Train Robotic AI Models using Qualia

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 2:49 AM UTC
• Version: 2.1.1

Overview

This is a coherent Qualia cloud-training skill, with expected API-key and remote job-management risks that users should handle carefully.

Install only if you trust Qualia with the dataset IDs, job metadata, and training parameters you provide. Store QUALIA_API_KEY through managed secrets when possible, avoid sharing it in prompts or logs, and require explicit user approval before launching paid training, cancelling jobs, or deleting projects.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

echo "Usage: qualia.sh project-delete <project_id>" >&2
      exit 1
    fi
    result=$(qapi DELETE "/v1/projects/${project_id}")
    echo "$result" | jq -r 'if .deleted then "Deleted project: \(.project_id)" else "Failed to delete project" end'
    ;;

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Session Persistence

Medium

• Category: Rogue Agent

Content

Manual install is also fine:

```bash
mkdir -p ~/.openclaw/workspace/skills
git clone https://github.com/fabbe1999/qualia-agent-skill ~/.openclaw/workspace/skills/qualia-skill
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

If `openclaw skills install` says installation completed but the agent does not mention the Qualia skill on the next turn, check that:

1. the files exist at `~/.openclaw/workspace/skills/qualia-skill/SKILL.md`;
2. the skill is not disabled under `skills.entries.qualia.enabled`;
3. `QUALIA_API_KEY` is configured for the agent environment; and
4. you started a fresh agent turn/session after installing.

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documentation clearly instructs use of shell, environment variables, and networked API access, but the manifest does not declare a restrictive tool scope such as permissions or allowed-tools. In an agent ecosystem, this weakens policy enforcement and can let the skill run with broader capabilities than users or orchestrators expect, increasing the blast radius if the skill is misused or later modified.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Configure API key

1. Sign up at [app.qualiastudios.dev](https://app.qualiastudios.dev/)
2. Create an API key (Settings -> API Keys)
3. Set the env var for local shell use:
   ```bash
   export QUALIA_API_KEY="your-api-key"

• Confidence: 83% confidence
• Finding: The skill recommends storing a long-lived API key in shell environment variables and in a persistent local configuration file so agent runs can inherit it. Persistent credential storage increases exposure to accidental leakage through logs, subprocess inheritance, misconfigured file permissions, or other skills running in the same environment.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill exposes a destructive project-delete command without an explicit warning that deletion may be irreversible or remove associated job metadata. In agent-driven workflows, users may approve actions based on brief summaries, so missing safety language materially increases the risk of accidental destructive operations.

External Transmission

Medium

• Category: Data Exfiltration

Content

local path="$2"
  local body="${3:-}"
  if [[ -n "$body" ]]; then
    curl -s -X "$method" "${API}${path}" \
      -H "Content-Type: application/json" \
      -H "X-API-Key: $QUALIA_API_KEY" \
      -d "$body"

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The qapi helper performs authenticated HTTP requests to an external service, and commands such as project creation, dataset inspection, hyperparameter validation, and fine-tuning transmit user-provided data to that service. While the code makes the network behavior visible to a shell reader, it does not provide any user-facing disclosure about sending data off-system beyond the generic CLI description.

Missing User Warnings

Low

• Confidence: 83% confidence
• Finding: The documented cancel command can interrupt active training and may waste credits or lose in-progress work, but the documentation does not warn the operator before presenting it as a routine management action. This is primarily an operational safety issue that becomes more relevant when an autonomous agent may invoke commands without nuanced human review.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The file requires QUALIA_API_KEY and injects it into the X-API-Key header for every API call, but it does not include any warning or guidance about handling this credential securely. The brief requirement comment notes the variable is needed, but it does not disclose that a secret is being used for authenticated remote operations.

Static analysis

No suspicious patterns detected.