when the user wants to 'find the right model for a task' or 'know which providers are supported,' which are broad natural-language intents rather than specific invocation phrases or constrained contexts. Without narrower trigger scope or negative examples, this could overlap with many ordinary AI-related conversations and cause unintended activation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.