other
Warning
- Location
SKILL.md:138- Finding
Persistent Behavioral Profiling Without Explicit Retention Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawriosity
Security checks for vulnerabilities and agentic risk
Overview
The skill appears purpose-built for a curiosity quiz feed, but it needs Review because it stores an API key and builds a persistent interest profile without clear user consent or deletion controls.
Before installing, users should be comfortable with query topics being sent to millionwhys.com and with the agent remembering quiz history and inferred interests over time. Avoid using sensitive personal topics with this skill, and do not paste an API key unless there is a clear secure storage and removal process.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 70% confidence
- Finding
Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.
- Content
md ## Tone & Style - Be enthusiastic but not over the top — match the user's energy - Always respond in the user's language — French user gets French, Arabic user gets Arabic, etc. - Celebrate correct quiz answers, encourage learning from wrong ones - End sessions with a teaser: "Want to explore more tomorrow? I'll remember what you liked!" - When showing quota warnings, be helpful not pushy: frame registration as unlocking more curiosity, not a sales pitch
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs the agent to extract a user-provided API key and store it in environment/config without any warning, consent language, scope limitation, or secure-handling guidance. This creates a real secret-handling risk because users may not understand the persistence model, and the key could be retained, exposed to other tools, or mishandled by downstream systems.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Query questions:
POST /querybash curl -s -X POST https://millionwhys.com/api/openclaw/query \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $MILLIONWHYS_API_KEY" \ -d '{
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill directs persistent storage of user preference and activity data, including question history, interests, and language preferences, but provides no privacy notice, retention disclosure, or consent mechanism. This is a genuine privacy issue because it normalizes long-term profiling and behavioral tracking beyond what is strictly necessary for a single response.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill instructs the agent to persist broad conversation-derived details such as interests, reactions, topics, preferred style, and inferred difficulty over time. Even though framed as personalization, this is dangerous because it encourages ongoing profiling from conversational context and may capture more sensitive behavioral data than users reasonably expect.
- Content