Security audit

Openclaw Skill Qa Quickcheck

Security checks for vulnerabilities and agentic risk

Overview

This QA testing skill is broadly aligned with testing, but it includes under-disclosed active execution, network requests, file writes, and unsafe template code execution that users should review before installing.

Install only if you are comfortable with a QA assistant that may run project startup commands, send HTTP requests, create or overwrite test-report.md, and use helper scripts that can post data to configured URLs. Avoid using untrusted data-factory templates, do not run it with sensitive environment variables, and keep dynamic testing limited to local or confirmed test environments.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The skill is described as a general QA/testing assistant, but its documented behavior includes generating test data, writing local files, sending batch POST requests to remote services, recording remote object IDs, and performing active endpoint/security probing. That is materially more invasive than a passive PR/static-review helper and can cause unintended state changes, data creation on remote systems, or unauthorized scanning if auto-invoked or used against the wrong environment.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The file claims the static-audit workflow only relies on source code, configuration, and command-line audit tools, but later includes project startup guidance. This scope expansion can cause an agent invoked for 'static' review to run application code or services unexpectedly, increasing exposure to untrusted build scripts, startup hooks, and side effects in the analyzed repository.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The document explicitly states that the tasks do not require the project to be runnable, yet later directs the AI to infer and start the project. This contradiction is security-relevant because it can mislead operators into believing the workflow is non-executing while still enabling execution of untrusted code from the target repository.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The documented `$custom:JS代码` feature enables template authors to supply JavaScript that is later executed via dynamic function निर्माण, which gives untrusted template input code-execution capability inside the Node.js process. In a QA data-generation tool, templates are likely to be shared or downloaded, so this turns ordinary data files into executable payloads and can lead to local code execution, data theft, filesystem access, or chained network abuse.

Context-Inappropriate Capability

Medium

Confidence: 82% confidence
Finding: The script can POST generated records to any user-supplied URL without allowlisting, confirmation, or environment restrictions. While useful for testing, this creates an exfiltration/SSRF-like primitive that can be abused to send internal test data or generated payloads to attacker-controlled endpoints, especially in CI or developer environments with network access.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The runner supports resolving arbitrary process environment variables via the $env.* syntax and can inject them into request bodies, headers, or query parameters from a user-supplied test config. In a QA tool that performs outbound HTTP requests, this creates a real secret-disclosure path because anyone controlling the config can cause API keys, tokens, or cloud credentials present in the runtime environment to be sent to a remote endpoint.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrases are very broad and overlap with ordinary developer conversation such as '测试', 'QA', '代码审查', and '静态扫描'. This increases the chance of unintended activation of a skill that may perform network tests, scans, and file output, causing actions the user did not explicitly request.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill instructs the agent to generate `test-report.md` in the project root, which is a filesystem side effect not prominently warned about at the point of use. Silent writes can overwrite expectations, pollute repositories, or create sensitive artifacts that may later be committed or exposed.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The file explicitly instructs the agent to generate a root-level `test-report.md`, but provides no safeguard about asking for user consent, checking whether the file already exists, or avoiding overwrite of project artifacts. In an agent skill context, this creates a real file-write risk because a user may invoke analysis expecting read-only behavior while the skill silently modifies repository state.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrases include broad everyday expressions such as “日常检查”, which can cause the skill to activate in contexts where the user did not intend to invoke this QA workflow. In an agent setting, overly permissive activation can lead to unintended instruction loading and execution of the skill’s testing process, increasing the chance of context hijacking or accidental tool use.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The file states it is loaded via an external dispatcher and gated by startup checks, but it does not define a clear user-consent boundary for when dynamic testing is allowed to begin. In an agent skill, ambiguous trigger conditions can cause the agent to initiate network interactions or runtime testing without explicit user authorization or sufficient environment confirmation.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs the agent to discover and execute project startup commands from package.json, which can run arbitrary local code with side effects. Without a prominent risk warning and explicit consent step, this creates a path for unsafe command execution against untrusted repositories or developer machines.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill directs the agent to send HTTP requests to pages and APIs as part of smoke testing, but the safeguards are incomplete for preventing contact with production or otherwise non-isolated services. This can trigger unintended state changes, access sensitive data, or violate testing boundaries if environment detection is wrong or uncertain.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The template format advertises execution of custom JavaScript but provides no meaningful safety boundary or warning that templates are code, not just data. This is dangerous because users may treat JSON templates as harmless fixtures, yet opening a third-party template grants attacker-controlled logic execution in the current Node context.

Missing User Warnings

High

Confidence: 100% confidence
Finding: `new Function("random", "index", ...)` executes attacker-controlled template content as JavaScript, which is effectively arbitrary code execution. Even without passing `require` directly, executed code can typically reach `globalThis`, `process`, and other runtime objects, enabling filesystem reads, command execution, secret access, or outbound network actions.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: Because $env references are resolved automatically and the resulting values flow directly into sendRequest(), secrets from the runtime environment can be transmitted over the network without any explicit disclosure or confirmation to the operator. This is especially risky in CI or shared QA environments where environment variables commonly contain deployment tokens, service credentials, or internal API secrets.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/data-factory.js:198