ClawHub
Back to skill

Security audit

Qirabot

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent GUI automation skill, but users should treat it like a remote UI automation service that can see and act on whatever screen or session they give it.

Install only if you are comfortable giving Qirabot-driven automation access to the target app or browser session. Avoid using it on screens with secrets or regulated data, keep recording off unless needed, review generated reports before sharing them, and require explicit confirmation before purchases, posts, deletions, or actions in a logged-in account.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (7)

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill explicitly instructs the agent to run shell commands and use environment secrets such as `QIRA_API_KEY`, but it declares no permissions. This creates a permission-model mismatch: an agent or platform may invoke the skill without surfacing to users that it can execute commands or access sensitive environment state, increasing the risk of unintended command execution or secret exposure.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger language is extremely broad (`automate a website or app`, `fill a form`, `scrape a page`, `tap or click a button`) and overlaps with many common requests. That makes accidental or overly eager invocation more likely, which is risky here because the skill can drive GUIs, run shell setup commands, and automate external actions under the user's identity.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The reference explicitly documents optional recording of the host machine's screen, which can unintentionally capture unrelated windows, notifications, credentials, tokens, PII, or other sensitive data visible on the operator's desktop. In a GUI automation skill, this is more dangerous because users are likely to run it during authenticated sessions and the resulting report artifacts may be stored, shared, or retained without realizing their sensitivity.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The documentation says `bot.ai` runs the perceive-decide-act loop on the vendor backend and manages step history server-side, but it does not clearly warn that screenshots, step history, task instructions, and possibly sensitive UI contents are transmitted to a remote service. In this skill context, that omission is significant because the tool is designed to automate real applications, including authenticated websites and apps, so remote processing may expose business data, credentials, or regulated content to third-party infrastructure.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
"pyautogui (whole-screen) is fine on any 3.10+; only the airtest path pins numpy<2.")

    # 2. API key
    has_key = bool(os.environ.get("QIRA_API_KEY"))
    line(OK if has_key else NO, "QIRA_API_KEY is set",
         "" if has_key else "Get a key at https://app.qirabot.com, then: export QIRA_API_KEY=qk_...")
    hard_ok = hard_ok and has_key
Confidence
70% confidence
Finding
Code accesses environment variables that may contain secrets (API keys, tokens). This is a common pattern for credential theft.

Unvalidated Output Injection

High
Category
Output Handling
Content
hard_ok = hard_ok and bool(adb)
        if adb:
            try:
                out = subprocess.run([adb, "devices"], capture_output=True,
                                     text=True, timeout=10).stdout
                devs = [ln for ln in out.splitlines()[1:] if ln.strip() and "\tdevice" in ln]
                line(OK if devs else NO, f"Android device connected ({len(devs)})",
Confidence
95% confidence
Finding
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.

Session Persistence

Medium
Category
Rogue Agent
Content
**Keep the task string a concise goal, not a step-by-step script.** `bot.ai` is
smart enough to plan its own clicks — over-specifying ("click Search, then type
X, then click the first result, then…") fights the model, locks in a brittle
path, and burns extra steps. Write what success looks like, not how to get
there. Good: `"Add the cheapest in-stock item to the cart and check out"`.
Bad: a 6-step click-by-click recipe.
Confidence
89% confidence
Finding
The skill encourages high-level goal delegation to `bot.ai` for tasks like adding items to a cart and checking out, and later documents reuse of authenticated state via persistent profiles. In context, this is a form of session persistence and autonomous action chaining that can let the agent operate inside an already logged-in session, amplifying the impact of prompt mistakes, malicious prompts, or unsafe invocation by enabling real account actions without reauthentication.

Static analysis

No suspicious patterns detected.