OATDA Text Completion

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:56 AM UTC
• Version: 1.0.5

Overview

The skill does what it claims, but its shell instructions handle user prompts and API keys in a way that could expose credentials or execute unintended commands if copied literally.

Review before installing. Use this only when you intentionally want prompts sent to OATDA and the selected external model provider. Do not send secrets, private business data, regulated data, or proprietary content unless that transfer is approved. The publisher should replace the shell JSON template with structured JSON construction such as jq --arg and avoid exporting the API key more broadly than the single request needs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:60

Finding

Shell Command Injection Through Unsafe User Prompt Interpolation

Content

View full analysis

", "model": "", "prompt": "", "temperature": 0.7, "maxTokens": 4096 }' ``` The same unsafe construction pattern appears in the example: ```bash curl -s -X POST "https://oatda.com/api/v1/llm" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $OATDA_API_KEY" \ -d '{ "provider": "anthropic", "model": "claude-3-5-sonnet", "prompt": "Write a haiku about code", "temperature": 0.7, "maxTokens": 256 }' ``` ### Technical Analysis The Skill instructs an agent to insert attacker-controlled prompt content into a single-quoted shell argument. If the agent performs direct textual substitution, a prompt containing a single quote can terminate the shell argument. The remaining prompt text can then introduce shell operators and arbitrary commands. Even when command injection is not attempted, prompt content containing quotation marks, backslashes, control characters, or newlines can create malformed JSON. Shell quoting is not an appropriate JSON-escaping mechanism. The risk is amplified because the same command resolves and exports `OATDA_API_KEY` before invoking `curl`. Any injected command would execute in a process context where the API key is available. The documented credential access itself is consistent with authenticated OATDA API use and does not independently demonstrate credential harvesting; however, the injection flaw could turn that legitimate access into a credential-exfiltration path. ### Attack Path 1. An attacker supplies a text-completion request containing a si ...[truncated 1432 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

"openclaw":
      {
        "emoji": "💬",
        "requires": { "bins": ["curl", "jq"], "env": ["OATDA_API_KEY"], "config": ["~/.oatda/credentials.json"] },
        "primaryEnv": "OATDA_API_KEY",
      },
  }

Credential Access

High

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The skill reads an API key directly from a local credentials file and exports it into the shell environment for subsequent commands. While common, this broadens exposure of the secret to spawned processes and shell context, increasing the risk of accidental leakage through debugging, logging, or process inspection.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

All commands need the OATDA API key. Resolve it inline for each exec call:

bash

export OATDA_API_KEY="${OATDA_API_KEY:-$(cat ~/.oatda/credentials.json 2>/dev/null | jq -r '.profiles[.defaultProfile].apiKey' 2>/dev/null)}"

If the key is empty or null, tell the user to get one at https://oatda.com and configure it.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

This API call pattern loads the secret from disk and exports it inline before making the request, which unnecessarily propagates the credential into the process environment. In multi-tool or logged execution contexts, that can increase exposure of the bearer token beyond the minimum needed for the request.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

API Call

bash

export OATDA_API_KEY="${OATDA_API_KEY:-$(cat ~/.oatda/credentials.json 2>/dev/null | jq -r '.profiles[.defaultProfile].apiKey' 2>/dev/null)}" && \
curl -s -X POST "https://oatda.com/api/v1/llm" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $OATDA_API_KEY" \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 79% confidence

Finding

The example repeats the pattern of reading a local credential and exporting it to the shell, reinforcing insecure secret-handling habits. Examples are often copied verbatim, so insecure examples can propagate unsafe operational practices into real deployments.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

User: "Write a haiku about code using claude"

bash

export OATDA_API_KEY="${OATDA_API_KEY:-$(cat ~/.oatda/credentials.json 2>/dev/null | jq -r '.profiles[.defaultProfile].apiKey' 2>/dev/null)}" && \
curl -s -X POST "https://oatda.com/api/v1/llm" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $OATDA_API_KEY" \

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description is broad enough to trigger on common writing requests, which increases the chance the agent routes ordinary user prompts into this skill and sends them to a third-party service. In this context, overbroad activation materially raises privacy and unintended data-transfer risk because many generic text requests may contain sensitive content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs sending user prompts to OATDA's external API but does not require an explicit privacy or data-transmission warning to the user beforehand. This is dangerous because users may unknowingly disclose confidential, regulated, or proprietary information to a third party.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This command performs an authenticated POST to an external API and includes the full user prompt in the request body. In a text-generation skill, that creates a direct exfiltration path for user-provided content to leave the local environment, especially when combined with broad triggers and no consent gate.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

bash

export OATDA_API_KEY="${OATDA_API_KEY:-$(cat ~/.oatda/credentials.json 2>/dev/null | jq -r '.profiles[.defaultProfile].apiKey' 2>/dev/null)}" && \
curl -s -X POST "https://oatda.com/api/v1/llm" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $OATDA_API_KEY" \
  -d '{

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

Example

User: "Write a haiku about code using claude"

bash

export OATDA_API_KEY="${OATDA_API_KEY:-$(cat ~/.oatda/credentials.json 2>/dev/null | jq -r '.profiles[.defaultProfile].apiKey' 2>/dev/null)}" && \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

The example command normalizes external transmission as standard usage without any consent or sensitivity screening. That increases the likelihood that operators copy a pattern that sends user content to a third-party API without realizing the privacy implications.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

bash

export OATDA_API_KEY="${OATDA_API_KEY:-$(cat ~/.oatda/credentials.json 2>/dev/null | jq -r '.profiles[.defaultProfile].apiKey' 2>/dev/null)}" && \
curl -s -X POST "https://oatda.com/api/v1/llm" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $OATDA_API_KEY" \
  -d '{