ClawHub
Back to skill

Security audit

dingo data quality

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate data-quality skill, but it can send user datasets, articles, claims, and API keys to external or custom providers without strong disclosure or endpoint safeguards.

Install only if you are comfortable with Dingo reading the files you select and, for LLM or fact-checking modes, sending their contents or derived claims to configured model/search providers. Prefer rule-based local evaluators for confidential data, avoid untrusted OPENAI_BASE_URL values, use least-privilege provider keys, and review or delete generated outputs that may contain original article text or evaluation details.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/fact_check.py:141
Finding

API Credentials and Article Content Can Be Sent to an Unrestricted Custom Endpoint

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party Packages Create a Mutable Supply-Chain Boundary

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (15)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CONTRIBUTING.md (reported line 6)May include surrounding context.

md
## How to contribute

1. Fork the [Dingo repository](https://github.com/MigoXLab/dingo)
2. Edit skill files in `clawhub/` (`SKILL.md`, `_meta.json`)
3. Test locally by placing `SKILL.md` in your `~/.openclaw/skills/` directory
4. Submit a pull request

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill provides LLM-based evaluation examples that send user dataset fields such as content, responses, references, and retrieved contexts to third-party API endpoints, but it does not present an explicit user-facing privacy or data-sharing warning before recommending those workflows. In a data-quality skill, users may reasonably run it on proprietary, regulated, or sensitive datasets, so omission of consent and disclosure guidance materially increases the risk of unintended external disclosure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This example explicitly configures an external API endpoint for LLM evaluation, which means dataset content mapped into the evaluation request can leave the local environment. In context this is expected functionality, but without nearby disclosure and consent guidance it still represents a real external-transmission risk for sensitive user data.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

md
"config": {
            "model": "deepseek-chat",
            "key": "${OPENAI_API_KEY}",
            "api_url": "https://api.deepseek.com/v1"
          }
        }
      ]

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The RAG evaluation example sends user_input, response, retrieved_contexts, and reference fields to an external LLM endpoint, which can expose potentially sensitive prompts, retrieved documents, and ground-truth data. Because RAG datasets often contain internal knowledge-base content, the context makes this transmission especially privacy-relevant.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md
"reference": "reference"
      },
      "evals": [
        {"name": "Faithfulness", "config": {"model": "deepseek-chat", "key": "${OPENAI_API_KEY}", "api_url": "https://api.deepseek.com/v1"}},
        {"name": "ContextPrecision", "config": {"model": "deepseek-chat", "key": "${OPENAI_API_KEY}", "api_url": "https://api.deepseek.com/v1"}}
      ]
    }

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This second external endpoint use in the same RAG example reinforces that multiple evaluators may each transmit the same dataset fields externally, increasing disclosure surface and repetition of sensitive content. The risk is not malicious behavior but insufficiently signposted outbound sharing of user data.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
},
      "evals": [
        {"name": "Faithfulness", "config": {"model": "deepseek-chat", "key": "${OPENAI_API_KEY}", "api_url": "https://api.deepseek.com/v1"}},
        {"name": "ContextPrecision", "config": {"model": "deepseek-chat", "key": "${OPENAI_API_KEY}", "api_url": "https://api.deepseek.com/v1"}}
      ]
    }
  ]

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

Documenting a default external base URL is normal, but in this skill it contributes to a workflow that can transmit user data off-host without a strong privacy warning. By itself this line is mostly informational, so the security concern is lower than the concrete examples that actually package dataset fields for transmission.

Content

Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.

md
| Variable | Description |
|---|---|
| `OPENAI_API_KEY` | API key for LLM-based evaluation |
| `OPENAI_BASE_URL` | Custom API endpoint (default: `https://api.openai.com/v1`) |
| `OPENAI_MODEL` | Model name (default: `gpt-4`) |

## Supported input formats

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 295)May include surrounding context.

md
When using this skill on behalf of the user:

* **Always write a config file** before running CLI evaluation. Don't try to pass complex JSON inline.
* **Quote file paths** with spaces in commands: `dingo eval --input "my config.json"`
* **Wrap main code in `if __name__ == '__main__':`** when writing Python scripts — Dingo uses multiprocessing internally, which fails on macOS without this guard.
* **Infer format from extension**: `.jsonl` → `jsonl`, `.json` → `json`, `.csv` → `csv`, `.txt` → `plaintext`.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The MCP server section exposes tool-driven evaluation over SSE/stdio for AI agents, but it does not warn that MCP-invoked tools may read local files and, depending on evaluator configuration, forward contents to external APIs. This creates a meaningful transparency and data-boundary problem because remote or semi-autonomous agent integrations can make file access and network exfiltration less visible to the end user.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The ArticleFactChecker SDK example sends article content and extracted claims to an external OpenAI-compatible endpoint for analysis. Articles may contain unpublished, proprietary, or personal information, and the autonomous fact-checking workflow increases the amount of derived content transmitted externally.

Content

Scanner excerpt · SKILL.md (reported line 467)May include surrounding context.

md
"config": {
                "key": os.environ["OPENAI_API_KEY"],
                "model": os.getenv("OPENAI_MODEL", "gpt-5.4-mini"),
                "api_url": os.getenv("OPENAI_BASE_URL", "https://api.openai.com/v1"),
                "parameters": {
                    "temperature": 0,
                    "agent_config": {

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This configuration additionally enables external claim extraction and optional Tavily web search, creating multiple outbound transmission paths for user-supplied article content or derived claims. Multi-provider agent workflows amplify privacy and confidentiality risk because data may be shared across several services during verification.

Content

Scanner excerpt · SKILL.md (reported line 477)May include surrounding context.

md
"claims_extractor": {
                                "api_key": os.environ["OPENAI_API_KEY"],
                                "model": os.getenv("OPENAI_MODEL", "gpt-5.4-mini"),
                                "base_url": os.getenv("OPENAI_BASE_URL", "https://api.openai.com/v1"),
                                "max_claims": 50
                            },
                            "arxiv_search": {"max_results": 5},

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation states that the tool saves original article text and detailed verification artifacts locally, but it does not warn users that potentially sensitive input content will be retained on disk. This creates a real privacy and data-handling risk because users may process confidential articles or proprietary drafts without realizing persistent local copies and structured outputs are being created.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · _meta.json (reported line 27)May include surrounding context.

json
'pip install "dingo-python[agent]"'
        )

    api_url = os.getenv("OPENAI_BASE_URL", "https://api.openai.com/v1")
    model = args.model or os.getenv("OPENAI_MODEL", "gpt-5.4-mini")
    tavily_key = os.getenv("TAVILY_API_KEY")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/advanced-config.md (reported line 70)May include surrounding context.

md
'pip install "dingo-python[agent]"'
        )

    api_url = os.getenv("OPENAI_BASE_URL", "https://api.openai.com/v1")
    model = args.model or os.getenv("OPENAI_MODEL", "gpt-5.4-mini")
    tavily_key = os.getenv("TAVILY_API_KEY")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/fact_check.py (reported line 359)May include surrounding context.

python
'pip install "dingo-python[agent]"'
        )

    api_url = os.getenv("OPENAI_BASE_URL", "https://api.openai.com/v1")
    model = args.model or os.getenv("OPENAI_MODEL", "gpt-5.4-mini")
    tavily_key = os.getenv("TAVILY_API_KEY")

Vague Triggers

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This manifest is a JSON file, so vague-trigger review applies. The description says the skill is a "Comprehensive AI Data, Model and Application Quality Evaluation Tool," which is very broad and does not define specific trigger phrases, contexts, or exclusions, making intended invocation scope unclear.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.