Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent Qualia cloud-training skill, with expected API-key and remote job-management risks that users should handle carefully.
Install only if you trust Qualia with the dataset IDs, job metadata, and training parameters you provide. Store QUALIA_API_KEY through managed secrets when possible, avoid sharing it in prompts or logs, and require explicit user approval before launching paid training, cancelling jobs, or deleting projects.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
echo "Usage: qualia.sh project-delete <project_id>" >&2
exit 1
fi
result=$(qapi DELETE "/v1/projects/${project_id}")
echo "$result" | jq -r 'if .deleted then "Deleted project: \(.project_id)" else "Failed to delete project" end'
;;
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Manual install is also fine:
mkdir -p ~/.openclaw/workspace/skills
git clone https://github.com/fabbe1999/qualia-agent-skill ~/.openclaw/workspace/skills/qualia-skill
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
If `openclaw skills install` says installation completed but the agent does not mention the Qualia skill on the next turn, check that:
1. the files exist at `~/.openclaw/workspace/skills/qualia-skill/SKILL.md`;
2. the skill is not disabled under `skills.entries.qualia.enabled`;
3. `QUALIA_API_KEY` is configured for the agent environment; and
4. you started a fresh agent turn/session after installing.
The skill documentation clearly instructs use of shell, environment variables, and networked API access, but the manifest does not declare a restrictive tool scope such as permissions or allowed-tools. In an agent ecosystem, this weakens policy enforcement and can let the skill run with broader capabilities than users or orchestrators expect, increasing the blast radius if the skill is misused or later modified.
The skill recommends storing a long-lived API key in shell environment variables and in a persistent local configuration file so agent runs can inherit it. Persistent credential storage increases exposure to accidental leakage through logs, subprocess inheritance, misconfigured file permissions, or other skills running in the same environment.
export QUALIA_API_KEY="your-api-key"
The skill exposes a destructive project-delete command without an explicit warning that deletion may be irreversible or remove associated job metadata. In agent-driven workflows, users may approve actions based on brief summaries, so missing safety language materially increases the risk of accidental destructive operations.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
local path="$2"
local body="${3:-}"
if [[ -n "$body" ]]; then
curl -s -X "$method" "${API}${path}" \
-H "Content-Type: application/json" \
-H "X-API-Key: $QUALIA_API_KEY" \
-d "$body"
The qapi helper performs authenticated HTTP requests to an external service, and commands such as project creation, dataset inspection, hyperparameter validation, and fine-tuning transmit user-provided data to that service. While the code makes the network behavior visible to a shell reader, it does not provide any user-facing disclosure about sending data off-system beyond the generic CLI description.
The documented cancel command can interrupt active training and may waste credits or lose in-progress work, but the documentation does not warn the operator before presenting it as a routine management action. This is primarily an operational safety issue that becomes more relevant when an autonomous agent may invoke commands without nuanced human review.
The file requires QUALIA_API_KEY and injects it into the X-API-Key header for every API call, but it does not include any warning or guidance about handling this credential securely. The brief requirement comment notes the variable is needed, but it does not disclose that a secret is being used for authenticated remote operations.
No suspicious patterns detected.