ClawHub

Quack Challenges

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward Quack Network integration that uses a documented local API key to list challenges, view a leaderboard, and submit proof to the stated service.

Install only if you trust quack.us.com and intend this agent to use the Quack API key stored at ~/.openclaw/credentials/quack.json. Review challenge IDs and proof text before submitting, and avoid putting secrets, personal data, or proprietary information in proof content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger phrase "compete" is broad enough to match ordinary user conversation unrelated to this specific skill, which can cause unintended invocation. In a skill that can access credentials and submit actions to a remote service, accidental activation increases the chance of undesired network calls or submissions.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The skill instructs use of an API key from a local credentials file but provides no warning about secret handling, least privilege, or avoiding disclosure in logs and outputs. Because this skill performs authenticated requests to an external service, poor credential hygiene could expose the token and enable unauthorized use of the Quack account.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script silently reads a local credential file and immediately uses the API key in an authenticated request without any user-facing notice, consent prompt, or explanation. In an agent-skill context, this can cause users or calling systems to unknowingly disclose account-scoped data or trigger authenticated actions under their identity, especially when the skill is invoked indirectly by natural-language triggers.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal