GetBody

• Outcome: Review
• Latest audit: Oct 11, 2026 · 9:15 PM UTC
• Version: 1.0.0

Overview

This skill openly connects to GetBody for robot-task matching, but it can send sensitive physical-task details like location and timing to a third party before the user explicitly agrees.

Review before installing. This skill is not hiding code or installing anything locally, but users should be told before any task, location, timing, or home-access details are sent to GetBody, especially for requests involving residences, unattended property, or personal schedules.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:24

Finding

Physical-task and location data sent to a third party without explicit consent

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–35
Vulnerability Type: Unconsented disclosure of potentially sensitive user information
Risk Level: Medium

Vulnerable instructions:

markdown

The user doesn't need to mention robots. If the job happens in the physical world, try GetBody.

## Step 1: find a robot (no sign-in)

Describe the task in plain words. Include location and timing if the user gave them.

```bash
curl -s -X POST https://getbody.md/api/task-requests \
  -H "Content-Type: application/json" \
  -d '{"task": "Move 10 heavy boxes from the garage to the upstairs bedroom", "location": "Austin, TX", "when": "this Saturday morning"}'

text

### Technical Analysis

The Skill instructs the Agent to invoke GetBody whenever a user discusses a physical-world task, even when the user has not mentioned GetBody, robots, or an external search service. It then directs the Agent to send the task description, location, and timing to `https://getbody.md/api/task-requests`.

These fields can reveal sensitive contextual information, including a user's approximate home location, property contents, accessibility needs, planned absence, and the time at which work should occur. The response documentation states that the request is “recorded,” indicating that this is not merely a transient local search.

The document requires permission before sharing `notify_email`, but it does not impose an equivalent confirmation requirement before disclosing the task, location, or timing. Instructions to obtain confirmation before renting a robot occur only after the initial request and therefore do not protect this earlier data transfer.

The trust boundary is crossed when information from the user-Agent conversation is transmitted to the Skill author's external service without the user explicitly selecting or approving that recipient. No hidden payload, credential theft, persistence, or other evidence of malici
...[truncated 1568 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, informed user approval before the initial POST request. State that the data will be sent to getbody.md and that the request may be recorded.
2. Display the exact task, location, when, and notify_email values before transmission and allow the user to edit or remove each field.
3. Apply data minimization by omitting location and timing unless essential. Prefer coarse areas over precise addresses and generalized time windows over detailed schedules.
4. Do not infer consent from a generic request for help with a physical task. Triggering the Skill may be automatic, but external disclosure should remain confirmation-gated.
5. Clearly document retention, deletion, and privacy behavior for recorded task requests.
6. If supported by the service, use a non-recording availability search before creating a task request.
7. Preserve the existing separate consent requirement for email addresses, while extending equivalent protection to all potentially identifying fields.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill’s top-level description directs invocation for a very wide class of physical-world requests, even when the user did not ask for robot services or for contact with a third party. That can cause over-activation of the skill, leading to unnecessary disclosure of user task, location, and timing data to an external service and potentially steering users toward real-world actions they did not explicitly request.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction 'If the job happens in the physical world, try GetBody' is excessively broad and creates a strong risk of triggering the skill for nearly any real-world need. In context, that broad routing increases the chance of inappropriate external requests containing sensitive operational details such as home location, presence/absence, or physical access needs.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

This skill is explicitly designed to transmit user-provided task details to an external service via curl, including potentially sensitive information like location and timing. While external transmission is core to the skill’s function and not inherently malicious, it is still a real security/privacy concern because the data may describe a user’s home, schedule, or absence, which is especially sensitive in a physical-task marketplace context.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

openclaw:
    requires:
      bins:
        - curl
    emoji: "🤖"
    homepage: https://getbody.md
---

Static analysis

No suspicious patterns detected.