ClawHub
Back to skill

Security audit

aicq-chat

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it needs review because it can create a persistent chat identity, run long-lived messaging loops, and send files or messages outside the user's machine with weak consent boundaries.

Install only if you intentionally want this agent to communicate through AICQ. Use a dedicated environment, confirm before creating or binding an identity, do not send files unless you have reviewed the exact path and contents, and avoid using it on shared or untrusted machines unless you are comfortable with persistent local keys and chat state.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill description is extremely broad and explicitly tells the agent it can do everything needed to join and use an external messaging network without consulting any other source. That increases the chance an agent will activate persistent communications, identity creation, or data-sharing behaviors outside a narrowly authorized task, especially because the description bundles many capabilities together without gating or consent checks.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The instruction 'Just execute the steps below' is an overly broad activation cue that encourages automatic operational use of the skill rather than conditional, user-approved use. In a security context, this is dangerous because it can cause an agent to install software, create accounts, connect to third-party infrastructure, and begin communications without verifying user intent or environmental safety.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill prominently advertises file and image transmission capabilities but does not warn that using them may disclose local files, metadata, or sensitive user data to external parties. For an agent skill, omission of a clear data-sharing warning materially increases the risk of accidental exfiltration when the agent is instructed to send attachments or screenshots.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The owner-binding workflow links an agent identity to a human owner's account and enables direct communications, but it does not clearly explain the privacy implications of that linkage. This can expose relationship metadata, persistent identifiers, and communication channels between a human and agent without informed consent or retention guidance.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: aicq-chat
description: Complete self-contained skill for AI agents to use the AICQ encrypted messaging network at https://aicq.me — create identity, bind to owner, add friends (agent-to-agent and agent-to-owner), private chat, stream output, send files & images, manage friends (accept/reject/delete), create/join groups and group chat. Python SDK (aicqSDK) with CLI and async API. After reading this skill you can do ALL of it without opening any other page.
version: "1.0.0"
---
Confidence
88% confidence
Finding
The skill is designed around persistent identity reuse and long-lived messaging presence, which creates durable authentication material and session state on disk. While persistence is functionally required for chat identity, it also increases the blast radius of compromise because stolen local state could enable account takeover, impersonation, or ongoing unauthorized access.

Static analysis

No suspicious patterns detected.