ClawHub
Back to skill

Security audit

QXMP Oracle

Security checks for vulnerabilities and agentic risk

Overview

This skill is a read-only QXMP oracle lookup guide that uses disclosed public API and blockchain calls without credentials, persistence, or local data access.

Install this if you are comfortable with the agent contacting QXMP/QELT services to answer asset and proof questions. Avoid treating returned valuation data as financial advice, and avoid putting confidential business context into asset lookup prompts if third-party request metadata is a concern.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Self-Modification

High
Category
Rogue Agent
Content
## Adding New Assets or Endpoints

Update SKILL.md when new assets or API endpoints are added to the QXMP Oracle.
- Keep the asset types and jurisdictions table accurate
- Add new endpoints in the correct category with working curl examples
Confidence
85% confidence
Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

External Transmission

Medium
Category
Data Exfiltration
Content
1. Test the API call directly in your terminal:
   ```bash
   curl -fsSL "https://api.qxmp.ai/api/v1/rwa/health"
   ```

2. Check if the oracle proof is within its 24-hour update window.
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
The QXMP Oracle is a custom oracle infrastructure (not Chainlink or RedStone) providing cryptographically verified real-world asset data on the QELT blockchain. It manages **12 tokenized mining projects** worth **$1.17 trillion USD** in certified in-ground mining assets — all on-chain.

**API Base URL:** `https://api.qxmp.ai/api/v1/rwa`
**Auth:** None required — fully public API
**CORS:** Enabled — works from any browser
**Update frequency:** Oracle proofs update ~once per 24 hours
Confidence
93% confidence
Finding
The skill directs the agent to send network requests to an external domain, which creates an external data exfiltration and trust-boundary risk. Even though the API is described as public and read-only, using it can disclose user queries or agent activity to a third party and introduces reliance on unverified remote content that could be manipulated.

External Transmission

Medium
Category
Data Exfiltration
Content
### Health Check

```bash
curl -fsSL "https://api.qxmp.ai/api/v1/rwa/health"
```

### Get All Assets (primary endpoint)
Confidence
91% confidence
Finding
This health-check example causes the agent to contact an external host, which is a real outbound network action and therefore an external transmission risk. While low sensitivity by itself, it still reveals agent usage patterns and normalizes execution of third-party requests from within the skill.

External Transmission

Medium
Category
Data Exfiltration
Content
### Get All Assets (primary endpoint)

```bash
curl -fsSL "https://api.qxmp.ai/api/v1/rwa/assets?page=1&limit=100"
```

Key fields per asset:
Confidence
94% confidence
Finding
The primary workflow instructs fetching asset data from an external API, so the skill's core behavior depends on transmitting requests outside the local trust boundary. This is risky because prompts, timing, identifiers, or future parameterized inputs may be exposed to the API operator, and returned data may influence downstream agent responses.

External Transmission

Medium
Category
Data Exfiltration
Content
### Get Single Asset

```bash
curl -fsSL "https://api.qxmp.ai/api/v1/rwa/assets/QXMP:RHENO-JORC-ZA"
```

Returns full asset details including `onChain` data and `proofHistory[]`.
Confidence
92% confidence
Finding
Fetching a specific asset by code is another direct outbound request to a third-party service. If user-provided asset identifiers are inserted into requests, the external operator can observe user interests and activity, and malformed or unexpected identifiers could increase operational risk if not sanitized by the calling layer.

External Transmission

Medium
Category
Data Exfiltration
Content
### Get Portfolio Statistics

```bash
curl -fsSL "https://api.qxmp.ai/api/v1/rwa/stats"
```

Returns `totalAssets`, `totalValue`, `averageValue`, `byType[]`, `byJurisdiction[]`.
Confidence
91% confidence
Finding
The stats endpoint is another example of mandatory external communication to an untrusted remote service. Although the request appears simple, it still leaks usage metadata and makes the agent dependent on externally controlled content that could be stale, misleading, or maliciously altered.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Check for 429 and respect Retry-After
response=$(curl -sI "https://api.qxmp.ai/api/v1/rwa/assets")
if echo "$response" | grep -q "HTTP/.*429"; then
  retry=$(echo "$response" | grep -i "retry-after" | awk '{print $2}' | tr -d '\r')
  echo "Rate limited. Waiting ${retry}s..."
Confidence
89% confidence
Finding
The rate-limit handling snippet performs a header request to the same external service, which remains an outbound transmission and adds automated retry behavior. Automated polling/retry logic can amplify information leakage about agent behavior and increase operational exposure to a third-party endpoint.

External Transmission

Medium
Category
Data Exfiltration
Content
Returns: (uint256 value, uint256 timestamp, address submitter, uint256 blockNumber)
```

**Example using curl + eth_call:**

```bash
# Asset code = keccak256("QXMP:RHENO-JORC-ZA")
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.