Security audit

Qinglong Skills

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed QingLong admin skill, but it exposes very powerful panel and host controls without enough guardrails.

Install only if you intentionally want an agent to administer your QingLong panel. Use a dedicated QingLong application with the minimum scopes needed, avoid granting system/scripts/configs/dependencies unless necessary, protect OpenClaw config and shell profile secrets, and require explicit human confirmation before command-run, auth-reset, update/reload, config save, script save/run, dependency install, or delete actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The security note is misleading because the skill can trigger scripts and system commands on the QingLong host, which may in turn access networks, files, credentials, or other services. Claims that it 'does not access external services or exfiltrate data' are unsafe assurances that could lower operator suspicion despite the presence of indirect remote execution capabilities.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: `system command-run --command ...` is a generic remote command-execution primitive on the QingLong host. If invoked with attacker-influenced input, it enables full host-side command execution, potentially leading to data theft, persistence, lateral movement, or complete compromise of the QingLong environment and anything reachable from it.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: `system auth-reset` allows changing panel login credentials, which is a powerful administrative control that can lock out legitimate users or transfer ownership of the panel. In an agent context, exposing this capability without strong scoping and confirmation creates a direct account-takeover risk.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The reference exposes Open API application management, including creating apps and resetting client secrets, which extends beyond ordinary QingLong task management and enables minting or rotating credentials for further access. In a skill intended to manage a QingLong instance, documenting these capabilities materially increases the ability to establish persistence or expand access if the skill or downstream agent is over-permissioned.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: `/system/auth/reset` allows resetting panel authentication credentials, which is a full account-takeover primitive and not necessary for routine cron/env/script management. In the context of a self-hosted automation panel, this could lock out legitimate administrators and hand persistent control of the instance to an attacker or misbehaving agent.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: `/system/command-run` and `/system/command-stop` provide arbitrary command execution on the QingLong host, which is equivalent to remote code execution. Because the skill is framed broadly as panel management, inclusion of raw shell execution makes the context more dangerous: it enables actions far beyond managing jobs, including data theft, persistence, service disruption, and host compromise.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The wrapper exposes high-risk QingLong system APIs for arbitrary command execution (`system command-run`) and credential changes (`system auth-reset`). Even if these endpoints exist in QingLong, surfacing them in a general-purpose skill materially expands the blast radius from panel management into host-level execution and account takeover, which is dangerous in an agent context where user prompts may be ambiguous or manipulated.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The token debug interface exposes authentication internals beyond normal QingLong resource operations, including forced refresh and display of cached token contents. In an agent/tool setting, these commands increase the chance of credential disclosure and misuse without serving core user-facing management needs.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README advertises high-risk QingLong operations such as deleting jobs, modifying environment variables, running scripts, system updates, and auth reset, but provides no warnings about operational impact, privilege scope, or confirmation requirements. In an agent-skill context, this increases the chance that users or agents invoke destructive actions on a live panel without understanding consequences.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README instructs users to store QingLong API credentials in openclaw.json and shell startup files without warning about plaintext secret exposure, file permissions, shell history, backups, or multi-user systems. These credentials can grant broad administrative control over the QingLong panel, so mishandling them can lead to panel compromise.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The CLI reference exposes destructive and irreversible commands including delete, save, dependency install/delete, system reload, command execution, and auth reset, but does not mark them as dangerous or requiring confirmation. Because this is intended for use by AI agents that can execute shell commands, the absence of cautions materially raises the risk of accidental destructive actions on production QingLong instances.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README explicitly advertises high-risk capabilities such as delete, reset password, execute command, update system, and reboot, but does not instruct the operator or calling agent to require confirmation, verify scope, or warn before destructive actions. In an agent skill context, this increases the chance of accidental or prompt-induced destructive operations against a live QingLong instance.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The documentation tells users to store QINGLONG_CLIENT_SECRET in openclaw.json or shell startup files without warning that these locations may be readable by other local users, copied into backups, or exposed through logs and screenshots. Because these credentials grant API access to panel administration functions, compromise of the secret could enable unauthorized management of cron jobs, scripts, environment variables, logs, and system operations.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The CLI reference includes destructive and privileged operations such as cron/env/script/subscription deletion, script execution, dependency installation, command execution, system reload, and auth reset, but presents them as ordinary examples without per-command warnings or confirmation expectations. In a tool meant for AI agents and shell execution, this materially raises the risk of accidental misuse, prompt injection chaining, or operators invoking irreversible commands without understanding the consequences.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger conditions are broad enough to activate on generic requests like viewing logs, adding environment variables, or running scripts whenever the system infers QingLong context. Over-broad auto-invocation increases the chance that a powerful administrative skill is selected unintentionally, exposing destructive operations in situations where a narrower or safer tool should have been used.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The documentation instructs obtaining a token by sending `client_id` and `client_secret` in URL query parameters, which are commonly captured in logs, browser history, proxies, monitoring systems, and referrer data. Even if the upstream API supports this pattern, reproducing it without warning normalizes insecure secret handling and increases credential exposure risk.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The API reference lists numerous destructive and high-impact operations—deletes, runs, stops, updates, imports, exports, reloads, notifications, auth reset, and system update—without any cautions, privilege expectations, or confirmation guidance. In an agent skill, omission of these safeguards increases the chance that an automated system will invoke dangerous operations without sufficient user intent validation, causing outages, data loss, or unauthorized state changes.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The setup guide tells users to place QingLong API credentials directly in shell startup files, which are long-lived plaintext locations that are easy to leak through backups, dotfile sync, shared accounts, terminal history habits, or accidental disclosure. Because these credentials can manage cron jobs, environment variables, scripts, logs, and system operations on the panel, exposure could lead to significant unauthorized access.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The OpenClaw example embeds client ID and client secret directly in a JSON configuration file without warning that the file becomes a sensitive secret store. JSON config files are commonly copied, backed up, or committed by mistake, so this pattern materially increases the chance of credential leakage and subsequent compromise of the QingLong panel API.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The script stores the QingLong bearer token on disk in a predictable cache location without setting restrictive file permissions or warning the user. On multi-user systems or misconfigured environments, local users or other processes could read the token and gain API access to the QingLong panel.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: `token show` prints the cached token object directly, exposing active authentication material in terminal output, logs, transcripts, or agent tool results. In an LLM-integrated environment, that can easily leak secrets to users, conversation history, or downstream systems.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill provides a direct pass-through to QingLong's command execution API using arbitrary user-supplied command strings. In the context of an agent skill, this is highly dangerous because prompt injection, user confusion, or malicious requests can trigger host-level command execution on the QingLong server.

Missing User Warnings

High

Confidence: 94% confidence
Finding: The credential reset operation allows changing panel authentication data without any confirmation step or warning about lockout/account takeover risk. In a tool-mediated workflow, a mistaken or malicious invocation could immediately seize control of the QingLong instance or deny access to legitimate administrators.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.