Security audit

Praesidia

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned, but it needs review because it can send sensitive content and API credentials to configurable API endpoints and can change live guardrails without strong confirmation guidance.

Review the configured PRAESIDIA_API_URL before use, prefer the official HTTPS endpoint unless you operate the custom deployment, and use a least-privilege Praesidia API key. Before asking the skill to validate messages or apply guardrails, assume submitted content may be sent to Praesidia and confirm any changes that could affect live agent behavior.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:257
Finding: Configurable API Endpoint Can Receive Bearer Credentials and Sensitive Validation Content
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README encourages broad natural-language triggering for common phrases like safety checks, agent discovery, and guardrail application without clearly constraining authorization, confirmation, or user intent. In practice, this can cause over-broad skill activation and lead the assistant to fetch third-party agent data or initiate security-policy changes in situations where the user did not explicitly request Praesidia-backed actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill documents guardrails that can BLOCK, REDACT, REPLACE, RETRY, or ESCALATE content, but it does not prominently warn that enabling them can disrupt agent behavior, alter outputs, or cause false positives. Without explicit operator awareness and confirmation, users may unintentionally deploy controls that impact production traffic, compliance workflows, or user experience.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 645)May include surrounding context.
md
### Skill Not Loading 1. Check file location: `~/.openclaw/skills/praesidia/SKILL.md` 2. Verify YAML frontmatter is valid 3. Restart OpenClaw 4. Check OpenClaw logs for errors

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description contains very broad trigger phrases such as generic security, compliance, moderation, trust, and agent-safety language, which can cause the skill to activate in many unrelated conversations. Over-broad activation increases the chance that user prompts and context are routed to this skill unnecessarily, which can lead to unintended external API use and over-collection of sensitive context.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 243)May include surrounding context.
Compliance: SOC2, GDPR Last verified: 2 days ago

Agent card: https://api.praesidia.ai/agents/chatbot-v2/agent-card

text
---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 658)May include surrounding context.
Compliance: SOC2, GDPR Last verified: 2 days ago

Agent card: https://api.praesidia.ai/agents/chatbot-v2/agent-card

text
---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.
Compliance: SOC2, GDPR Last verified: 2 days ago

Agent card: https://api.praesidia.ai/agents/chatbot-v2/agent-card

text
---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.
Compliance: SOC2, GDPR Last verified: 2 days ago

Agent card: https://api.praesidia.ai/agents/chatbot-v2/agent-card

text
---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 320)May include surrounding context.
Compliance: SOC2, GDPR Last verified: 2 days ago

Agent card: https://api.praesidia.ai/agents/chatbot-v2/agent-card

text
---

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs sending arbitrary user-provided content to a remote guardrail validation endpoint without requiring a user-facing disclosure or consent step. Because the content may include prompts, secrets, personal data, regulated data, or proprietary material, this creates a real risk of unintended data exfiltration to a third-party service.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: README.md:566