T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/limesurvey_client.py:31- Finding
Sensitive credentials and survey data may be transmitted without enforced TLS
- Content
View full analysis
- Remediation
View remediation
Security audit
Limesurvey Openclaw Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it says, but it can handle sensitive survey data and send or change live survey content with weak guardrails.
Review this carefully before installing. Use only a dedicated least-privilege LimeSurvey service account, require an HTTPS RemoteControl endpoint, avoid copying the admin examples, and treat response exports and participant files as sensitive data. Confirm survey IDs and recipient scopes before activation, deletion, invitations, or reminders.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (22)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python p_add = subparsers.add_parser('add-participants', help='Add participants to survey') p_add.add_argument('survey_id', type=int, help='Survey ID') p_add.add_argument('--file', help='JSON file with participant data (default: stdin)') p_add.add_argument('--create-token', action='store_true', default=True, help='Create access tokens') p_add.set_defaults(func=cmd_add_participants) # invite-participants
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md [](https://opensource.org/licenses/MIT) [](https://openclaw.ai) [](https://api.limesurvey.org/) ## Features
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md [](https://opensource.org/licenses/MIT) [](https://openclaw.ai) [](https://api.limesurvey.org/) ## Features
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md [](https://opensource.org/licenses/MIT) [](https://openclaw.ai) [](https://api.limesurvey.org/) ## Features
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md [](https://opensource.org/licenses/MIT) [](https://openclaw.ai) [](https://api.limesurvey.org/) ## Features
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README advertises destructive and privacy-impacting capabilities such as deleting/importing surveys, sending invitations/reminders, and exporting responses without clear warnings, approval expectations, or data-handling cautions. In an agent skill context, this can lead operators to invoke high-impact actions without appreciating the consequences for participant privacy, survey integrity, or accidental bulk messaging.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The README explicitly instructs users to set LIMESURVEY_USER='admin' and a password, which contradicts the stated least-privilege requirement in the skill metadata. In a skill that can export responses, delete/copy/import surveys, and send participant communications, encouraging full admin credentials materially increases blast radius if the skill is misused, compromised, or invoked on the wrong target.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The Python API examples again normalize use of an 'admin' account and password in code snippets, reinforcing insecure operational practice. Because this skill automates sensitive survey, participant, and response operations, examples are likely to be copied directly into production workflows, resulting in unnecessary privileged access and increased risk of data exposure or destructive changes.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill requires environment access, network access, and local file read/write behavior, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, that omission weakens least-privilege controls and makes it easier for the skill to be invoked with broader capabilities than users expect.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Using admin credentials in the quick-start materially increases the danger of all subsequent survey, participant, and response operations. In this skill's context, broad API access can expose sensitive response data, alter live surveys, send participant communications, or delete records if the account is misused or compromised.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The invitation and reminder examples can trigger real outbound communications to survey participants, but the documentation does not warn about user-consent, production-vs-test separation, or accidental bulk sends. This creates operational and privacy risk, especially if run against live surveys with broad permissions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill demonstrates exporting survey responses and writing them to a local file without warning that survey responses may contain sensitive personal or research data. In practice, this can lead to unintended local persistence, insecure sharing, or mishandling of regulated data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file documents permanently destructive actions such as deleting a survey, but it does not include any warning about data loss, irreversibility, or the need to verify the target before execution. Under the markdown-file criteria, descriptions should warn about behaviors that could affect user data or system integrity.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The documentation describes exporting survey responses, which can expose respondent data, but it does not warn readers about privacy, access control, or careful handling of exported files. For markdown documentation, data-affecting behaviors should include warnings when they may impact privacy or user data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The participant-management examples process email addresses, names, custom attributes, and invitation workflows without warning about privacy obligations or the operational risk of bulk email actions. Because these snippets normalize importing participant data and sending invitations/reminders, users may perform mass outreach or expose participant data without proper authorization, notice, or rate limiting.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
These examples export potentially sensitive survey responses and persist them to local files without any warning about personal data, consent, retention, access controls, or secure storage. In a survey automation skill, response exports are expected functionality, but documenting them without privacy guardrails can lead users to mishandle PII or confidential research data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code submits participant records loaded from a file or stdin to a network API, which can include personal data such as email addresses. Although the function name implies adding participants, there is no confirmation prompt, visible disclosure, or warning in surrounding output/comments that user data will be transmitted to the server.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Inviting participants is an externally visible and potentially irreversible action because it causes emails to be sent. The code performs the API call and only prints the result afterward, with no prior confirmation prompt, warning, or explanatory notice about the impact.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Activating a survey changes remote system state and may make the survey live to respondents, which can have significant operational impact. The code executes the activation directly and only reports status afterward, without a pre-execution warning, confirmation, or comment documenting the risk.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The quick-start instructions tell users to set LIMESURVEY_USER to 'admin', directly contradicting the earlier least-privilege guidance. This encourages unsafe deployment patterns and increases the blast radius if the credential is exposed or the skill is misused.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The Python example authenticates as 'admin' with a plaintext password placeholder, normalizing use of highly privileged credentials in code snippets. Even as sample code, this can lead users to copy insecure patterns into automation and operational scripts.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
The file documents invitation and reminder email functions, which can contact real participants and affect user experience, but it provides no warning about verifying recipient scope or avoiding unintended bulk sends. In markdown skill documentation, externally impactful behaviors should be disclosed when they can affect users or operations.
- Content
Static analysis
No suspicious patterns detected.