ClawHub
Back to skill

Security audit

量子密信对话机器人接入openclaw

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Quantum IM connector, but it starts an exposed webhook and handles private messages without enough documented deployment controls.

Install only if you can run the webhook behind HTTPS or a trusted reverse proxy, restrict who can reach the port, keep dmSecurity set to pairing or allowlist, protect and rotate the robot key, review how Quantum IM handles message data, and update or skip vulnerable dev dependencies for production deployment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The plugin directly reads ~/.openclaw/openclaw.json from the host filesystem during startup instead of using the provided plugin API/config plumbing. This creates hidden host-file access beyond the advertised IM integration behavior and can expose sensitive local configuration data or create unsafe coupling to the runtime environment.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The README instructs users to expose a webhook and configure an external Quantum IM host, but it does not clearly disclose the privacy and security implications that message bodies, phone numbers, and metadata will traverse third-party infrastructure. This is dangerous because operators may deploy the integration without informed consent, data handling review, or appropriate network protections, increasing the risk of unintended data exposure.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation instructs users to expose the webhook callback over plain HTTP and does not warn that inbound bot traffic may traverse the network without transport encryption. This can enable message interception, tampering, replay, or credential leakage if deployed outside a strictly trusted local or reverse-proxied environment.

External Transmission

Medium
Category
Data Exfiltration
Content
### 测试 Webhook 接收

```bash
curl -X POST http://localhost:3777/quantum-im \
  -H "Content-Type: application/json" \
  -d '{
    "type": "text",
Confidence
84% confidence
Finding
The documented webhook test includes realistic message content and a phone number, and the plugin’s purpose is to forward communications through the IM platform. In context this is expected functionality, but it still represents external transmission of potentially sensitive data; if operators copy these patterns into production without authentication, transport security, or data handling guidance, user communications could be exposed or spoofed.

External Transmission

Medium
Category
Data Exfiltration
Content
openclaw logs --follow

# 5. 测试 webhook
curl -X POST http://localhost:3777/quantum-im \
  -H "Content-Type: application/json" \
  -d '{"type":"text","phone":"18800001111","textMsg":{"content":"test"}}'
```
Confidence
83% confidence
Finding
This troubleshooting example again demonstrates posting message content and a phone number to the local webhook, reinforcing a workflow where sensitive communications enter the plugin and may be relayed externally. In an IM connector this is contextually normal, but the absence of adjacent warnings about authentication, privacy, and exposure makes accidental insecure deployment more likely.

Known Vulnerable Dependency: vitest==2.0.0 — 1 advisory(ies): CVE-2025-24964 (Vitest allows Remote Code Execution when accessing a malicious website while Vit)

Critical
Category
Supply Chain
Confidence
97% confidence
Finding
The package declares vitest ^2.0.0, and the static analysis identifies version 2.0.0 as affected by a critical RCE advisory. Although Vitest is a devDependency, development and CI environments often execute test tooling with high privileges, so a compromised browsing or test workflow could lead to code execution in trusted environments.

Static analysis

No suspicious patterns detected.