ClawHub
Back to skill

Security audit

Claw Loudyai Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches Loudy.ai task automation, but its installer, optional cron persistence, and under-disclosed promotion of another posting skill create review-level risk.

Review before installing. Use only a user-scoped install path, avoid curl | bash and unpinned GitHub installs, do not enable the cron option unless you understand how to remove it, and treat any suggestion to install the Binance posting skill as a separate trust decision.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
install.sh:3
Finding

Installation instructions execute a mutable remote script through curl and Bash

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
install.sh:84
Finding

Installer replaces a system-level Skill with an unpinned remote repository revision

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Error
Location
SKILL.md:163
Finding

Optional cron configuration creates durable five-minute execution of installed Skill code

Content
View full analysis
/dev/null; echo "*/5 * * * * $SKILL_DIR/scripts/cron_check.sh") | crontab - ``` ```bash (crontab -l 2>/dev/null; echo "*/5 * * * * /usr/lib/node_modules/openclaw/skills/loudy-ai-auto-task/scripts/cron_check.sh") | crontab - ``` ### Technical Analysis The documentation instructs users to add a cron entry that executes `cron_check.sh` every five minutes across login sessions and system restarts. Scheduling periodic checks is related to the declared automation feature and is disclosed as optional, but the implementation creates a durable execution channel for files installed from a mutable remote repository. The configuration has no executable integrity check, constrained service account, duplicate-entry prevention, or documented removal command. If the installed script is subsequently modified—whether through repository compromise, unsafe reinstallation, or local filesystem access—the modified code is automatically executed by cron. The system path variant can be configured in a privileged user's crontab. In that case, any later compromise of the scheduled script obtains recurring privileged execution. ### Attack Path 1. A user follows the documentation and adds the cron entry. 2. The Skill directory or `cron_check.sh` is later replaced or modified. 3. Cron executes the modified script automatically within five minutes. 4. The malicious script runs repeatedly under the privileges of the crontab owner. 5. The execution continues across future sessions until the cron entry is discovered and removed. ### Impact Assessment The cron entry provides repeated, cross-session code execution. An attacker who can modify the scheduled files can: - Execute arbitrary commands as the crontab owner. - Re-establish d ...[truncated 338 chars]
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
scripts/auto_task_flow.py:135
Finding

Pool display output redirects users and agents to install and invoke an unrelated external Skill

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/cron_check.sh:6
Finding

Scheduled process writes predictable workspace files without symlink or ownership validation

Content
View full analysis
"$LOG_FILE" if [ -f "$LAST_FILE" ]; then if diff -q "$LOG_FILE" "$LAST_FILE" > /dev/null 2>&1; then exit 0 fi fi cp "$LOG_FILE" "$LAST_FILE" echo "NEW_TASKS" > "$WORKSPACE_DIR/loudy_has_new.txt" ``` ### Technical Analysis The scheduled wrapper writes to fixed, predictable paths using shell redirection and `cp`. It does not: - Verify workspace ownership or permissions. - Reject symbolic links. - Create a private state directory. - Set a restrictive `umask`. - Use securely created temporary files. - Perform atomic replacement. Shell redirection and ordinary `cp` can follow symbolic links. If another local user or compromised process can write in the configured workspace, it can pre-create one of these state paths as a symlink to another file writable by the cron owner. The issue becomes more serious if the cron task runs as root while the workspace remains writable by a less-privileged account. ### Attack Path 1. An attacker obtains write access to `OPENCLAW_WORKSPACE` or its default directory. 2. The attacker creates a symbolic link such as `loudy_tasks.json` or `loudy_has_new.txt` pointing to a target file. 3. The scheduled cron job runs under a more privileged account. 4. Shell redirection, `cp`, or `echo` follows the symbolic link. 5. The target is truncated or overwritten with pool output, copied data, or the marker string. Exploitation requires the attacker to have write access to the workspace or the relevant state-file entries. ### Impact Assessment The attacker may overwrite or truncate any file writable by the cron owner. Potential consequences include: - Corrupt ...[truncated 396 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (48)

Tainted flow: 'headers' from os.environ.get (line 65, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/auto_task_flow.py (reported line 23)May include surrounding context.

python
}
    
    try:
        response = requests.get(url, headers=headers, timeout=30)
        response.raise_for_status()
        data = response.json()
    except requests.exceptions.RequestException as e:

Tainted flow: 'headers' from os.environ.get (line 65, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/auto_task_flow.py (reported line 49)May include surrounding context.

python
}
    
    try:
        response = requests.get(url, headers=headers, timeout=30)
        response.raise_for_status()
        data = response.json()
    except requests.exceptions.RequestException as e:

Tainted flow: 'headers' from os.environ.get (line 65, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/auto_task_flow.py (reported line 77)May include surrounding context.

python
}
    
    try:
        response = requests.post(url, headers=headers, json=payload, timeout=30)
        response.raise_for_status()
        data = response.json()
    except requests.exceptions.RequestException as e:

Tainted flow: 'headers' from os.environ.get (line 27, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/check_task.py (reported line 32)May include surrounding context.

python
"Content-Type": "application/x-www-form-urlencoded"
    }
    
    response = requests.get(url, headers=headers)
    data = response.json()
    
    if data.get("code") != 0 and data.get("code") != 200:

Tainted flow: 'headers' from os.environ.get (line 16, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/check_tasks.py (reported line 21)May include surrounding context.

python
"Content-Type": "application/x-www-form-urlencoded"
    }
    
    response = requests.get(url, headers=headers)
    data = response.json()
    
    if data.get("code") != 0 and data.get("code") != 200:

Tainted flow: 'headers' from os.environ.get (line 15, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_pools.py (reported line 20)May include surrounding context.

python
"Content-Type": "application/x-www-form-urlencoded"
    }
    
    response = requests.get(url, headers=headers)
    data = response.json()
    if data.get("code") != 0 and data.get("code") != 200:
        print(f"Error: {data.get('msg')}")

Tainted flow: 'headers' from os.environ.get (line 27, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/list_my_tasks.py (reported line 42)May include surrounding context.

python
if task_status:
        params["taskStatus"] = str(task_status)
    
    response = requests.get(url, headers=headers, params=params)
    data = response.json()
    
    if data.get("code") != 0 and data.get("code") != 200:

Tainted flow: 'headers' from os.environ.get (line 25, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/submit_task.py (reported line 36)May include surrounding context.

python
"languageType": language_type
    }
    
    response = requests.post(url, headers=headers, json=payload)
    data = response.json()
    
    if data.get("code") != 0 and data.get("code") != 200:

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

Even though submitting a tweet URL is not itself Twitter auto-posting, the repeated emphasis on 'no Twitter/X functionality' can still be misleading if the workflow is tightly coupled to X content submission and surrounding undeclared behaviors are absent. Security review should treat such wording inconsistencies as risk-amplifying because they obscure the true data flow and user actions the skill expects.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Even though submitting a tweet URL is not itself Twitter auto-posting, the repeated emphasis on 'no Twitter/X functionality' can still be misleading if the workflow is tightly coupled to X content submission and surrounding undeclared behaviors are absent. Security review should treat such wording inconsistencies as risk-amplifying because they obscure the true data flow and user actions the skill expects.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Even though submitting a tweet URL is not itself Twitter auto-posting, the repeated emphasis on 'no Twitter/X functionality' can still be misleading if the workflow is tightly coupled to X content submission and surrounding undeclared behaviors are absent. Security review should treat such wording inconsistencies as risk-amplifying because they obscure the true data flow and user actions the skill expects.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Even though submitting a tweet URL is not itself Twitter auto-posting, the repeated emphasis on 'no Twitter/X functionality' can still be misleading if the workflow is tightly coupled to X content submission and surrounding undeclared behaviors are absent. Security review should treat such wording inconsistencies as risk-amplifying because they obscure the true data flow and user actions the skill expects.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Even though submitting a tweet URL is not itself Twitter auto-posting, the repeated emphasis on 'no Twitter/X functionality' can still be misleading if the workflow is tightly coupled to X content submission and surrounding undeclared behaviors are absent. Security review should treat such wording inconsistencies as risk-amplifying because they obscure the true data flow and user actions the skill expects.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

Even though submitting a tweet URL is not itself Twitter auto-posting, the repeated emphasis on 'no Twitter/X functionality' can still be misleading if the workflow is tightly coupled to X content submission and surrounding undeclared behaviors are absent. Security review should treat such wording inconsistencies as risk-amplifying because they obscure the true data flow and user actions the skill expects.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

_KEY="你的API Key" export OPENCLAW_WORKSPACE="/root/.openclaw/workspace" # 可选，默认值

text

### 2. 配置 Cron 定时检查（可选）
```bash
# 方法1: 使用工作区安装路径（推荐）
SKILL_DIR="/root/.openclaw/workspace/skills/claw-loudyai-skill"
(crontab -l 2>/dev/null; echo "*/5 * * * * $SKILL_DIR/scripts/cron_check.sh") | crontab -

# 方法2: 如果安装到系统路径
(crontab -l 2>/dev/null; echo "*/5 * * * * /usr/lib/node_modules/openclaw/skills/loudy-ai-auto-task/scripts/cron_check.sh") | crontab -

3. 配置 Heartbeat 通知（可选）

在 HEARTBEAT.md 中添加：

text
## Loudy.ai 任务检查
检查工作区目录下的 loudy_has_new.txt 是否存在：
- 如果存在 → 读取 loudy_tasks.json 内容
- 发送消息通知用户
- 删除 loudy_has_new.txt

注意事项

  • ⚠️ API Key 安全：建议使用环境变量 export LOUDY_API_KEY=你的密钥，不要写入 TOOLS.md 或其他共享文件
  • 📝 文件系统访问

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The | bash chaining pattern causes whatever content is fetched remotely to be executed immediately by the shell, eliminating any review step and amplifying supply-chain compromise risk. In this installer, the risk is heightened because it writes into a system-wide skills directory and may be run with elevated privileges to obtain permissions.

Content

Scanner excerpt · install.sh (reported line 3)May include surrounding context.

sh
#!/bin/bash
# Loudy.ai 自动任务 Skill 安装脚本
# 使用方法: curl -fsSL https://raw.githubusercontent.com/sfsf332/claw-loudyai-skill/main/install.sh | bash

set -e

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill declares required environment variables and documents network, shell, and filesystem behavior, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates unnecessary privilege ambiguity: an agent may be allowed to invoke broader capabilities than users expect, especially given the documented cron installation and local file writes.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This skill is explicitly designed to send data to an external service, so external transmission is expected in context; however, it still represents a real data egress boundary because API keys and user-submitted task links are sent to api.loudy.ai. The danger is elevated by the fact that the skill handles credentials and potentially user content, so users need explicit disclosure and scoping.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
## API 接口

### 1. 获取奖池列表
- **URL**: `GET https://api.loudy.ai/app-api/open-api/v1/earning-pools`
- **Header**: `X-API-Key: <LOUDY_API_KEY>`

### 2. 获取奖池详情

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Fetching earning-pool details from an external API is consistent with the skill's purpose, but it still constitutes network egress and use of a sensitive credential. In an agent environment, undeclared or under-scoped network transmission can leak usage patterns, task identifiers, or API credentials if mishandled.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md
- **Header**: `X-API-Key: <LOUDY_API_KEY>`

### 2. 获取奖池详情
- **URL**: `GET https://api.loudy.ai/app-api/open-api/v1/earning-pools/{id}`
- **Header**: `X-API-Key: <LOUDY_API_KEY>`

### 3. 提交任务

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The POST submission endpoint sends user-provided task links and the API key to a third-party service. That is an expected function of the skill, but it is still security-relevant because malformed or unintended links, sensitive content, or credentials could be transmitted externally if validation and disclosure are weak.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

  • Header: X-API-Key: <LOUDY_API_KEY>

3. 提交任务

  • URL: POST https://api.loudy.ai/app-api/open-api/v1/earning-pool-tasks/submit
  • Header: X-API-Key: <LOUDY_API_KEY>
  • Body:
json

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The example request body sets languageType to zh_CN, which indicates a fixed locale choice. Under the policy, forcing a specific language or locale without offering the user a choice is a natural-language policy concern unless the constraint is explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

Listing task history through the external API can disclose workflow metadata and requires transmission of the API key. This is normal for the skill's use case, but it remains a real exposure point that should be bounded and transparent.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

text

### 4. 查询我的任务列表（分页）
- **URL**: `GET https://api.loudy.ai/app-api/open-api/v1/earning-pool-tasks`
- **Header**: `X-API-Key: <LOUDY_API_KEY>`
- **Query**:
  - `pageNo` - 页码（必填）

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

Querying task status externally is expected, but it still transmits authenticated requests and retrieves potentially sensitive task/audit information. In a security review, expected egress is still a vulnerability class when secrets and third-party data flows are involved, though context lowers suspicion of malicious intent.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md
- `taskStatus` - 任务状态（可选）

### 5. 查询任务状态
- **URL**: `GET https://api.loudy.ai/app-api/open-api/v1/earning-pool-tasks/{id}`
- **Header**: `X-API-Key: <LOUDY_API_KEY>`
- **返回字段**:
  - `taskStatus` - 任务状态

Session Persistence

Medium
Category
Rogue Agent
Confidence
96% confidence
Finding

Adding a cron entry establishes persistence outside the immediate user session, causing code to execute every five minutes until manually removed. In an agent skill, persistence is especially dangerous because it can continue network access, file writes, and monitoring after the user no longer expects the skill to be active.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

bash
# 方法1: 使用工作区安装路径（推荐）
SKILL_DIR="/root/.openclaw/workspace/skills/claw-loudyai-skill"
(crontab -l 2>/dev/null; echo "*/5 * * * * $SKILL_DIR/scripts/cron_check.sh") | crontab -

# 方法2: 如果安装到系统路径
(crontab -l 2>/dev/null; echo "*/5 * * * * /usr/lib/node_modules/openclaw/skills/loudy-ai-auto-task/scripts/cron_check.sh") | crontab -

Session Persistence

Medium
Category
Rogue Agent
Confidence
96% confidence
Finding

This second cron-install path writes persistent execution into a system-level location, which increases blast radius and makes the behavior more invasive. Persistence combined with shell execution and file monitoring can be abused for continued unauthorized activity even if the initial session ends.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

(crontab -l 2>/dev/null; echo "*/5 * * * * $SKILL_DIR/scripts/cron_check.sh") | crontab -

方法2: 如果安装到系统路径

(crontab -l 2>/dev/null; echo "*/5 * * * * /usr/lib/node_modules/openclaw/skills/loudy-ai-auto-task/scripts/cron_check.sh") | crontab -

text

### 3. 配置 Heartbeat 通知（可选）