Security audit
Security checks for vulnerabilities and agentic risk
This QQ/OneBot skill is mostly coherent, but it exposes high-impact group moderation actions and logs private message data without enough safeguards or warning.
Install only if you intend to give the agent access to a OneBot server and are comfortable with it sending messages and potentially performing group administration through the bot account. Keep endpoints on localhost or protected TLS connections, use a narrowly scoped token where possible, avoid running the sample listener in production with full-event logging, and do not adopt the group-management example without explicit admin checks, approved group allowlists, confirmation, and audit logging.
scripts/onebot_ws_listener.py:73Unredacted Logging of Private OneBot Events and Message Content
references/message-handling.md:76Privileged Group-Management Example Omits Sender Authorization
scripts/onebot_client.py:21Bearer Credentials and QQ Data Can Be Transmitted over Plaintext Connections
The skill instructs users to use environment variables and make network connections to local WebSocket/HTTP OneBot endpoints, but it does not declare any tool scope such as permissions or allowed-tools. This creates a trust and containment gap: an agent may gain undeclared access to environment secrets and network endpoints, making the skill capable of interacting with local services or exfiltrating sensitive configuration without explicit authorization.
This markdown file includes an example handler that removes a group member when a matching message is received, but the surrounding documentation does not warn that the pattern performs a destructive moderation action. For markdown files, examples that can affect user access or system integrity should disclose the impact so users understand the consequence before adopting the pattern.
The code automatically reads ONEBOT_TOKEN from the environment and attaches it to outbound requests, but there is no disclosure, consent flow, or trust restriction on the destination URL. If base_url is changed to an untrusted host, the bearer token will be transmitted to that host, potentially leaking credentials or authorizing unintended actions.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if method == "GET":
resp = requests.get(url, headers=self.headers, timeout=10)
else:
resp = requests.post(url, headers=self.headers, json=data, timeout=10)
resp.raise_for_status()
return resp.json()
The client exposes group-administration operations such as kicking users, banning users, and changing group metadata in a skill described primarily as QQ messaging integration. These capabilities materially expand the action surface from message transport into moderation and configuration, so a caller that gains access to this skill can perform destructive administrative actions not obviously required by the stated purpose.
Group moderation and configuration methods are present without clear justification from the stated 'sending/receiving QQ messages' purpose. This mismatch increases the risk of over-privileged use, where downstream agents or users may invoke administrative endpoints unintentionally or without understanding they can alter group state.
The skill provides destructive moderation actions such as kicking and banning users with no confirmation, approval step, or safety interlock. In an agent context, this creates a direct path from prompt or automation mistakes to irreversible or harmful group-management actions against real users.
The listener logs entire inbound events, which can include message contents, user IDs, group IDs, and other sensitive metadata. In a QQ/OneBot integration context, this can leak private communications and identifiers into console logs, process supervisors, or centralized log collectors, expanding data exposure well beyond the bot itself.
The private-message handler automatically responds via an API call when it receives a matching message. The code comments describe the action, but there is no clear user-facing warning that running this listener can cause automatic outbound messaging based on incoming private messages.
The example only responds to the Chinese trigger 帮助, which imposes a specific language expectation in natural-language behavior. Because no opt-in, alternative language handling, or locale-specific justification is provided, this may violate language/locale policy guidance.
No suspicious patterns detected.