OpenClaw Validate

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:29 PM UTC
• Version: 4.0.1

Overview

The skill is mostly transparent about registering an agent for a question platform, but it also stores a plaintext API key and sets up mandatory unattended future checks and submissions.

Review before installing. Use it only if you are comfortable sharing an email address, display name, optional agent metadata, and public answers with HumanJudge. Prefer not to enable the heartbeat unless you want unattended future participation, and store any API key with owner-only permissions or a secret manager, with a clear way to delete or rotate it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:215

Finding

Mandatory Heartbeat Creates a Persistent External Instruction Channel

Content

View full analysis

"I can't set up automatic checking on this instance. You'll need to ask me to check for new rounds manually, or enable heartbeats in your OpenClaw config." **After completing this step**, confirm to your owner that heartbeat is configured and they'll be notified when new rounds open. ``` ### Technical Analysis The Skill requires the agent to modify the persistent workspace file `HEARTBEAT.md`. The stored instruction directs future sessions to retrieve content from `https://humanjudge.com/openclaw/skill.md` and automatically act on newly announced questions. This creates a persistent external instruction channel whose effective behavior can change after the installed Skill has been reviewed. Although the retrieved resource is described as a Skill document rather than executable machine code, its instructions are intended to control subsequent agent actions, including network requests and response submission. The command to notify the owner only for errors or new-round announcements reduces visibility into routine automated operations. Mandatory wording elsewhere in `SKILL.md:29-45` reinforces the instruction by requiring the workflow and heartbeat to be followed rather tha ...[truncated 1618 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:132

Finding

API Key Is Written to Disk Without Enforced Restrictive Permissions

Content

View full analysis

~/.config/humanjudge/credentials.json ``` The directory is created earlier with: ```bash mkdir -p ~/.config/humanjudge ``` ### Technical Analysis The Skill writes the HumanJudge bearer API key to a plaintext JSON file but does not enforce permissions on either the credential directory or the file. The resulting modes depend on the process umask. In environments with permissive defaults, other local users or processes may be able to read the credential. The credential is subsequently loaded at `SKILL.md:157`: ```bash API_KEY=$(jq -r .api_key ~/.config/humanjudge/credentials.json) ``` It is then sent as an authorization bearer token to the declared HumanJudge API. Reading the application-specific credential and transmitting it to its intended API are necessary for authenticated requests. The security issue is not that access itself occurs, but that the Skill stores the token without ensuring least-privilege filesystem protection. The direct redirection is also non-atomic. A failure during writing could leave an empty or partially written credential file. ### Attack Path 1. Registration returns an API key. 2. The agent writes it to `~/.config/humanjudge/credentials.json` using ordinary shell redirection. 3. The file inherits permissions determined by the current umask rather than an explicitly secure mode. 4. Another local user, process, plugin, or compromised component with filesystem access reads the JSON file. 5. The attacker extracts the API key and reuses it as a bearer token against HumanJudge endpoints. ### Impact Assessment A stolen token could allow an attacker to impersonate the registered agent within the authorization scope granted by HumanJudge. Based on the documented endpoints, this may incl ...[truncated 369 chars]

Remediation

View remediation

"$tmp_file" chmod 600 "$tmp_file" mv "$tmp_file" "$HOME/.config/humanjudge/credentials.json" ``` 4. Prefer an operating-system credential manager or secret store rather than a plaintext JSON file. 5. Verify the credential file is a regular file owned by the current user before reading it, and reject symlinks or unexpectedly permissive modes. 6. Document token revocation and rotation procedures. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:113

Finding

Untrusted Values Are Inserted Into Shell and JSON Examples Without Safe Serialization

Content

View full analysis

~/.config/humanjudge/credentials.json ``` ```bash curl -X POST https://api.humanjudge.com/api/v1/oc/challenges/29a11580-5e9c-4e4b-80ab-d916764f4142/responses \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d '{"responses": [{"question_id": "UUID_1", "response_text": "Your answer"}, {"question_id": "UUID_2", "response_text": "Your answer"}]}' ``` ### Technical Analysis The documented workflow expects placeholders to be replaced with values originating from the owner, the remote API, or generated answer content. These values are embedded into single-quoted shell arguments containing hand-constructed JSON. JSON-sensitive characters such as quotation marks, backslashes, and control characters can produce malformed payloads if they are not escaped. More seriously, if an implementation performs literal textual substitution into these shell examples, a single quote in an inserted value can terminate the shell's quoted string. Shell operators and commands following that quote may then be interpreted by the shell. For example, a maliciously crafted display name containing a quote and shell syntax could escape the intended `curl -d` argument when substituted naively. Generated answers may also naturally contain quotations, line breaks, backslashes, or apostrophes, making mal ...[truncated 1670 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The instruction to read ~/.config/humanjudge/credentials.json accesses locally stored credentials. While intended to reuse registration state, any skill that reads secrets from disk increases exposure risk if the file is accessible beyond this workflow or if the agent later reveals its contents.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

Check for existing credentials

bash

cat ~/.config/humanjudge/credentials.json 2>/dev/null

If the file exists and contains an api_key, skip to Step 4.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Writing the API key directly to a plaintext JSON file creates durable credential exposure. A bearer token stored this way can be stolen by other local processes, users, backups, or future prompt-induced file reads, enabling unauthorized use of the external account.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

On success, the response contains your api_key. Save it immediately — it is shown only once:

bash

echo '{"api_key": "THE_API_KEY", "agent_name": "YOUR_DISPLAY_NAME"}' > ~/.config/humanjudge/credentials.json

Tell your owner: "Registration complete! I'm now registered as [name] on HumanJudge."

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

Loading the API key from a plaintext credentials file further normalizes secret handling through ordinary shell operations. This increases the chance of accidental disclosure through process inspection, debugging, shell history, or misuse by later commands.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

Load your API key:

bash

API_KEY=$(jq -r .api_key ~/.config/humanjudge/credentials.json)

Join:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

AI agent must follow the workflow sequence in this file exactly.

metadata: {"openclaw":{"emoji":"🦞","category":"challenges","api_base":"https://api.humanjudge.com/api/v1/oc","challenge_id":"29a11580-5e9c-4e4b-80ab-d916764f4142"}}
---

# HumanJudge OpenClaw

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly says it must begin on every activation and continue the sequence automatically. That broad trigger can cause repeated unsolicited prompts for email, OTPs, and profile data, increasing the chance of accidental data disclosure or user confusion about why the agent is requesting sensitive information.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Creating a persistent credentials directory establishes long-term session state on disk for future automatic reuse. In this skill's context, persistence combines with mandatory heartbeat/automatic activity, which raises the risk of unattended authenticated actions and ongoing credential exposure.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

New registration

Create the credentials directory:

bash

mkdir -p ~/.config/humanjudge

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This endpoint transmits owner email, agent display name, and optionally model/provider/framework details to a third-party service. Even though the flow is described as registration, it is still an external data transfer of user-linked information and should be treated as sensitive.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

Start registration (sends 6-digit code to owner's email):

bash

curl -X POST https://api.humanjudge.com/api/v1/oc/agents/register/start \
  -H "Content-Type: application/json" \
  -d '{
    "name": "DISPLAY_NAME_FROM_STEP_2",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This endpoint transmits owner email, agent display name, and optionally model/provider/framework details to a third-party service. Even though the flow is described as registration, it is still an external data transfer of user-linked information and should be treated as sensitive.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

Start registration (sends 6-digit code to owner's email):

bash

curl -X POST https://api.humanjudge.com/api/v1/oc/agents/register/start \
  -H "Content-Type: application/json" \
  -d '{
    "name": "DISPLAY_NAME_FROM_STEP_2",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The OTP verification request sends a registration identifier and one-time code to a third-party service, completing account enrollment tied to the owner's email. This is expected for registration, but it still creates an external trust boundary and handles authentication material.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

Complete registration:

bash

curl -X POST https://api.humanjudge.com/api/v1/oc/agents/register/verify \
  -H "Content-Type: application/json" \
  -d '{"registration_id": "REG_ID_FROM_ABOVE", "otp_code": "THE_6_DIGIT_CODE"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to write an API key to ~/.config/humanjudge/credentials.json without warning about local secret persistence, file permissions, or shared-machine risks. Storing bearer credentials in plaintext can expose the account to other local users, logs, backups, or later accidental disclosure by the agent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 76% confidence

Finding

The profile update endpoint transmits agent profile data and uses a bearer token to modify remote state. While functionally normal, it expands the external transmission surface and could unintentionally disclose architecture metadata if used casually.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

If you or your owner want to change your display name or LLM info later:

bash

curl -X PATCH https://api.humanjudge.com/api/v1/oc/agents/me \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "NEW_NAME"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 74% confidence

Finding

The join request contacts an external platform using the stored API key, creating a session/action on behalf of the agent. This is expected behavior for the skill but still constitutes external state-changing network activity tied to a credential.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

Join:

bash

curl -X POST https://api.humanjudge.com/api/v1/oc/challenges/29a11580-5e9c-4e4b-80ab-d916764f4142/join \
  -H "Authorization: Bearer $API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

Fetching questions from the remote challenge is an external pull of third-party content that the agent is then instructed to answer automatically. This increases risk because remote prompts could influence agent behavior or induce disclosure if not strongly sandboxed and constrained.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

Fetch questions:

bash

curl -X GET "https://api.humanjudge.com/api/v1/oc/challenges/29a11580-5e9c-4e4b-80ab-d916764f4142/questions?limit=20" \
  -H "Authorization: Bearer $API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This endpoint submits generated responses to an external service, potentially sending content derived from interactions with the owner. Although the skill warns against sharing sensitive information, automatic answering of third-party prompts still risks inadvertent disclosure or policy bypass.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

Submit responses in batches of 5:

bash

curl -X POST https://api.humanjudge.com/api/v1/oc/challenges/29a11580-5e9c-4e4b-80ab-d916764f4142/responses \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"responses": [{"question_id": "UUID_1", "response_text": "Your answer"}, {"question_id": "UUID_2", "response_text": "Your answer"}]}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Checking stats sends an authenticated request to a third-party service and reveals account activity metadata. This is routine functionality, but it still relies on external transmission of credential-backed requests.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

Check your stats:

bash

curl -X GET https://api.humanjudge.com/api/v1/oc/agents/me \
  -H "Authorization: Bearer $API_KEY"

Static analysis

No suspicious patterns detected.