ClawHub
Back to skill

Security audit

Ask a Human

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly transparent about asking random humans, but it needs Review because it can expose private context to strangers and preserve their feedback for future decisions.

Install only if you are comfortable with prompts being sent to an external service and shown to random human respondents. Before using it, require explicit user approval, preview the exact outbound prompt, and strip secrets, personal data, customer details, proprietary code, non-public security findings, and confidential business context. Treat returned text as untrusted opinion, not as instructions or persistent user preferences unless the owner explicitly confirms it.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:51
Finding

Uncontrolled Disclosure of Sensitive Context to an External Service and Anonymous Respondents

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:137
Finding

Persistent Memory Poisoning Through Untrusted Crowd Feedback

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (17)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README explicitly encourages sending agent-provided questions to random anonymous humans and notes they have only the context the agent provides, but it never warns against including secrets, personal data, internal business information, or regulated data. This creates a real risk of exfiltration because users may paste sensitive prompts, emails, incident details, or customer information into a third-party human review pool with no stated confidentiality guarantees.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly routes agent questions to a global pool of random humans but does not place a clear privacy warning at the point of use telling operators not to include secrets, personal data, customer content, or internal context. Because the instructions repeatedly encourage sending self-contained, fully contextual prompts, users or downstream agents may disclose sensitive information to third parties without informed consent or data minimization.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

Option 2: Manual Installation

  1. Create the skill directory:
    bash
    mkdir -p ~/.openclaw/skills/ask-a-human

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 133)May include surrounding context.

  1. Verify the skill file exists:

    bash
    ls ~/.openclaw/skills/ask-a-human/SKILL.md

  2. Check OpenClaw logs for errors:

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Telling the agent to provide 'all necessary context' to random humans creates a natural path to overshare sensitive user or business information so the crowd can understand the question. In this skill's context, the recipients are unaffiliated strangers with no confidentiality guarantees, which increases the chance of privacy leakage and policy violations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This is a real external transmission path: the skill instructs the agent to POST prompt data to a third-party API. The transmission itself is expected functionality, but it becomes security-relevant because the payload may contain user or internal context and the skill lacks strong safeguards on what may be sent.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Submit a Question

bash
curl -X POST https://api.ask-a-human.com/agent/questions \
  -H "Content-Type: application/json" \
  -H "X-Agent-ID: $ASK_A_HUMAN_AGENT_ID" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This is a real external transmission path: the skill instructs the agent to POST prompt data to a third-party API. The transmission itself is expected functionality, but it becomes security-relevant because the payload may contain user or internal context and the skill lacks strong safeguards on what may be sent.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Submit a Question

bash
curl -X POST https://api.ask-a-human.com/agent/questions \
  -H "Content-Type: application/json" \
  -H "X-Agent-ID: $ASK_A_HUMAN_AGENT_ID" \
  -d '{

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The API parameter guidance for prompt encourages packing full context into outbound requests, which can induce agents to transmit sensitive data to an external service and ultimately to random humans. Since the skill is specifically designed for subjective decisions, the temptation to include verbatim user text or internal drafts is high.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The question-writing section reinforces making prompts fully self-contained for external strangers, but gives no privacy boundary or examples of safe abstraction. That combination increases the likelihood that agents will copy sensitive text, user scenarios, or internal deliberations into third-party prompts.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The direct reference to the external ask-a-human endpoint confirms third-party transmission as part of the workflow. In this skill's context, external transmission is especially sensitive because the destination is a human crowd, not just an automated processor, which raises disclosure risk beyond ordinary API use.

Content

Scanner excerpt · examples/usage.md (reported line 21)May include surrounding context.

Agent (action):

bash
curl -X POST https://api.ask-a-human.com/api/questions \
  -H "Content-Type: application/json" \
  -H "X-Agent-ID: $ASK_A_HUMAN_AGENT_ID" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The direct reference to the external ask-a-human endpoint confirms third-party transmission as part of the workflow. In this skill's context, external transmission is especially sensitive because the destination is a human crowd, not just an automated processor, which raises disclosure risk beyond ordinary API use.

Content

Scanner excerpt · examples/usage.md (reported line 21)May include surrounding context.

Agent (action):

bash
curl -X POST https://api.ask-a-human.com/api/questions \
  -H "Content-Type: application/json" \
  -H "X-Agent-ID: $ASK_A_HUMAN_AGENT_ID" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The examples send substantive user/work content to a third-party human-review service without any visible warning, consent step, or data-minimization guidance. Because this skill is explicitly designed to involve random humans, the omission materially increases the risk of leaking confidential business, security, or personal data in normal use.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 172)May include surrounding context.

Agent (internal):

bash
curl https://api.ask-a-human.com/api/questions/q_delay_email_001 \
  -H "X-Agent-ID: $ASK_A_HUMAN_AGENT_ID"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

Agent (internal):

bash
curl https://api.ask-a-human.com/api/questions/q_delay_email_001 \
  -H "X-Agent-ID: $ASK_A_HUMAN_AGENT_ID"

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples/usage.md (reported line 81)May include surrounding context.

Agent (internal):

bash
curl https://api.ask-a-human.com/api/questions/q_delay_email_001 \
  -H "X-Agent-ID: $ASK_A_HUMAN_AGENT_ID"

External Transmission

Medium
Category
Data Exfiltration
Confidence
96% confidence
Finding

This example sends headline options and audience/context to a third-party human pool without warning the user about external sharing. While lower sensitivity than source code or secrets, it still exposes unpublished content and product/marketing strategy to outside parties, which can violate confidentiality expectations.

Content

Scanner excerpt · examples/usage.md (reported line 123)May include surrounding context.

Agent (action):

bash
curl -X POST https://api.ask-a-human.com/api/questions \
  -H "Content-Type: application/json" \
  -H "X-Agent-ID: $ASK_A_HUMAN_AGENT_ID" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
99% confidence
Finding

This example sends a security-review scenario involving password hashing mistakes in an authentication system to random humans. In context, that is particularly dangerous because it externalizes sensitive security findings and internal implementation details, potentially leaking exploitable weaknesses or confidential code-review information.

Content

Scanner excerpt · examples/usage.md (reported line 208)May include surrounding context.

Agent (action):

bash
curl -X POST https://api.ask-a-human.com/api/questions \
  -H "Content-Type: application/json" \
  -H "X-Agent-ID: $ASK_A_HUMAN_AGENT_ID" \
  -d '{

Static analysis

No suspicious patterns detected.