ClawHub
Back to skill

Security audit

sensorpro.app

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for managing Sensorpro, but it gives an agent broad marketing-account powers, including deleting contacts and sending email, without strong guardrails.

Install only if you intend to let OpenClaw operate a Sensorpro marketing account. Use a dedicated least-privilege API user if Sensorpro supports it, keep credentials out of repositories, and require explicit approval before deleting contacts, invoking ForgetMe, changing account users, creating broadcasts, or sending email to real recipients.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Ae1

High
Category
analysis-evasion
Content
- Put secrets in `~/.openclaw/.env` (or your process manager), **not** in `SKILL.md`.
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

External Script Fetching

High
Category
Supply Chain
Content
Example (bash):
```bash
TOKEN=$(curl -sS -X POST "https://apinie.sensorpro.net/auth/sys/signin" \
  -H "Content-Type: application/json" \
  -H "x-apikey: ${SENSORPRO_API_KEY}" \
  -d "{\"Organization\":\"${SENSORPRO_ORG}\",\"User\":\"${SENSORPRO_USER}\",\"Password\":\"${SENSORPRO_PASS}\"}" \
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Session Persistence

Medium
Category
Rogue Agent
Content
The key is passed as an HTTP header:
- `x-apikey: $SENSORPRO_API_KEY`

### How to create an API user
Sensorpro distinguishes between UI users and API users:
- **API users** have *no UI access* but **can** use the REST API.
- **Normal users** have UI access but typically **cannot** use the REST API.
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium
Category
Data Exfiltration
Content
Example (bash):
```bash
TOKEN=$(curl -sS -X POST "https://apinie.sensorpro.net/auth/sys/signin" \
  -H "Content-Type: application/json" \
  -H "x-apikey: ${SENSORPRO_API_KEY}" \
  -d "{\"Organization\":\"${SENSORPRO_ORG}\",\"User\":\"${SENSORPRO_USER}\",\"Password\":\"${SENSORPRO_PASS}\"}" \
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
| python3 -c 'import sys,json; print(json.load(sys.stdin).get("Token",""))')

# Call an endpoint (example)
curl -sS -X POST "https://apinie.sensorpro.net/api/Contact/UpdateAdd/${TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"AddToList":[],"Contact":[{"PersonalEMail":"someone@example.com"}],"Options":{"Parameters":{},"Action":""},"ReturnFailedRequests":false,"UpdateByKey":"email","SendWelcomeEmail":false,"SignupFormId":"00000000-0000-0000-0000-000000000000"}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill documents destructive contact/account operations such as deleting contacts or invoking ForgetMe without any caution about irreversibility, authorization checks, or confirmation requirements. In an agent setting, that omission increases the risk that a user or automation triggers permanent data loss or privacy-impacting actions without understanding the consequences.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill exposes outbound email-sending capabilities without warning about the operational and compliance impact of sending messages to recipients. In an agent context, this can lead to unintended bulk mail, spam complaints, reputational harm, or misuse of the organization's email infrastructure.

Static analysis

No suspicious patterns detected.