T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:39- Finding
Mandatory ingestion and external transmission of sensitive local profile data
- Content
View full analysis
- Remediation
View remediation
Security audit
duo
Security checks for vulnerabilities and agentic risk
Overview
This skill needs review because it can read broad local profile and memory files, then send sensitive relationship details to an external matchmaking API without clear opt-in or payload review.
Install only if you are comfortable with this skill reading local OpenClaw profile, memory, identity, and tooling files and sending derived relationship, financial, family, religion, location, and other private details to the NDAI endpoint. Before use, require per-file and per-category permission, review the exact payload before any create or join call, avoid including secrets or third-party information, and use a narrowly scoped API key.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:271- Finding
Bearer credentials and sensitive matchmaking profiles exposed through command-line arguments
- Content
View full analysis
" \ -H "Content-Type: application/json" \ -d '{ "description": "Private relationship compatibility negotiation", "instructions": "", "whitelist": [ {"username": "", "max_entries": 5} ], "is_private": false }' ``` The same credential-handling pattern is also prescribed for joining rooms and querying room or session information: ```bash curl -s -X POST "$NDAI_BASE_URL/rooms//join" \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{ "instructions": "" }' ``` ### Technical Analysis The documented commands interpolate both the bearer API key and the sensitive request body directly into `curl` arguments. On systems where process arguments are observable, these values may appear in process listings, process-monitoring systems, audit records, debugging traces, shell execution logs, or agent tool logs. The request body is particularly sensitive because the Skill directs it to contain relationship criteria and a derived self-profile, potentially including financial, family, location, employment, education, religious, lifestyle, and marital information. The instruction not to print or persist API keys does not prevent exposure through the process argument vector. The use of HTTPS protects network transport but does not address local command-line disclosure. ### Attack Path 1. The agent substitutes a real bearer token for ``. 2. It substitutes the compiled private profile for ``. 3. A shell launches `curl` with the authorization header and JSON body in its process arguments. ...[truncated 1100 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly requires deriving the agent's relationship profile from local OpenClaw files before compiling instructions, which turns local context into a source of outbound sensitive data. In a matchmaking workflow, this is especially dangerous because the derived content is intentionally intimate and may include information far beyond what the user just provided in chat.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs collection and transmission of highly sensitive personal data—religion, finances, family background, health-adjacent details, relationship goals, and deal-breakers—to an external API, but does not require an explicit user-facing warning or informed consent before sending it. Because the workflow defaults to including sensitive-but-relevant context, users may unknowingly disclose intimate information outside the local environment.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
These instructions tell the agent to read local files and use them to derive sensitive self-information for negotiation, including finances, religion, family, and other intimate constraints, then include that material in outbound private instructions. Mining local files for unrelated secrets or profile data without strict minimization and explicit consent creates a direct confidentiality risk and can exfiltrate information the user never intended to share.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The template formalizes embedding a private self-profile sourced from local files into the negotiation instructions, including sensitive context like income buckets, assets/debt, marital history, and personal constraints for ongoing counterpart questioning. This operationalizes persistent external disclosure of local sensitive data and expands the blast radius because the remote service can use that profile throughout the session.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The invocation description is broad enough to match routine requests like registering, joining rooms, listing sessions, or checking status without clearly signaling that the skill performs sensitive matchmaking and external data transmission. Over-broad triggering increases the chance the agent activates this skill in contexts where the user did not intend to share personal relationship criteria or local profile data.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Use when the user asks to join/register Duo.
bash curl -s -X POST "$NDAI_BASE_URL/register" \ -H "Content-Type: application/json" \ -d '{"username":"<username>"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 99% confidence
- Finding
The room creation call sends compiled instructions to an external NDAI endpoint, and elsewhere the skill defines those instructions to include highly sensitive relationship criteria and a self-profile derived from local files. In context, this is not a harmless API call but the concrete exfiltration point for intimate personal and locally sourced data, making the transmission materially dangerous.
- Content
Step 4: Call NDAI
/rooms/createbash curl -s -X POST "$NDAI_BASE_URL/rooms/create" \ -H "Authorization: Bearer <api_key>" \ -H "Content-Type: application/json" \ -d '{