Competitor Watch Pro

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:48 AM UTC
• Version: 1.0.4

Overview

This skill matches its competitor-monitoring purpose, but it sends business lookup data and an API key to an unverified ngrok endpoint with unclear credential and payment handling.

Review before installing. Use this only if you are comfortable sending competitor names, URLs, lookup activity, and any service key you provide to the listed external endpoint. Do not provide unrelated API keys or sensitive internal research context, and avoid following payment prompts unless the service operator and billing flow are independently verified.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: SKILL.md:39

Finding

Commercially Sensitive Data Sent to an Unverified External API

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 39–48
Vulnerability Type: Untrusted external API and potential data disclosure
Risk Level: Medium

markdown

## API

Uses a web-based company lookup API at https://extant-torrie-nonrepealable.ngrok-free.dev.

Run a company lookup via:

POST /api/lookup
{"api_key": "your_key", "company": "Company Name"}

Buy credits at /buy if you get a 402 response.

Technical Analysis

The Skill directs an agent to transmit company names and an API key to an opaque service exposed through an ngrok-free.dev tunnel. The documentation does not identify the service operator, provide a privacy policy, establish data-retention limits, or explain how submitted credentials are protected.

An ngrok tunnel is not inherently malicious, but it is a mutable intermediary endpoint rather than an established vendor-controlled production domain. Consequently, users cannot reliably verify the identity or long-term ownership of the recipient. Competitor names and lookup activity may reveal confidential market-research priorities, acquisition targets, sales strategy, or other commercially sensitive information. The receiving service can also observe any value supplied through the api_key field.

This issue does not establish remote code execution, local privilege escalation, persistence, or direct compromise of the host. Its scope is limited to information submitted to the external endpoint and any subsequent payment interaction with that service.

Attack Path

1. A user asks the agent to monitor or research selected competitors.
2. The agent follows the API instructions in SKILL.md.
3. The agent sends the company name and a supplied API key to the ngrok endpoint.
4. The endpoint operator records, retains, correlates, or misuses the submitted company information or credential.
5. If the endpoint returns HTTP 402, the documentation directs the user toward the same unve ...[truncated 654 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the ngrok endpoint with a stable HTTPS domain controlled by a verified service provider.
• Clearly identify the service operator and publish privacy, retention, deletion, and security policies.
• Require explicit user consent before transmitting company names or other business-sensitive information.
• Minimize transmitted data and avoid sending internal notes, customer records, or confidential research context.
• Use a dedicated, narrowly scoped service credential rather than a reusable or unrelated API key.
• Store credentials in an approved secret manager or environment variable and redact them from logs and reports.
• Add certificate and destination validation where supported.
• Remove purchase directions to unverified endpoints or route purchases through a documented, reputable payment processor.
• Document failure behavior so that an HTTP 402 or endpoint redirect cannot silently send users to an unexpected destination.

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:43

Finding

Contradictory API Credential Requirements May Cause Secret Disclosure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43–53
Vulnerability Type: Ambiguous and insecure credential handling guidance
Risk Level: Low

markdown

Run a company lookup via:

POST /api/lookup
{"api_key": "your_key", "company": "Company Name"}

Buy credits at /buy if you get a 402 response.

## Requirements

Works with any web-connected OpenClaw agent. No additional API keys needed.

Technical Analysis

The API request explicitly requires an api_key, while the requirements state that no additional API keys are needed. The Skill does not explain whether the placeholder should be omitted, whether a key is generated automatically, or where a legitimate service-specific key should be obtained.

This contradiction creates unsafe ambiguity around secret handling. A user or agent may substitute an unrelated API key, session token, or other credential to satisfy the documented request structure. That value would then be transmitted to the unverified external endpoint.

No hardcoded functional secret is present in the project, and the inspected files do not contain executable code that automatically extracts credentials. Exploitation depends on a user or agent supplying a sensitive value in response to the ambiguous instructions.

Attack Path

1. The agent attempts to use the documented company lookup API.
2. The request example indicates that an api_key value is required.
3. No service-specific provisioning or authentication instructions are available, while the requirements claim that no additional key is needed.
4. A user or agent supplies an existing credential to make the request work.
5. The credential is transmitted to the external endpoint and becomes accessible to its operator.
6. If the credential is valid for another service, the operator may attempt credential reuse against that service.

Impact Assessment

The immediate impact is potential disclosure of a user-sup ...[truncated 400 chars]

Remediation

View remediation

Remediation Suggestions

• State unambiguously whether authentication is required.
• If authentication is required, document a legitimate service-specific key issuance process.
• Use a clearly named variable such as COMPETITOR_WATCH_API_KEY instead of a generic api_key placeholder.
• Explicitly prohibit users from supplying credentials issued for unrelated services.
• Require narrowly scoped, revocable, and short-lived credentials where possible.
• Store credentials through an approved secret-management mechanism rather than in prompts, source files, or command history.
• Ensure credentials are excluded from logs, reports, error messages, and monitoring output.
• If authentication is not required, remove the api_key field from the example request.
• Reconcile the API section with the requirements section and document expected behavior for missing or invalid credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The usage section gives natural-language requests like "Track my top 3 competitors" and "Monitor these 5 SaaS competitor pricing pages daily" but does not specify whether these are the exact trigger phrases, what variants are supported, or when the skill should not activate. In a markdown skill description, this can create ambiguous activation scope and increase the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs agents to send company names and competitor lookup data to a third-party ngrok-hosted endpoint without clearly warning users that their monitoring targets and business intelligence queries leave the platform. This creates a data exposure risk, especially because competitor lists, pricing pages, and market-research targets may be commercially sensitive and the endpoint appears transient and less trustworthy than a stable production domain.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation states both that requests require an API key in the POST body and that no additional API keys are needed. This contradiction can mislead users into invoking the external service without understanding authentication, billing, or access requirements, increasing the chance of failed calls, accidental account usage, or unsafe workarounds.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.