ClawHub
Back to skill

Security audit

sensorpro.app

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for managing Sensorpro, but it gives an agent broad marketing-account powers, including deleting contacts and sending email, without strong guardrails.

Install only if you intend to let OpenClaw operate a Sensorpro marketing account. Use a dedicated least-privilege API user if Sensorpro supports it, keep credentials out of repositories, and require explicit approval before deleting contacts, invoking ForgetMe, changing account users, creating broadcasts, or sending email to real recipients.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md
- Put secrets in `~/.openclaw/.env` (or your process manager), **not** in `SKILL.md`.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

Example (bash):

bash
TOKEN=$(curl -sS -X POST "https://apinie.sensorpro.net/auth/sys/signin" \
  -H "Content-Type: application/json" \
  -H "x-apikey: ${SENSORPRO_API_KEY}" \
  -d "{\"Organization\":\"${SENSORPRO_ORG}\",\"User\":\"${SENSORPRO_USER}\",\"Password\":\"${SENSORPRO_PASS}\"}" \

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
The key is passed as an HTTP header:
- `x-apikey: $SENSORPRO_API_KEY`

### How to create an API user
Sensorpro distinguishes between UI users and API users:
- **API users** have *no UI access* but **can** use the REST API.
- **Normal users** have UI access but typically **cannot** use the REST API.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

Example (bash):

bash
TOKEN=$(curl -sS -X POST "https://apinie.sensorpro.net/auth/sys/signin" \
  -H "Content-Type: application/json" \
  -H "x-apikey: ${SENSORPRO_API_KEY}" \
  -d "{\"Organization\":\"${SENSORPRO_ORG}\",\"User\":\"${SENSORPRO_USER}\",\"Password\":\"${SENSORPRO_PASS}\"}" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md
| python3 -c 'import sys,json; print(json.load(sys.stdin).get("Token",""))')

# Call an endpoint (example)
curl -sS -X POST "https://apinie.sensorpro.net/api/Contact/UpdateAdd/${TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"AddToList":[],"Contact":[{"PersonalEMail":"someone@example.com"}],"Options":{"Parameters":{},"Action":""},"ReturnFailedRequests":false,"UpdateByKey":"email","SendWelcomeEmail":false,"SignupFormId":"00000000-0000-0000-0000-000000000000"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill documents destructive contact/account operations such as deleting contacts or invoking ForgetMe without any caution about irreversibility, authorization checks, or confirmation requirements. In an agent setting, that omission increases the risk that a user or automation triggers permanent data loss or privacy-impacting actions without understanding the consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill exposes outbound email-sending capabilities without warning about the operational and compliance impact of sending messages to recipients. In an agent context, this can lead to unintended bulk mail, spam complaints, reputational harm, or misuse of the organization's email infrastructure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.