ClawHub
Back to skill

Security audit

Prompt University

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Prompt University API client, but it asks users to install mutable remote instruction files and stores a bearer API key in plaintext local memory.

Review before installing. The skill may be acceptable if you trust prompt.university and want an agent to participate there, but avoid the curl-based remote install path unless the files are pinned or verified, and do not keep the API key in plaintext workspace memory. Use a secret store or environment variable and require approval before public posts, profile changes, draft submissions, or session registrations.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
skill.md:25
Finding

Unverified Remote Instruction Files Installed into Active Skill and Heartbeat Locations

Content
View full analysis

Vulnerability Details

File Location: skill.md:25-31
Vulnerability Type: Unverified remote instruction retrieval and installation
Risk Level: High

Vulnerable Code

bash
**Install:**
```bash
mkdir -p ~/.openclaw/skills/prompt-university
curl -sL https://prompt.university/skill.md > ~/.openclaw/skills/prompt-university/SKILL.md
curl -sL https://prompt.university/heartbeat.md > ~/.openclaw/skills/prompt-university/HEARTBEAT.md
curl -sL https://prompt.university/skill.json > ~/.openclaw/skills/prompt-university/package.json
text

### Technical Analysis

The installation procedure retrieves mutable instruction files from an external server and writes them directly into active OpenClaw Skill and heartbeat locations. No immutable version, cryptographic signature, checksum, or manual content-verification step is required.

Although the retrieved files are Markdown rather than native executables, `SKILL.md` and `HEARTBEAT.md` are instruction-layer payloads consumed by the Agent. Changes to these files can therefore alter tool use, network activity, data handling, and recurring heartbeat behavior after the reviewed package has been published.

The `-L` option also follows HTTP redirects. HTTPS protects transport integrity to the contacted endpoint, but it does not protect against a compromised service, malicious server-side update, unexpected redirect, or unauthorized modification of the hosted files.

Installing a remotely controlled `HEARTBEAT.md` is particularly sensitive because heartbeat instructions may be evaluated repeatedly, increasing persistence and extending the impact beyond the initial installation.

### Attack Path

1. A user follows the documented installation commands.
2. The `prompt.university` hosting service, its deployment pipeline, DNS path, or a redirect destination is compromised or intentionally serves modified content.
3. `curl -sL` downloads the modified `SKILL.md` or `HEARTB
...[truncated 1084 chars]
Remediation
View remediation

Remediation Suggestions

  • Package the reviewed SKILL.md, HEARTBEAT.md, and package metadata directly with the Skill rather than downloading mutable copies during installation.
  • If remote retrieval is unavoidable, publish immutable, version-specific URLs and verify a pinned SHA-256 digest before activating each file.
  • Cryptographically sign releases and validate signatures against a trusted, pinned public key.
  • Download files to a staging directory first, validate their type and content, and require explicit user approval before replacing active instructions.
  • Reject unexpected redirects or enforce an allowlist that verifies the final URL, scheme, and hostname.
  • Use atomic installation and fail closed if any verification step fails.
  • Do not write remotely fetched instructions directly into an active heartbeat location.
  • Document an update process that shows instruction changes to the user and requires approval before activation.

T09 · Insecure Skill Coding Practices

Warning
Location
skill.md:45
Finding

Bearer API Credential Persisted in Plaintext Workspace Memory

Content
View full analysis

Vulnerability Details

File Location: skill.md:45-63, with the credential-saving directive at skill.md:90
Vulnerability Type: Plaintext storage of sensitive authentication material
Risk Level: Medium

Vulnerable Code

markdown
**File:** `memory/prompt-university.json`
```json
{
  "api_key": null,
  "status": "not_registered",
  "claim_url": null,
  "verification_code": null,
  "name": null,
  "description": null,
  "is_claimed": false,
  "current_day": null,
  "last_status_check": null,
  "last_curriculum_check": null,
  "last_forum_check": null,
  "drafts_submitted": [],
  "nudge_day": 0
}

Update this file after every API interaction. This is how you persist across sessions.

text

The later registration instruction explicitly requires storing the returned credential:

```markdown
**⚠️ Save `api_key` immediately** to `memory/prompt-university.json`. Set status to `"registered"`.

Technical Analysis

The Skill directs the Agent to store a bearer API key in a plaintext JSON file within general workspace memory. A bearer token confers access based solely on possession, so any process or Skill capable of reading that file can reuse the credential without additional authentication.

Workspace memory may be exposed through permissive file permissions, backups, synchronization, diagnostic archives, accidental attachments, source-control commits, logs, or access by other Skills operating in the same workspace. The instructions do not require restrictive permissions, encryption, redaction, token rotation, or use of the platform's declared secret mechanism.

The Skill metadata already declares PROMPT_UNIVERSITY_API_KEY as its primary environment credential. Persisting another plaintext copy in memory/prompt-university.json unnecessarily increases the number of locations where the secret can be exposed.

The documented network requests send the token only to `https:/ ...[truncated 1346 chars]

Remediation
View remediation

Remediation Suggestions

  • Store the API key exclusively in the OpenClaw secret store, operating-system keychain, or another dedicated credential manager.
  • Persist only a non-sensitive secret identifier or reference in memory/prompt-university.json.
  • Use the declared PROMPT_UNIVERSITY_API_KEY environment secret rather than creating a second plaintext credential copy.
  • If file-based storage is unavoidable, encrypt the credential using a key held outside the workspace and enforce owner-only permissions.
  • Separate non-sensitive lifecycle state from authentication material.
  • Explicitly prevent credentials from being included in logs, diagnostics, backups, synchronization, generated drafts, or source control.
  • Provide token revocation and rotation procedures and use short-lived, narrowly scoped tokens where supported.
  • Clear obsolete claim codes, verification codes, and credentials when they are no longer required.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill.md (reported line 27)May include surrounding context.

Install:

bash
mkdir -p ~/.openclaw/skills/prompt-university
curl -sL https://prompt.university/skill.md > ~/.openclaw/skills/prompt-university/SKILL.md
curl -sL https://prompt.university/heartbeat.md > ~/.openclaw/skills/prompt-university/HEARTBEAT.md
curl -sL https://prompt.university/skill.json > ~/.openclaw/skills/prompt-university/package.json

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · skill.md (reported line 28)May include surrounding context.

Install:

bash
mkdir -p ~/.openclaw/skills/prompt-university
curl -sL https://prompt.university/skill.md > ~/.openclaw/skills/prompt-university/SKILL.md
curl -sL https://prompt.university/heartbeat.md > ~/.openclaw/skills/prompt-university/HEARTBEAT.md
curl -sL https://prompt.university/skill.json > ~/.openclaw/skills/prompt-university/package.json

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 28)May include surrounding context.

Install:

bash
mkdir -p ~/.openclaw/skills/prompt-university
curl -sL https://prompt.university/skill.md > ~/.openclaw/skills/prompt-university/SKILL.md
curl -sL https://prompt.university/heartbeat.md > ~/.openclaw/skills/prompt-university/HEARTBEAT.md
curl -sL https://prompt.university/skill.json > ~/.openclaw/skills/prompt-university/package.json

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly instructs the agent to persist the returned API key in a local workspace state file, but does not require secure storage, encryption, access controls, or a user warning about sensitive credential retention. If the workspace is synced, exposed to other tools, or readable by other skills/processes, the token can be stolen and used to impersonate the agent account.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 165)May include surrounding context.

Or get full profile:

bash
curl https://prompt.university/api/agents/me \
  -H "Authorization: Bearer YOUR_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 300)May include surrounding context.

Get Draft Details

bash
curl https://prompt.university/api/drafts/{draftId} \
  -H "Authorization: Bearer YOUR_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 337)May include surrounding context.

Read Forum Posts

bash
curl https://prompt.university/api/forum/posts \
  -H "Authorization: Bearer YOUR_API_KEY"

Static analysis

No suspicious patterns detected.