T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:52- Finding
Bearer credential can be transmitted to an untrusted or plaintext API endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
Praesidia
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Praesidia API integration, but it needs Review because it can change live guardrail settings and send authenticated requests to configurable endpoints without strong safety boundaries.
Install only if you trust Praesidia and the configured API endpoint. Prefer the default HTTPS production URL, avoid sending production keys to custom or plaintext endpoints, use least-privilege and separate read/write keys, and require explicit confirmation before applying or changing guardrails. Treat any text submitted for validation as data sent to Praesidia.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
README.md:95- Finding
README guidance permits authenticated requests to arbitrary or plaintext endpoints
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The README encourages broad natural-language triggering around phrases like agent safety, trust, and securing agents, but does not define tighter preconditions or consent boundaries for when the skill should activate. In an agentic environment, this can cause over-invocation of a networked skill that makes external trust assertions or leads into administrative actions based on loosely related user prompts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill documents state-changing guardrail application behavior and frames it as a normal assistant action, but it does not require an explicit confirmation step before modifying live security configuration. This is dangerous because a user request phrased conversationally could cause an agent to alter production guardrails, potentially blocking traffic, redacting content, or weakening protections if parameters are misunderstood.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
md ### Skill Not Loading 1. Check file location: `~/.openclaw/skills/praesidia/SKILL.md` 2. Verify YAML frontmatter is valid 3. Restart OpenClaw 4. Check OpenClaw logs for errors
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 72% confidence
- Finding
The troubleshooting example includes a curl command with an Authorization header against the production API, normalizing direct manual use of bearer credentials and increasing the chance users copy secrets into shells, logs, history, or support channels. While not malicious, this creates avoidable credential-handling risk, especially because the example uses a production-style key prefix and a live endpoint.
- Content
- Test key directly with curl:
bash curl -H "Authorization: Bearer pk_live_..." \ https://api.praesidia.ai/agents/discovery
No Results Found
- Test key directly with curl:
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest description says to use the skill when the user mentions broad terms like "security policies," "content moderation," or asks "find agents that can [task]," which are not narrowly scoped to Praesidia-specific workflows. Without clearer constraints or exclusion examples, the skill could be invoked for many generic security or discovery requests that were not intended for this integration.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Compliance: SOC2, GDPR Last verified: 2 days ago
Agent card: https://api.praesidia.ai/agents/chatbot-v2/agent-card
text ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Compliance: SOC2, GDPR Last verified: 2 days ago
Agent card: https://api.praesidia.ai/agents/chatbot-v2/agent-card
text ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Compliance: SOC2, GDPR Last verified: 2 days ago
Agent card: https://api.praesidia.ai/agents/chatbot-v2/agent-card
text ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Compliance: SOC2, GDPR Last verified: 2 days ago
Agent card: https://api.praesidia.ai/agents/chatbot-v2/agent-card
text ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to perform a configuration-changing POST that enables guardrails on an agent without requiring an explicit confirmation step or warning that this modifies live security policy. In an agentic environment, that can lead to unauthorized or accidental state changes, service disruption, or policy misconfiguration if the user's request is ambiguous or maliciously framed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill sends arbitrary user-provided content to a remote validation API without an explicit privacy notice or data-handling warning. If users paste sensitive prompts, personal data, credentials, or regulated content, the agent may transmit that data off-platform unexpectedly, creating confidentiality and compliance risk.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The Security & Privacy section claims at L485 that API keys are 'never exposed to users'. However, the error-handling guidance at L363 tells the agent to direct the user to check
PRAESIDIA_API_KEYin a specific local config file path. While it does not print the secret value itself, this contradicts the stronger documentation claim that key handling details are never exposed to users.- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- README.md:566