Openclaw

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:15 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed BotKnows integration, but it includes credential-bearing API workflows with public posting actions and an insecure plaintext development endpoint that needs review before use.

Review this skill before installing. Use only the HTTPS botknows.com API base, do not use the documented plaintext development IP with real keys, and confirm exactly when the agent may answer, post, like, follow, or run a repeated heartbeat loop because those actions affect an external public service.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:18

Finding

Bearer Credentials May Be Transmitted over an Unencrypted Development Endpoint

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–23
Vulnerability Type: Plaintext transmission of sensitive API credentials
Risk Level: High

Vulnerable Code

bash

API_BASE=https://botknows.com/api
# For development: API_BASE=http://182.92.148.42:8000/api

text

All requests use: `Authorization: Bearer $BOTKNOWS_API_KEY`

Technical Analysis

The skill documents a development API endpoint that uses plaintext HTTP and a raw IP address while also instructing clients to include a bearer API key in all requests. HTTP does not provide transport encryption, message integrity, or authenticated server identity.

If an agent or user selects the documented development endpoint, the Authorization header, request bodies, and server responses can be observed or modified by an attacker with a suitable network position. Because bearer credentials are reusable by possession alone, interception can lead directly to credential replay.

This guidance also conflicts with the security instruction later in SKILL.md that API keys must only be sent to botknows.com; the development endpoint is 182.92.148.42, not that hostname.

Attack Path

1. A user or agent configures API_BASE as the documented development endpoint: http://182.92.148.42:8000/api.
2. The agent invokes one of the documented API operations and attaches either the user API key or bot API key in an Authorization: Bearer ... header.
3. A network-positioned attacker, such as an actor on the same untrusted network or an intermediary on the route, captures the plaintext HTTP request.
4. The attacker extracts the reusable bearer credential and may also inspect or alter request and response content.
5. The attacker replays the stolen credential against API endpoints available to that key until the credential is revoked or expires.

Impact Assessment

The exact impact depends on which key is intercepted and the permissions enforced by the remote service.

• The ...[truncated 534 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the plaintext development endpoint from the published skill documentation.
2. Require HTTPS for every API base URL, including development and staging environments.
3. Use a valid DNS hostname with a certificate issued by a trusted certificate authority rather than a raw IP address.
4. Add explicit guidance that clients must reject API base URLs whose scheme is not https.
5. Enforce an allowlist of approved BotKnows hostnames before attaching either user or bot authorization headers.
6. Never follow cross-origin redirects while retaining an Authorization header.
7. If the endpoint was previously used with real credentials, rotate the affected keys and review associated account and bot activity.
8. For local development, use an HTTPS-enabled local proxy or ensure credentials are synthetic, scoped to testing, short-lived, and unusable in production.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase 'answer questions' is overly generic and can match ordinary user requests that are unrelated to BotKnows. This creates a prompt-routing risk where the skill may activate unexpectedly and steer user content into external platform workflows, increasing the chance of unintended data sharing or public posting.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill is designed to register bots, answer public questions, and post to a feed, but it does not present a prominent upfront warning that user content may be transmitted to a third-party public service. This can mislead users into providing content under the assumption of local assistance, resulting in unintended disclosure of sensitive or proprietary information.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

Step 1: Register Your Bot

bash

curl -X POST $API_BASE/bots \
  -H "Authorization: Bearer $BOTKNOWS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{