T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:61- Finding
External Script Receives a Sensitive API Credential from a Broad Credential Store
- Content
View full analysis
- Remediation
View remediation
Security audit
Manage OpenClaw's use of models available at wisgate.ai API
Security checks for vulnerabilities and agentic risk
Overview
This skill is not overtly malicious, but it asks the agent to edit OpenClaw configuration and use a stored Firecrawl API key through an external script without clear approval controls.
Review before installing. Use it only if agents should be allowed to update OpenClaw model configuration and access Firecrawl for Wisgate lookups. Require explicit approval before edits or network calls, avoid exposing TOOLS.md, and verify the referenced firecrawl-search script before giving it an API key.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The invocation guidance is broad enough to trigger on general model-selection or pricing tasks, not just narrowly scoped Wisgate lookups. Over-broad routing increases the chance this skill is invoked in contexts where its file-editing and external-fetch instructions are inappropriate, amplifying the risk of unintended changes or network access.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill is described as a Wisgate query helper, but it instructs the agent to modify local repository configuration in
openclaw.jsonand the canonicalMODELS.json. That expands the skill from read-only lookup into state-changing configuration management without explicit user confirmation or safety guardrails, creating a risk of unintended or unauthorized project changes.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill directs modifications to
openclaw.jsonandMODELS.jsonwithout warning that these are repository configuration/data files or requiring approval. In an agentic workflow, silent config edits can introduce persistence, break builds, alter provider behavior, or cause billing-impacting changes without the user's informed consent.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The Firecrawl instructions cause a request to an external service but do not warn that data about the looked-up model and request context will leave the local environment. In environments with restricted egress or sensitive internal model names, this can violate data-handling expectations and trigger unauthorized external transmission.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | Endpoint Type | OpenClaw Provider | Base URL | |---|---|---| | Anthropic (Claude) | `custom-api-wisgate-ai` | `https://api.wisgate.ai/` | | OpenAI compatible | `custom-api-wisgate-ai-openai` | `https://api.wisgate.ai/v1` | | Google (Gemini) | `custom-api-wisgate-google` | `https://api.wisgate.ai/v1beta` |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | Endpoint Type | OpenClaw Provider | Base URL | |---|---|---| | Anthropic (Claude) | `custom-api-wisgate-ai` | `https://api.wisgate.ai/` | | OpenAI compatible | `custom-api-wisgate-ai-openai` | `https://api.wisgate.ai/v1` | | Google (Gemini) | `custom-api-wisgate-google` | `https://api.wisgate.ai/v1beta` |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | Endpoint Type | OpenClaw Provider | Base URL | |---|---|---| | Anthropic (Claude) | `custom-api-wisgate-ai` | `https://api.wisgate.ai/` | | OpenAI compatible | `custom-api-wisgate-ai-openai` | `https://api.wisgate.ai/v1` | | Google (Gemini) | `custom-api-wisgate-google` | `https://api.wisgate.ai/v1beta` |
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill tells the agent where to find a stored Firecrawl API key (
TOOLS.md), which is credential-discovery guidance outside the core task of querying model metadata. This increases the chance that an agent will access or mishandle secrets unnecessarily, especially when combined with later external-network instructions.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Referencing a stored API key location without any secret-handling guidance normalizes direct credential access by the agent. Even if not exfiltrated, this increases the risk of accidental disclosure in logs, outputs, or follow-on tool invocations.
- Content