proxq

• Outcome: Review
• Latest audit: Nov 10, 2026 · 9:25 AM UTC
• Version: 0.11.5

Overview

ClawScan marks this skill suspicious because its setup instructions use an unpinned Docker image and include commands beyond the declared shell permissions; the scan is partial, so the evidence is incomplete.

Consider the suspicious verdict and Skillspector's high-risk, do-not-install recommendation before installing. The confirmed concern is the unpinned Docker image; the scan also reports an instruction-scope mismatch. Skillspector inspected two components but marked analysis partial because a referenced local path was missing. The AIG scan completed with no findings, but the overall evidence is incomplete.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: proxq
description: Go, Redis-backed async HTTP proxy queue (built on asynq). POST any HTTP request (any method, any path, any body) to a configured upstream, get a job ID back instantly (202), a worker forwards it later, you poll GET /__jobs/{id} for status (queued/running/completed/failed) and GET /__jobs/{id}/content for the replayed upstream response (status/headers/body). DELETE /__jobs/{id} cancels. Path-prefix routing to multiple upstreams, per-upstream timeout/retries/pathFilter, optional response caching (memory or Redis LRU), automatic direct-proxy bypass for WebSocket/chunked/large-body requests. No built-in auth. Use when the user wants to turn a slow/unreliable backend into a fire-and-forget async API, decouple a client from upstream latency, relay webhooks with retries, or queue heavy uploads/processing jobs behind short-timeout reverse proxies.
homepage: https://github.com/psyb0t/docker-proxq
user-invocable: true
metadata:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

it with a reverse proxy doing auth (basic auth, mTLS, an API gateway) or bind it to loopback/an internal network only. Do not expose a bare proxq instance to the open internet.
- **Trusted upstreams only.** Configure `upstreams[].url` to point only at backends you control or explicitly trust. proxq forwards the full original request (method, headers, body) plus `X-Forwarded-For`/`X-Real-IP`/`X-Forwarded-Proto`, so treat the upstream config the same way you'd treat a reverse-proxy target list.
- **Consumer-only.** This skill talks to an instance you (or your operator) already run and trust. It never provisions, hardens, or reconfigures the server; that's covered in setup.md as an explicit operator step.
- **Cancelling a job.** `DELETE /__jobs/{id}` best-effort stops an in-flight job and deletes its record (no undo). Per the no-auth point above there's no ownership check, so only cancel a job you submitted or one the user explicitly named. Don't guess IDs or bulk-cancel.

## When To Use

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md

{ "openclaw": { "emoji": "🦡", "primaryEnv": "PROXQ_URL", "requires": { "bins": ["curl", "docker"] } } }
permissions:
  network: "outbound HTTP to the configured PROXQ_URL (submit/poll/cancel job calls), AND proxq itself makes arbitrary outbound HTTP requests to whatever upstream/URL you submit through it, on your behalf. That's an SSRF surface: only submit requests you intend proxq's configured upstreams to receive."
  shell: "curl + docker/docker-compose invocations shown in setup.md and this file (container lifecycle, request examples); no other host access"
---

# proxq

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/setup.md (reported line 36)May include surrounding context.

bash

docker compose up -d
curl http://127.0.0.1:8080/__jobs/nonexistent-id   # 404, X-Proxq-Source: proxq → confirms it's up

Docker run (config file mounted from host)

Docker image referenced without tag or digest: 'Docker run (config'.

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Docker image referenced without tag or digest: 'docker run -d'.

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

Although the matched command prefix is not itself an image name, the complete command runs psyb0t/proxq without a tag or digest, implicitly selecting mutable latest. A compromised or unexpectedly changed image could execute unwanted code and access the container's configuration, network, and proxied traffic; the read-only mount and non-root runtime reduce but do not eliminate this risk.

Content

No source excerpt is available for this finding.

The management instructions prescribe make and Go commands outside the declared shell permissions.

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The manifest limits shell access to curl and docker/docker-compose invocations and explicitly permits no other host access. L198–L205 instead instruct running repository Makefile targets and Go tests, including vendoring dependencies and executing local development code; labeling these instructions operator-side does not authorize them under the declared permissions.

Content

No source excerpt is available for this finding.