PPQ.AI Private Mode

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:22 PM UTC
• Version: 1.0.1

Overview

The skill appears to do what it claims, but it asks for a live API key and installs mutable third-party plugin code without pinning or verification.

Review the PPQ plugin source before installing, prefer a pinned release or commit with provenance, and treat the PPQ API key as sensitive. Use a limited or revocable key if available, check permissions on ~/.openclaw/openclaw.json, and know how to remove the plugin or rotate the key before proceeding.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:21
• Finding: Installation and Execution of an Unpinned Remote Plugin<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 21 **Vulnerability Type**: Remote payload retrieval from a mutable GitHub repository **Risk Level**: High ### Vulnerable Code ```bash openclaw plugins install https://github.com/PayPerQ/ppq-private-mode-proxy ``` ### Technical Analysis The Skill instructs OpenClaw to install a plugin directly from a remote GitHub repository without pinning it to a reviewed commit hash or immutable release artifact. It also provides no checksum or digital-signature verification. Consequently, the code executed during installation can differ from the code that existed when the Skill was audited. A compromise of the repository, maintainer account, release workflow, or relevant delivery infrastructure could replace the legitimate plugin with arbitrary code. This is best classified as remote payload retrieval and execution because the effective executable payload is obtained from an external, mutable location when the Skill is invoked. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or its release process. 2. The attacker modifies the plugin to include malicious installation or runtime behavior. 3. A user follows the Skill and executes the unpinned installation command. 4. OpenClaw retrieves and installs the attacker-controlled version. 5. The plugin executes in the OpenClaw gateway context. 6. The malicious plugin can access resources available to that process, potentially including OpenClaw configuration, the PPQ API key, user-readable files, network access, and model traffic. ### Impact Assessment Successful exploitation can result in arbitrary code execution with the privileges of the user running OpenClaw. The affected scope can include: - Theft of the configured PPQ API key. - Access to user-readable files and OpenClaw configuration. - Interception or modification of prompts and model responses. - Unauthorized outbound network communication. - Modification ...[truncated 278 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the plugin to a specific, audited commit hash or immutable signed release rather than installing from the repository's mutable default branch. 2. Publish and verify a cryptographic checksum, such as SHA-256, for the exact installation artifact. 3. Require verification of a trusted maintainer signature before installation. 4. Review the plugin's installation hooks and runtime code at the pinned revision. 5. Prefer a trusted package registry that supports immutable versions, provenance attestations, and integrity metadata. 6. Run the plugin with least privilege and restrict filesystem, secret, and network access where OpenClaw supports sandboxing. 7. Document a controlled upgrade process requiring security review before changing the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:15
• Finding: PPQ API Key Collected and Stored Without Secret-Protection Guidance<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 15–17 and 52–56 **Vulnerability Type**: Plaintext sensitive-data handling in configuration **Risk Level**: Medium ### Vulnerable Code Lines 15–17 instruct the agent to request the credential directly: ```markdown Ask the user for their PPQ.AI API key. They can find it at https://ppq.ai/api-docs -- it starts with `sk-`. Do not proceed until the user provides their key. ``` Lines 52–56 instruct the agent to place that credential in the OpenClaw configuration: ```json "ppq-private-mode": { "config": { "apiKey": "<the key the user provided>" } } ``` ### Technical Analysis The Skill requires the user to provide a live API credential and directs the agent to store it directly in `~/.openclaw/openclaw.json`. It does not require a secure credential prompt, operating-system secret storage, restrictive file permissions, log redaction, or avoidance of chat-history exposure. This creates multiple potential disclosure channels: - The key may remain in conversation or agent execution history. - The configuration may be included in backups or diagnostic bundles. - Other local users or processes may read the file if its permissions are too broad. - Tools may echo, log, or serialize the configuration during editing. - Users may accidentally share the configuration while troubleshooting. The audit does not establish that the key is intentionally exfiltrated. The issue is that the prescribed workflow handles a sensitive credential without adequate safeguards. ### Attack Path 1. The user provides the live PPQ API key through the agent interaction as instructed. 2. The agent inserts the key into `~/.openclaw/openclaw.json`. 3. The credential remains available in plaintext configuration and may also remain in conversation or tool history. 4. A local process, another user with file access, a backup system, diagnostic tooling, or a party with access to retained interaction logs obtains the key. ...[truncated 767 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not ask users to paste long-lived API keys into ordinary chat or agent messages. 2. Obtain the credential through a non-echoing secure prompt or an out-of-band secret-entry mechanism. 3. Store the key in an operating-system keychain, dedicated secret manager, or protected environment variable instead of directly embedding it in the main OpenClaw configuration. 4. If file-based storage is unavoidable, use a separate credential file with owner-only permissions, such as mode `0600`, and reference it indirectly. 5. Ensure tools, command output, diagnostics, and agent logs redact values matching the PPQ key format. 6. Prevent secret values from appearing in configuration diffs, backups, telemetry, crash reports, and support bundles. 7. Add explicit credential-rotation and revocation instructions for suspected exposure. 8. Use a narrowly scoped key with spending limits or usage restrictions where the provider supports them. 9. Validate file ownership and permissions before restarting the gateway. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly instructs the agent to solicit a PPQ API key and place it into a local configuration file, but provides no guidance on treating the key as a secret, minimizing exposure, or avoiding logging/echoing it in chat. In an agent context, this increases the chance of credential leakage through conversation history, screenshots, shell history, backups, or overly permissive file permissions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs installation of a plugin directly from a remote GitHub repository and then restarts a local service, causing unreviewed third-party code to be fetched, installed, and activated on the user's machine. Because the repository content can change and the skill gives no warning, verification step, or pinning to a reviewed version, this materially increases supply-chain and local code-execution risk.

Static analysis

No suspicious patterns detected.