Clicky Analytics

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:03 AM UTC
• Version: 1.2.0

Overview

The skill mostly does what it claims, but it publishes realistic Clicky API credentials in its documentation and handles site keys in URL query strings.

Review this before installing. Replace the documented Clicky site IDs and site keys with placeholders, rotate them if they were ever real, and only store your own Clicky credentials in protected environment variables. Use the skill only for Clicky analytics requests and be aware that each invocation sends the configured site key and requested analytics parameters to Clicky's API.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:16
• Finding: Potential Clicky API Credential Embedded in Documentation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16-18` **Vulnerability Type**: Hardcoded credential exposure **Risk Level**: High ### Vulnerable Code ```bash # In ~/.openclaw/.env or your shell profile CLICKY_ENVELOPEBUDGET_SITE_ID=101427673 CLICKY_ENVELOPEBUDGET_SITEKEY=c287a01cc00f70cb ``` ### Technical Analysis The setup documentation contains a realistic, site-specific Clicky site ID and site key instead of clearly marked placeholders. The audit could not establish whether the credential is currently valid, but distributing a real or previously valid API credential in documentation exposes it to every recipient of the Skill and potentially through repository history, package archives, caches, and logs. A Clicky site key functions as an authentication secret for analytics API requests. Possession of both the site ID and corresponding site key may allow a party to retrieve analytics associated with that Clicky site. ### Attack Path 1. An attacker obtains the Skill package or accesses its source history. 2. The attacker extracts the site ID and site key from `SKILL.md`. 3. The attacker submits the values to the Clicky statistics API. 4. If the credential remains valid, the attacker requests supported analytics data types. 5. The attacker collects available website traffic and visitor analytics without authorization. ### Impact Assessment If valid, the exposed credential could provide unauthorized read access to analytics associated with the referenced Clicky site. Exposed information may include traffic counts, popular pages, referral URLs, search terms, campaigns, geographic statistics, and visitor-related activity supported by the account and API. The exposure does not grant demonstrated local operating-system privileges or access to unrelated credentials. Its scope is limited by the permissions and sites associated with the disclosed Clicky credential. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Immediately verify whether the documented site key is or was genuine. 2. Revoke and rotate the key if it could have been valid. 3. Remove the credential from the current documentation and replace it with unmistakable placeholders: ```bash CLICKY_EXAMPLE_SITE_ID=YOUR_CLICKY_SITE_ID CLICKY_EXAMPLE_SITEKEY=YOUR_CLICKY_SITE_KEY ``` 4. Purge the credential from version-control history and previously published artifacts where feasible. 5. Review Clicky access logs for unauthorized requests using the exposed credential. 6. Store production credentials in a restricted secret store or environment file with owner-only permissions rather than committing them to documentation. 7. Add secret-scanning checks to the development and release process to prevent future credential publication. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/clicky.sh:54
• Finding: Clicky API Secret Exposed Through a Command-Line URL<![CDATA[ ## Vulnerability Details **File Location**: `scripts/clicky.sh:54-57` **Vulnerability Type**: Credential exposure through process arguments and URL logging **Risk Level**: Medium ### Vulnerable Code ```bash URL="${API_URL}?site_id=${SITE_ID}&sitekey=${SITEKEY}&type=${TYPE}&date=${DATE}&limit=${LIMIT}&output=${OUTPUT}" [[ -n "$DAILY" ]] && URL="${URL}&daily=1" [[ -n "$PAGE" ]] && URL="${URL}&page=${PAGE}" curl -s "$URL" ``` ### Technical Analysis The script places the Clicky site key directly in a URL and supplies the complete URL as a command-line argument to `curl`. HTTPS protects the request from ordinary network interception while in transit, and the destination—`https://api.clicky.com/api/stats/4`—is consistent with the Skill’s declared analytics function. Therefore, this network transmission is necessary and is not evidence of unrelated exfiltration. However, embedding a secret in a command-line URL increases its exposure. Depending on the operating system and deployment environment, another local process or user may be able to inspect process arguments while `curl` is running. Credential-bearing URLs can also be retained by debugging systems, command tracing, proxy infrastructure, monitoring agents, or verbose operational logs. Query strings may additionally be logged by the receiving service. ### Attack Path 1. A legitimate user invokes `scripts/clicky.sh` with valid Clicky credentials in the environment. 2. The script interpolates the site key into the request URL. 3. The full credential-bearing URL is passed to `curl` as a process argument. 4. A local observer, monitoring component, diagnostic collector, or improperly configured logger captures the argument or URL. 5. The observer extracts the `site_id` and `sitekey`. 6. The observer reuses those values against the Clicky API to retrieve analytics available to that credential. Successful exploitation requires access to process metadata or logs containing the URL. The script does not ...[truncated 508 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Check whether Clicky supports an authentication mechanism that does not place the site key in the URL, such as an authorization header or request body, and use it if available. 2. If query-string authentication is mandatory, avoid passing the completed credential-bearing URL directly in `curl` command arguments. Consider supplying a protected curl configuration through standard input or another mechanism that does not expose the secret in the process listing. 3. Ensure that shell tracing such as `set -x` is never enabled while credentials are handled. 4. Configure proxies, monitoring agents, and application logs to redact `sitekey` query parameters. 5. Restrict access to process metadata and diagnostic output on systems that execute the script. 6. Use narrowly scoped API credentials where Clicky supports them and rotate keys periodically. 7. Preserve HTTPS certificate verification and restrict requests to the fixed official Clicky API host. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Credential Access

High

• Category: Privilege Escalation

Content

Store site credentials as environment variables. Use the naming convention `CLICKY_<NAME>_SITE_ID` and `CLICKY_<NAME>_SITEKEY`:

```bash
# In ~/.openclaw/.env or your shell profile
CLICKY_ENVELOPEBUDGET_SITE_ID=101427673
CLICKY_ENVELOPEBUDGET_SITEKEY=c287a01cc00f70cb
CLICKY_ZAPYETI_SITE_ID=99999999

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises shell-based usage (`scripts/clicky.sh ...`) but does not declare an explicit tool scope such as allowed shell commands or permissions. That creates ambiguity about what command execution the agent may perform when the skill is invoked, increasing the risk of unintended or overly broad shell access.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The description includes broad activation cues like website traffic, visitors, pageviews, top pages, traffic sources, and scheduled reports, which could cause the skill to trigger for generic analytics requests not clearly intended for Clicky. Over-broad triggering is dangerous because it may steer user requests into a shell/API-capable skill unnecessarily, expanding exposure to credentials and external actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup section shows full-looking site IDs and site keys in plaintext without marking them as placeholders or warning against committing real secrets. Even if illustrative, publishing realistic credentials normalizes unsafe secret handling and increases the chance users will copy, paste, store, or expose actual API keys in docs, chat, or repositories.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Or for default: CLICKY_SITE_ID + CLICKY_SITEKEY
set -euo pipefail

API_URL="https://api.clicky.com/api/stats/4"

SITE_NAME="${1:?Usage: clicky.sh <site_name> <type> [--date DATE] [--limit N] [--daily]}"
shift

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script constructs a URL containing the Clicky site ID and sitekey, then sends it via curl. Although comments mention that credentials come from environment variables, there is no user-facing prompt, logging, or warning that sensitive credentials and query parameters will be transmitted to an external API.

Static analysis

No suspicious patterns detected.