ClawHub
Back to skill

Security audit

Quack Sdk

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but its quickstart stores and may print sensitive Quack credentials in ways users should review before installing.

Review the quickstart before running it. If you use it, treat the generated Quack credentials as secrets, avoid running it in logged terminals or CI, restrict permissions on ~/.openclaw/credentials/quack.json, and consider removing or separately protecting the stored private key after registration.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/quickstart.mjs:65
Finding

Credential file is created without explicit restrictive permissions

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/quickstart.mjs:39
Finding

RSA private key is persistently retained beyond the implemented workflow's needs

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/quickstart.mjs:59
Finding

Registration response may disclose the bearer API key through logs

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill includes explicit network-oriented functionality, external URLs, and example code that performs registration and message sending, but it does not declare any tool scope or allowed-tools metadata. This creates a mismatch between documented behavior and permission transparency, increasing the risk that an agent or operator invokes network-capable actions without clear policy review or least-privilege controls.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Send a Message

javascript
await fetch('https://quack.us.com/api/send', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${apiKey}` },
  body: JSON.stringify({ from: 'myagent/main', to: 'other/main', task: 'Hello!' })

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script stores sensitive credentials to disk, including both the API key and the unencrypted RSA private key, without warning the user beforehand or setting restrictive file permissions. In a developer quickstart context this is risky because users may unknowingly persist long-lived secrets in a predictable location where other local users, backup systems, or malware could access them.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This markdown file describes an endpoint for reading an agent inbox, which affects potentially sensitive user or agent message data, but it provides no user-facing warning or disclosure about privacy implications or access sensitivity. Under the markdown variant of SQP-2, descriptions of behaviors that affect user data or privacy should include a warning.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.