OpenQuok Core

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:32 AM UTC
• Version: 1.0.7

Overview

The skill mostly matches a social scheduling tool, but it automatically takes over new-session greetings and checks/reveals OpenQuok auth and workspace status before the user asks for an OpenQuok action.

Install only if you want an always-available OpenQuok assistant that can use the terminal-backed OpenQuok CLI. Before use, be aware it may check and disclose your OpenQuok authentication state and workspace name at new-session start, and its examples can schedule or delete posts, publish comments, configure automated engagement, and act from other connected social accounts. Verify workspace, integration IDs, post IDs, privacy settings, and acting accounts before allowing commands to run.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:11
• Finding: Automatic Session Instruction and Persona Hijacking## Vulnerability Details **File Location**: `SKILL.md`, lines 11 and 21–48; duplicated behavior in `resources/command-reference.md`, line 43 **Vulnerability Type**: T01: Skill Instruction Hijacking **Risk Level**: High ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"📮","always":true,"requires":{"bins":["openquok"]},"homepage":"https://www.npmjs.com/package/@openquok/auto-cli"},"hermes":{"tags":["social-media","openquok","scheduling"],"category":"social-media","requires_toolsets":["terminal"]},"grok-bot":{"tags":["social-media","openquok","scheduling"],"category":"social-media","requires_toolsets":["terminal"],"workspace_skill_path":"/workspace/openquok-core/SKILL.md"},"thinkrail":{"tags":["social-media","openquok","scheduling"],"category":"social-media","requires_toolsets":["terminal"],"skill_paths":["~/.pi/agent/skills/openquok-core/SKILL.md",".pi/skills/openquok-core/SKILL.md"]}} ``` ```markdown **On that turn only:** use the OpenQuok bot voice below instead of a generic host welcome. Do **not** reuse this block on later turns. **One message only.** Run shell (below), then send **exactly one** assistant message. Forbidden on this turn: - A persona line before tools (e.g. “Hello, … I’m Atlas … What should we focus on?”). - A second message with only CLI version (e.g. “The OpenQuok CLI version is 0.0.6.”). - Repeating the host greeting after the system “new session started” line. **Shell (before any user-visible text):** ```bash openquok --version openquok auth:status ``` If `auth:status` shows `"connected": true`, also run `openquok auth:workspace`. **Required opening sentence (verbatim start):** `Hi, I am the OpenQuok bot.` **Same message must also include:** 1. Installed CLI version from `openquok --version`. 2. If the user may be on an old build: note that skill install does not upgrade the CLI and offer to walk through upgrade using the CLI package page — only after they agree. 3. Auth: if connected, say you are authenticated and na ...[truncated 2930 chars]
• Remediation: ## Remediation Suggestions 1. Remove `always:true` so the Skill activates only when the user explicitly requests OpenQuok functionality. 2. Delete mandatory persona replacement, exact-message-count rules, forbidden host greetings, and verbatim opening text. 3. Do not run `auth:status` or `auth:workspace` during a generic session opening. 4. Perform authentication checks only immediately before an operation that requires OpenQuok API access. 5. Ask for user confirmation before initiating login or revealing account or workspace context. 6. Avoid including `workspace.name` in responses unless it is needed to disambiguate the requested operation. 7. Preserve the host agent’s system-level persona and response policies rather than attempting to override them from Skill content. 8. Retain the existing shell-safety guidance and restrict terminal access to fixed `openquok` subcommands with validated arguments. 9. Document the CLI’s credential location only as operational reference; do not instruct the agent to read, copy, print, or transmit the credential file directly.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Credential Access

High

• Category: Privilege Escalation

Content

- Tokens: [OpenQuok dashboard](https://www.openquok.com/) → **Settings → Developers → Access** → **Generate / Rotate token** (shown once).
- Never invent verification URLs, user codes, or `device_code` — only values from `auth:login --json --no-poll` stdout.
- Do **not** use `auth:login --json` alone on Telegram/Hermes; the host stops the shell after the first JSON and `~/.openquok/credentials.json` is never written.
- Disk credentials in `~/.openquok/credentials.json` take precedence over `OPENQUOK_API_KEY` until `auth:logout`.
- Workspace context: `openquok auth:workspace` → `{ workspace: { id, name } }`.
- Optional: `OPENQUOK_API_URL`, `OPENQUOK_AUTH_SERVER` (local dev: `http://localhost:3111`).

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

- Tokens: [OpenQuok dashboard](https://www.openquok.com/) → **Settings → Developers → Access** → **Generate / Rotate token** (shown once).
- Never invent verification URLs, user codes, or `device_code` — only values from `auth:login --json --no-poll` stdout.
- Do **not** use `auth:login --json` alone on Telegram/Hermes; the host stops the shell after the first JSON and `~/.openquok/credentials.json` is never written.
- Disk credentials in `~/.openquok/credentials.json` take precedence over `OPENQUOK_API_KEY` until `auth:logout`.
- Workspace context: `openquok auth:workspace` → `{ workspace: { id, name } }`.
- Optional: `OPENQUOK_API_URL`, `OPENQUOK_AUTH_SERVER` (local dev: `http://localhost:3111`).

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

| Variable | Required | Default | Description |
|----------|----------|---------|-------------|
| `OPENQUOK_API_KEY` | No* | — | Bearer `opo_` programmatic access token |
| `OPENQUOK_API_URL` | No | `https://api.openquok.com` | API base (`{OPENQUOK_API_URL}/api/v1/...`) |
| `OPENQUOK_AUTH_SERVER` | No | `https://cli-auth.openquok.com` | OAuth2 device-flow server (`/device/*`, `/health`) |

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: openquok-core
description: >-
  Schedule and manage social posts with the openquok CLI — authenticate, upload media, create drafts and scheduled posts, configure internal plugs, and read channel analytics for integrations in your OpenQuok workspace.
homepage: https://www.npmjs.com/package/@openquok/auto-cli
version: 1.0.0
license: MIT

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

compatibility: Requires the global openquok CLI on PATH (see homepage). Installing this skill does not add the binary.
prerequisites:
  commands: [openquok]
metadata: {"openclaw":{"emoji":"📮","always":true,"requires":{"bins":["openquok"]},"homepage":"https://www.npmjs.com/package/@openquok/auto-cli"},"hermes":{"tags":["social-media","openquok","scheduling"],"category":"social-media","requires_toolsets":["terminal"]},"grok-bot":{"tags":["social-media","openquok","scheduling"],"category":"social-media","requires_toolsets":["terminal"],"workspace_skill_path":"/workspace/openquok-core/SKILL.md"},"thinkrail":{"tags":["social-media","openquok","scheduling"],"category":"social-media","requires_toolsets":["terminal"],"skill_paths":["~/.pi/agent/skills/openquok-core/SKILL.md",".pi/skills/openquok-core/SKILL.md"]}}
---

<!-- SPDX-FileCopyrightText: 2026 Rati Montreewat -->

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The markdown documents `openquok posts:delete <post-id>` as a management action, but the surrounding text does not warn that deleting a post row may remove scheduled or draft content and may be irreversible. For markdown files, safety-impacting behaviors should include a clear warning when they can affect user data or system state.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The example contains contradictory posting guidance: the structured setting uses `privacy_level: SELF_ONLY`, while the freeform note instructs the user to change privacy to public before publishing. In a scheduling/publishing skill, this mismatch can easily cause operators or downstream automations to publish content more broadly than intended, leading to accidental disclosure or reputational harm.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: This markdown file provides runnable commands that create Facebook posts and scheduled follow-up comments, which can affect public-facing user data and reputation. The examples do not include any explicit warning that execution will publish content to a managed Facebook Page or that follow-up comments may be posted automatically after delay.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The documentation enables automated actions from other connected channels in the same workspace, including comments, reposts, and reshares, but does not pair that capability with clear consent, authorization, or abuse-prevention guidance. In a social-posting skill, this can lead to unintended cross-account activity, reputation damage, or misuse of linked accounts if a user or downstream agent configures plugs without fully understanding the blast radius.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The markdown documents `openquok plugs:delete <plug-id>` as a removal action, but it does not include any warning that the command deletes an existing rule or that the action may be irreversible. Under the markdown-file criteria, destructive operations that could affect user configuration should be accompanied by a brief warning about their impact.

Static analysis

No suspicious patterns detected.