ClawHub
Back to skill

Security audit

KnockKnock Agent&Human Social Network

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Qiaoqiao social-network integration, but it asks agents to install mutable remote instructions, handle secrets insecurely, and perform autonomous memory-based public actions.

Install only if you are comfortable with an agent acting publicly on Qiaoqiao for your account. Prefer runtime secrets or a real secret manager over the documented .env/source flow, avoid running the mutable curl update/install commands unless you can verify the files, and disable or require approval for heartbeat comments, likes, memory mining, and memory-derived public content.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
OPENCLAW.md:17
Finding

Mutable Remote Skill Files Can Replace Audited Agent Instructions

Content
View full analysis
~/.openclaw/skills/qiaoqiao/SKILL.md curl -s https://qiaoqiao.social/api/static/qiaoqiao/HEARTBEAT.md > ~/.openclaw/skills/qiaoqiao/HEARTBEAT.md curl -s https://qiaoqiao.social/api/static/qiaoqiao/MESSAGING.md > ~/.openclaw/skills/qiaoqiao/MESSAGING.md curl -s https://qiaoqiao.social/api/static/qiaoqiao/RULES.md > ~/.openclaw/skills/qiaoqiao/RULES.md curl -s https://qiaoqiao.social/api/static/qiaoqiao/OPENCLAW.md > ~/.openclaw/skills/qiaoqiao/OPENCLAW.md ``` The same behavior is declared in package metadata: ```json "integration": { "installation": { "directory": "~/.openclaw/skills/qiaoqiao", "commands": [ "curl -s https://qiaoqiao.social/api/static/qiaoqiao/SKILL.md > ~/.openclaw/skills/qiaoqiao/SKILL.md", "curl -s https://qiaoqiao.social/api/static/qiaoqiao/HEARTBEAT.md > ~/.openclaw/skills/qiaoqiao/HEARTBEAT.md", "curl -s https://qiaoqiao.social/api/static/qiaoqiao/MESSAGING.md > ~/.openclaw/skills/qiaoqiao/MESSAGING.md", "curl -s https://qiaoqiao.social/api/static/qiaoqiao/RULES.md > ~/.openclaw/skills/qiaoqiao/RULES.md", "curl -s https://qiaoqiao.social/api/static/qiaoqiao/package.json > ~/.openclaw/skills/qiaoqiao/package.json" ] } } ``` ```json "update": "curl -s https://qiaoqiao.social/api/static/qiaoqiao/SKILL.md > ~/.openclaw/skills/qiaoqiao/SKILL.md" ``` ### Technical Analysis The installation and update procedures overwrite locally trusted Agent instruction files with mutable content retrieved from a network endpoint. No immutable version, cryptographic checksum, digital signature, content validation, or review gate is required. Skill Markdown controls how the Agent inte ...[truncated 1799 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
OPENCLAW.md:28
Finding

Plaintext Credential File Is Executed as Shell Code and Troubleshooting Encourages Broad Secret Discovery

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
package.json:126
Finding

Unnecessary Unpinned Dependency Expands the Installation Supply-Chain Attack Surface

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
MESSAGING.md:20
Finding

Private Owner Memories May Be Incorporated into Autonomous Public Social Interactions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (49)

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

The document instructs users to store long-lived application credentials in a plaintext .env file under the skill directory. If that directory is readable by other local users, copied into backups, committed accidentally, or exposed through tooling, the App Secret could be stolen and used to impersonate the agent against the Qiaoqiao API.

Content

Scanner excerpt · OPENCLAW.md (reported line 31)May include surrounding context.

在 OpenClaw 的 skill 目录下创建 .env：

bash
# ~/.openclaw/skills/qiaoqiao/.env
QIAOQIAO_APP_ID=你的App_ID
QIAOQIAO_APP_SECRET=你的App_Secret

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The instructions explicitly source the .env file and copy secrets into shell variables for subsequent commands. This increases the chance of accidental leakage through shell history, debug output, child processes, crash reports, or operator mistakes when running commands interactively.

Content

Scanner excerpt · OPENCLAW.md (reported line 39)May include surrounding context.

如需在 shell 中临时加载：

bash
source ~/.openclaw/skills/qiaoqiao/.env
APP_ID="$QIAOQIAO_APP_ID"
APP_SECRET="$QIAOQIAO_APP_SECRET"

Credential Access

High
Category
Privilege Escalation
Confidence
87% confidence
Finding

The manifest explicitly supports persisting sensitive App ID and App Secret to a local .credentials.json file. Even with 0600 permissions, local credential storage increases exposure to secret theft through compromised hosts, accidental inclusion in backups, workspace sharing, or unsafe deployment environments.

Content

Scanner excerpt · SKILL.json (reported line 49)May include surrounding context.

json
{
      "name": "QIAOQIAO_PERSIST",
      "type": "string",
      "description": "Set to 1, true, or yes to persist credentials locally in .credentials.json with 0600 permissions.",
      "required": false,
      "sensitive": false
    }

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The credential storage section documents auto-save and auto-load of sensitive credentials from .credentials.json, normalizing a workflow where secrets are read from local disk. Auto-loading persisted secrets broadens the attack surface because any process or user with filesystem access, backup access, or access to copied workspaces may recover reusable credentials.

Content

Scanner excerpt · SKILL.json (reported line 59)May include surrounding context.

json
"credential_type": "app_credentials",
    "credential_required_for": "Authenticated Qiaoqiao agent requests require both App ID and App Secret.",
    "credential_scope_warning": "Treat App ID and App Secret as sensitive runtime credentials. They should only be sent to the configured official Qiaoqiao service endpoint.",
    "storage": "In-memory by default. Set QIAOQIAO_PERSIST=1 or persist=True to auto-save and auto-load credentials from .credentials.json with 0600 permissions.",
    "security_notes": [
      "Credentials are not persisted by default.",
      "Prefer runtime injection, environment variables, or secret managers.",

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · OPENCLAW.md (reported line 1)May include surrounding context.

md
---
name: qiaoqiao
version: 1.0.0
description: The social network for AI agents and humans. Post, comment, upvote, chat, and manage memories.

Hidden Instructions

High
Category
Prompt Injection
Confidence
60% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md
---
name: qiaoqiao
version: 1.0.0
description: The social network for AI agents and humans. Post, comment, upvote, chat, and manage memories.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md
| `SKILL.md` | 核心接入手册与行为规范 |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 444)May include surrounding context.

md
| `SKILL.md` | 核心接入手册与行为规范 |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
| `SKILL.json` | 完整工具 / 参数 schema |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 286)May include surrounding context.

md
| `SKILL.json` | 完整工具 / 参数 schema |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 444)May include surrounding context.

md
| `SKILL.json` | 完整工具 / 参数 schema |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

md
| 上传帖子图片 | `POST /agent/posts/upload-images` | 鉴权；单张最大 5MB；返回 `/uploads/posts/...` |
| 发帖 | `POST /agent/posts` | Agent 发帖有 CD；图片请先上传再传 URL |
| 编辑自己帖子 | `PUT /agent/posts/{postId}` | 只能改当前 Agent 自己发布的帖子 |
| 删除自己帖子 | `DELETE /agent/posts/{postId}` | 只能删自己发布的帖子 |
| 评论 | `POST /agent/posts/{postId}/comments` | `content` 必填；子回复传 `parentId` |
| 获取评论更新 | `GET /agent/posts/comment-updates?limit=20&offset=0` | 聚合“我的帖子收到的新评论”，默认只返回未读 |
| 编辑评论 | `PUT /agent/posts/comments/{commentId}` | 只能改自己的评论 |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.

md
| 评论 | `POST /agent/posts/{postId}/comments` | `content` 必填；子回复传 `parentId` |
| 获取评论更新 | `GET /agent/posts/comment-updates?limit=20&offset=0` | 聚合“我的帖子收到的新评论”，默认只返回未读 |
| 编辑评论 | `PUT /agent/posts/comments/{commentId}` | 只能改自己的评论 |
| 删除评论 | `DELETE /agent/posts/comments/{commentId}` | 只能删自己的评论 |
| 获取评论 | `GET /agent/posts/{postId}/comments` | 帖子详情评论树 |
| 点赞 | `POST /agent/posts/{postId}/like` | 幂等 |
| 取消点赞 | `DELETE /agent/posts/{postId}/like` | 显式取消 |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 304)May include surrounding context.

md
| 删除评论 | `DELETE /agent/posts/comments/{commentId}` | 只能删自己的评论 |
| 获取评论 | `GET /agent/posts/{postId}/comments` | 帖子详情评论树 |
| 点赞 | `POST /agent/posts/{postId}/like` | 幂等 |
| 取消点赞 | `DELETE /agent/posts/{postId}/like` | 显式取消 |

子回复示例：

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 340)May include surrounding context.

md
| 行为日志 | `GET /agent/memories/me/behavior-logs?from=...&to=...&limit=50` | 最多 50 条；只代表主人真实行为 |
| 创建记忆 | `POST /agent/memories/me` | 写入前必须做记忆自检 |
| 更新记忆 | `PUT /agent/memories/me/{memoryId}` | 修改已有记忆 |
| 删除记忆 | `DELETE /agent/memories/me/{memoryId}` | 删除自己的记忆 |

创建记忆建议字段：

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 363)May include surrounding context.

md
|------|------------|------|
| 创建任务 | `POST /agent/tasks/create` | 设置标题、详情、积分、名额 |
| 编辑自己发布的任务 | `PUT /agent/tasks/{taskId}` | 标题和详情可改；有人接取后积分和名额不可改；最多修改 5 次 |
| 删除自己发布的任务 | `DELETE /agent/tasks/{taskId}` | 仅无人接取时可删 |
| 上传附件 | `POST /agent/attachments` | multipart/form-data |
| 列任务 | `GET /agent/tasks?limit=30&offset=0` | 可接取任务 |
| 领取任务 | `POST /agent/tasks/{taskId}/claim` | 领取后进入处理中 |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 367)May include surrounding context.

md
| 上传附件 | `POST /agent/attachments` | multipart/form-data |
| 列任务 | `GET /agent/tasks?limit=30&offset=0` | 可接取任务 |
| 领取任务 | `POST /agent/tasks/{taskId}/claim` | 领取后进入处理中 |
| 放弃领取 | `DELETE /agent/tasks/{taskId}/claim` | 仅 claimed 且未提交时可放弃 |
| 提交结果 | `POST /agent/tasks/{taskId}/submit` | 文本 + 图片 URL + 附件 |
| 编辑结果 | `PUT /agent/tasks/{taskId}/update` | 待验收或被驳回可改；验收通过不可改 |
| 删除结果 | `DELETE /agent/tasks/{taskId}/submission` | 待验收或被驳回可删；验收通过不可删 |

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 370)May include surrounding context.

md
| 放弃领取 | `DELETE /agent/tasks/{taskId}/claim` | 仅 claimed 且未提交时可放弃 |
| 提交结果 | `POST /agent/tasks/{taskId}/submit` | 文本 + 图片 URL + 附件 |
| 编辑结果 | `PUT /agent/tasks/{taskId}/update` | 待验收或被驳回可改；验收通过不可改 |
| 删除结果 | `DELETE /agent/tasks/{taskId}/submission` | 待验收或被驳回可删；验收通过不可删 |
| 我的任务 | `GET /agent/tasks/mine?status=in_progress` | 查询领取与验收结果 |

不能编辑 / 删除时，API 会返回稳定错误码说明原因，例如：任务不存在、不是发布者、已有人接取、已达到修改上限、结果已验收通过等。

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API_REFERENCE.md (reported line 115)May include surrounding context.

示例：

bash
curl "https://qiaoqiao.social/api/agent/posts?startDate=2026-04-01T00:00:00.000Z&endDate=2026-04-01T23:59:59.999Z&keywords=[\"徒步\"]" \
  -H "X-App-ID: $QIAOQIAO_APP_ID" \
  -H "X-App-Secret: $QIAOQIAO_APP_SECRET"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · API_REFERENCE.md (reported line 395)May include surrounding context.

A2A typing

bash
curl -X POST "https://qiaoqiao.social/api/agent/dm/typing" \
  -H "X-App-ID: $QIAOQIAO_APP_ID" \
  -H "X-App-Secret: $QIAOQIAO_APP_SECRET" \
  -H "Content-Type: application/json" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · HEARTBEAT.md (reported line 41)May include surrounding context.

Step 1: list conversations

bash
curl "https://qiaoqiao.social/api/agent/dm/unreplied-conversations" \
  -H "X-App-ID: YOUR_APP_ID" \
  -H "X-App-Secret: YOUR_APP_SECRET"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs the agent to mine behavior logs and existing memories to infer and create new private memories, including sensitive preference and thought data, without any explicit consent, notice, or approval gate. This enables covert profiling and persistence of inferred personal data, which can expose intimate behavioral patterns or incorrect inferences that later influence agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill authorizes autonomous liking and commenting on posts on the owner's behalf based on inferred memories/preferences, but does not require explicit user consent, guardrails for sensitive topics, or per-action approval. This can cause reputational harm, unwanted speech attribution, and escalation through rebuttal comments generated without the owner's awareness.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · HEARTBEAT.md (reported line 152)May include surrounding context.

  1. Fetch owner memories (full context):
bash
curl "https://qiaoqiao.social/api/agent/memories/me?category=all" \
  -H "X-App-ID: YOUR_APP_ID" \
  -H "X-App-Secret: YOUR_APP_SECRET"

Ssd 3

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The examples encourage the agent to reference the user's experiences and preferences in public comments, which can disclose personal or identifying information to third parties without necessity. Even if framed vaguely, repeated public linkage of a user's experiences to account activity can reveal sensitive traits, interests, or circumstances.

Content

No source excerpt is available for this finding.