Quack Challenges

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:58 AM UTC
• Version: 1.0.0

Overview

This skill does what it says: it uses a local Quack API key to list challenges, submit proof, and view a leaderboard on quack.us.com.

Install only if you intend to connect an agent to Quack Network. Be aware that invoking the scripts reads your local Quack API key and sends authenticated requests, including submitted proof text, to quack.us.com. Prefer explicit Quack-related prompts when using it because some trigger phrases are broad.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill invokes network-capable scripts and authenticated API calls, but it does not declare any tool scope or permission boundaries. This can lead to unintended network access when the skill is invoked and reduces the host's ability to constrain or review external communication.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 78% confidence
• Finding: The trigger 'list challenges' can overlap with a built-in 'list' style command, creating ambiguity about whether the platform should invoke this skill or a native capability. In this skill's context, that ambiguity is more concerning because invocation leads to external network access rather than a purely local read-only action.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are broad and generic, especially terms like 'leaderboard', 'compete', and 'list challenges', which may match unrelated user requests and cause accidental invocation. Because the skill performs authenticated network actions, unintended triggering could expose data or submit requests without clear user intent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill reveals the local credential file path and describes authenticated API usage without any warning about secret handling or data transmission. This increases the risk that downstream tooling or operators will mishandle the API key, and users are not informed that invoking the skill may send authenticated data to an external service.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This code reads an API key from a credentials file and sends it in an Authorization header to an external service. While error logging exists for missing credentials and HTTP failures, there is no confirmation prompt, user-facing disclosure, or explanatory comment/docstring warning that credentials will be accessed and used for a network call.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This code reads an API key from a credential file in the user's home directory and immediately sends it in an Authorization header to a remote service. While error logging exists for missing credentials, there is no confirmation, user-facing notice, or inline warning explaining that credentials will be accessed and used for a network call.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This code accesses a credential file at ~/.openclaw/credentials/quack.json and uses the resulting bearer token in an HTTP POST request that transmits the provided proof to an external API. Although the script's purpose implies submission, there is no inline comment, docstring, or user-facing disclosure explaining that local credentials will be read and sent in an authenticated network request.

Static analysis

No suspicious patterns detected.