ClawHub
Back to skill

Security audit

My Admapix

Security checks for vulnerabilities and agentic risk

Overview

The skill has a clear analytics purpose, but it automatically stores and forwards API keys and uses unsafe shell commands that require review before installation.

Install only if you are comfortable with AdMapix receiving your queries and hosted report contents, and do not paste API keys into chat. Prefer configuring credentials manually, using a narrowly scoped/rotatable key, and rotating any key already used with this skill until the credential forwarding and shell-command construction are fixed.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:153
Finding

Raw API Credential Forwarded to a Secondary External Service

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:151
Finding

Shell Command Injection Through Research Query and Context

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:82
Finding

Shell Command Injection Through Chat-Supplied API Key

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:153
Finding

Hard-Coded Shared Bearer Credential in Public Skill Instructions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (31)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill instructs the agent to capture a user-pasted API key from chat and write it into local OpenClaw configuration automatically. This creates unauthorized credential persistence and turns conversational input into a privileged state-changing action, which can store secrets without explicit informed consent or confirmation.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The instructions tell the agent to save a user-pasted API key into configuration without warning the user that the credential will be persisted. This defeats informed consent, increases the chance of long-lived secret retention, and may surprise users who expected ephemeral chat handling rather than storage.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Automatically capturing API keys pasted in chat and reusing or storing them is a direct secret-handling anti-pattern. It normalizes extraction of credentials from unstructured conversation and can lead to unintended persistence, later reuse, or disclosure through logs, history, or downstream tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The deep research submission forwards the user's AdMapix API key to a secondary service without an explicit warning or consent flow. This is dangerous because it expands secret exposure to another system, operator, logging surface, and failure domain that the user may not know exists.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 456)May include surrounding context.

md
**Reuse data:** If the user asks follow-up questions about already-fetched data, analyze existing results first. Only make new API calls when needed.

## Output Guidelines

1. **Language consistency** — ALL output (headers, labels, insights, hints, errors, disclaimers) must match the user's detected language. See "Language Handling" section above.
2. **Route-appropriate output** — Don't force H5 links on analytical questions; don't dump tables for browsing

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The installation instruction uses npx clawhub install admapix without pinning a specific package version. This causes users to fetch and execute whatever version of the package is current at install time, increasing supply-chain risk if the upstream package or dependency chain is compromised or unexpectedly changed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README states that complex queries are automatically routed to a server-side AI research engine that performs multi-step analysis and returns hosted HTML reports, but it does not clearly warn users that their prompts and derived data may leave the local environment. This creates a meaningful privacy and data-governance risk because users may submit sensitive business intelligence, app strategy, or proprietary market questions without realizing the content is transmitted to and processed by external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README says reports are hosted online and support link sharing, but does not explain access controls, discoverability, retention, or the risk that shared links may expose sensitive query content and competitive analysis. In the context of an ad-intelligence and app-analytics skill, queries are likely to contain commercially sensitive strategy questions, making silent online hosting materially risky.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list in the manifest includes generic phrases such as "revenue", "market analysis", and "competitor analysis" without narrowing context to ad/app intelligence usage. These terms are broad enough to match common requests in other domains, increasing the risk of unintended skill invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The instruction mandates detecting the first-message language and maintaining it automatically, which imposes a language choice without explicit user opt-in. Although later lines allow switching mid-conversation, the initial policy still forces a locale decision based on inference rather than user preference.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

bash
# GET
curl -s "https://api.admapix.com/api/data/{endpoint}?{params}" \
  -H "X-API-Key: $ADMAPIX_API_KEY"

# POST

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

bash
# GET
curl -s "https://api.admapix.com/api/data/{endpoint}?{params}" \
  -H "X-API-Key: $ADMAPIX_API_KEY"

# POST

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

bash
# GET
curl -s "https://api.admapix.com/api/data/{endpoint}?{params}" \
  -H "X-API-Key: $ADMAPIX_API_KEY"

# POST

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

bash
# GET
curl -s "https://api.admapix.com/api/data/{endpoint}?{params}" \
  -H "X-API-Key: $ADMAPIX_API_KEY"

# POST

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill routes user queries to a separate deepresearch.admapix.com service that is outside the primary declared API scope, expanding the trust boundary. More importantly, the design later passes the user's API key to that secondary service, so this is not just analytics orchestration but credential-bearing delegation to another endpoint.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

Run this command first to verify the API key is valid:

bash
curl -s -o /dev/null -w "%{http_code}" https://api.admapix.com/api/data/quota -H "X-API-Key: $ADMAPIX_API_KEY"
  • If it returns 200 → key is valid, proceed to Step 1.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The instructions at the end of the file say 'Never output ... upstream URLs, or internal implementation details' (L466), yet these lines explicitly direct the skill to append a deepresearch.admapix.com report URL to the user response. That is an active contradiction between the documentation and the prescribed behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 341)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 381)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-creative.md (reported line 123)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-creative.md (reported line 140)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-creative.md (reported line 178)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-creative.md (reported line 192)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/api-creative.md (reported line 193)May include surrounding context.

md
"playHtmlFp": [],
      "playHtmlUrl": [],
      "demoadCnt": 1,
      "appList": [
        {
          "id": "6498883328",
          "cnt": null,

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:155