T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:21- Finding
Installation and Execution of an Unpinned Remote Plugin
- Content
View full analysis
- Remediation
View remediation
Security audit
PPQ.AI Private Mode
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to do what it claims, but it asks for a live API key and installs mutable third-party plugin code without pinning or verification.
Review the PPQ plugin source before installing, prefer a pinned release or commit with provenance, and treat the PPQ API key as sensitive. Use a limited or revocable key if available, check permissions on ~/.openclaw/openclaw.json, and know how to remove the plugin or rotate the key before proceeding.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:15- Finding
PPQ API Key Collected and Stored Without Secret-Protection Guidance
- Content
View full analysis
" } } ``` ### Technical Analysis The Skill requires the user to provide a live API credential and directs the agent to store it directly in `~/.openclaw/openclaw.json`. It does not require a secure credential prompt, operating-system secret storage, restrictive file permissions, log redaction, or avoidance of chat-history exposure. This creates multiple potential disclosure channels: - The key may remain in conversation or agent execution history. - The configuration may be included in backups or diagnostic bundles. - Other local users or processes may read the file if its permissions are too broad. - Tools may echo, log, or serialize the configuration during editing. - Users may accidentally share the configuration while troubleshooting. The audit does not establish that the key is intentionally exfiltrated. The issue is that the prescribed workflow handles a sensitive credential without adequate safeguards. ### Attack Path 1. The user provides the live PPQ API key through the agent interaction as instructed. 2. The agent inserts the key into `~/.openclaw/openclaw.json`. 3. The credential remains available in plaintext configuration and may also remain in conversation or tool history. 4. A local process, another user with file access, a backup system, diagnostic tooling, or a party with access to retained interaction logs obtains the key. ...[truncated 767 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill explicitly instructs the agent to solicit a PPQ API key and place it into a local configuration file, but provides no guidance on treating the key as a secret, minimizing exposure, or avoiding logging/echoing it in chat. In an agent context, this increases the chance of credential leakage through conversation history, screenshots, shell history, backups, or overly permissive file permissions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs installation of a plugin directly from a remote GitHub repository and then restarts a local service, causing unreviewed third-party code to be fetched, installed, and activated on the user's machine. Because the repository content can change and the skill gives no warning, verification step, or pinning to a reviewed version, this materially increases supply-chain and local code-execution risk.
- Content