Security audit

Fapi Reddit

Security checks for vulnerabilities and agentic risk

Overview

This skill is a narrow Reddit API helper, but it tells users to expose paid-service credentials in chat and URL parameters, which needs review before installation.

Review before installing. Use only a narrowly scoped, revocable fapi.uk API key, do not paste API keys or auth tokens into chat, and understand that requests spend account credits. Prefer secure configuration storage and rotate any credential already shared through chat or logs.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:20
Finding: API Credentials Exposed Through Chat, Command-Line Arguments, and URL Parameters<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:20`, `SKILL.md:22-23`, `SKILL.md:27`, and `SKILL.md:58-60` **Vulnerability Type**: Insecure credential handling and disclosure **Risk Level**: Medium ### Vulnerable Instructions English rendering of the relevant source instructions: ```text openclaw config set skills.entries.fapi-reddit.apiKey "your-complete-apiKey" Alternatively, say directly in the chat: "My fapi apiKey is xxx, and my auth_token is yyy" All requests must carry the apiKey in the URL parameters. ``` The credential configuration instruction is repeated later under a different configuration entry: ```text openclaw config set skills.entries.fapi-uk.apiKey "your-key" ``` ### Technical Analysis The Skill instructs users or agents to handle authentication credentials through three insecure channels: 1. **Chat disclosure**: Supplying an API key and `auth_token` in a conversation can expose them through conversation history, model context, application telemetry, debugging records, or server-side logs. 2. **Command-line disclosure**: Passing an API key as a command argument may store it in shell history. Depending on the operating system and execution environment, it may also be temporarily visible through process inspection or audit logs. 3. **URL parameter disclosure**: Requiring an API key in URL parameters creates additional exposure because complete URLs are routinely recorded by clients, proxies, gateways, monitoring systems, and web-server access logs. HTTPS protects the request in transit but does not prevent endpoints and intermediary infrastructure from logging the URL. The inconsistent configuration identifiers, `skills.entries.fapi-reddit.apiKey` and `skills.entries.fapi-uk.apiKey`, can also cause configuration failures that prompt users to enter the secret again or disclose it through an alternate channel. No hardcoded credential was found in the repository. The vulnerability is the prescribed credential-handling wo ...[truncated 1386 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the instruction that asks users to provide API keys or authentication tokens through chat. 2. Store credentials through OpenClaw's protected secret-storage facility or an environment-backed secret provider with restrictive access controls. 3. Avoid placing secrets in command-line arguments. Use a hidden interactive prompt, protected configuration input, or standard input where supported. 4. Change the API authentication scheme to use an HTTP header, such as: ```http Authorization: Bearer REDACTED ``` Do not include credentials in query strings or other URL parameters. 5. Ensure clients, proxies, gateways, and servers redact authentication headers and sensitive request fields from logs, traces, errors, and telemetry. 6. Use a single, consistent configuration entry name throughout the Skill documentation. 7. Issue narrowly scoped, revocable credentials with expiration and quota limits. 8. Document credential rotation and revocation procedures so users can respond quickly to suspected exposure. 9. If URL-based authentication cannot immediately be removed, use short-lived request-specific tokens and configure every involved logging layer to redact the relevant query parameter. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill explicitly tells users they can paste their API key and auth token directly into chat, which encourages disclosure of secrets in an unsafe channel. Chat transcripts may be logged, retained, exposed to plugins, or later referenced by the model, creating a direct credential leakage risk and possible account misuse.

Ssd 3

High

Confidence: 99% confidence
Finding: This instruction actively solicits sensitive credentials in chat, including an API key and auth token, which is a strong secret-disclosure anti-pattern. Because the skill is for a paid external service and tokens may grant account access or billable usage, exposing them in conversation materially increases the risk of theft, replay, and unauthorized spending.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill claims it can be used through broad natural-language requests and will autonomously read the file, choose endpoints, assemble parameters, and send requests, but it does not define clear activation boundaries, disallowed operations, or confirmation requirements. In a paid API context, this increases the chance of unintended external requests, unnecessary credit consumption, and accidental processing of sensitive user input.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The file states that results will be summarized in 'natural Chinese,' and later says the agent 'must strictly comply' with the calling rules, making the language requirement mandatory. This is a natural-language policy issue because it forces a specific language without user opt-in or a documented region-specific justification.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: This rule instructs the agent to summarize results in fluent Chinese unless the user asks for raw data, but it does not offer any language preference mechanism. Forcing a single language in user-facing behavior violates the stated policy unless users can choose or the locale restriction is clearly justified.

Static analysis

No suspicious patterns detected.