Security audit

qqbot-image-helper

Security checks for vulnerabilities and agentic risk

Overview

This skill openly helps agents copy images out of an image-tool-restricted directory into an allowed media directory, which is useful for its stated purpose but bypasses a local access boundary and can leave private copies behind.

Install only if you are comfortable letting the agent copy local QQBot images from a tool-restricted download directory into ~/.openclaw/media for analysis. Prefer a platform-approved attachment import path; if used, authorize each file explicitly, use unique temporary names, and delete copied images immediately after processing.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:24
Finding: Bypass of Image Tool Directory Access Controls
Content: View full analysis
~/.openclaw/media/<文件名> ``` ``` The subsequent instructions at lines 51-54 provide a concrete implementation: ```bash # QQBot 下载的图片 cp ~/.openclaw/qqbot/downloads/86635B3805C6F6E405B847EC5B242684_1773402564132.png ~/.openclaw/media/86635B3805C6F6E405B847EC5B242684_1773402564132.png ``` ### Technical Analysis The Skill explicitly identifies that the `image` tool denies access to `~/.openclaw/qqbot/downloads/` because that directory is outside its allowlist. It then instructs the Agent to use the more privileged `exec` tool and the `cp` binary to copy the protected file into `~/.openclaw/media/`, where the `image` tool is permitted to read it. This changes the file's location without changing the underlying authorization decision. It therefore circumvents the `image` tool's directory-based access-control boundary rather than obtaining authorization through a trusted import mechanism. The Skill's declared requirements for `exec` and `cp` provide filesystem capabilities that are broader than the image-analysis task itself requires. The documented command also uses unrestricted `cp` behavior. It does not require canonical-path validation, symlink rejection, exclusive destination creation, file type or size validation, or automatic cleanup. Consequently, an implementation following these instructions could copy an unintended file, follow a ...[truncated 1676 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Ssd 4

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This skill explicitly works around the image tool's allowed-directory restriction by copying files from a blocked location into an allowed one. That undermines a security boundary intended to limit what local content the tool can analyze, enabling policy bypass and access expansion beyond the tool's designed trust model.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow directs the agent to expose files from a restricted local directory by placing them into a readable area for downstream analysis. Even if the source files are user-related images, the pattern normalizes exfiltration from restricted storage into less-protected locations and can be abused to process sensitive local content that the original restriction was meant to shield.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill tells the agent to copy images from a restricted directory into an allowed directory, creating a second copy of potentially sensitive user content without foregrounding the privacy and retention risks. This increases exposure because the copied file may persist longer, be accessed by other tooling, and bypass the original storage boundary assumptions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The cleanup warning appears only in later notes, not before the main procedure, so operators may unknowingly leave sensitive images accumulated in the allowed media directory. Persistent temporary copies create unnecessary retention and broaden the window for unauthorized access or accidental reuse.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.