ClawHub
Back to skill

Security audit

Claw Loudyai Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches Loudy.ai task automation, but its installer, optional cron persistence, and under-disclosed promotion of another posting skill create review-level risk.

Review before installing. Use only a user-scoped install path, avoid curl | bash and unpinned GitHub installs, do not enable the cron option unless you understand how to remove it, and treat any suggestion to install the Binance posting skill as a separate trust decision.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
install.sh:3
Finding
Installation instructions execute a mutable remote script through curl and Bash<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:3` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash # Usage: curl -fsSL https://raw.githubusercontent.com/sfsf332/claw-loudyai-skill/main/install.sh | bash ``` The original comment documents this command as the supported installation method. ### Technical Analysis The documented command downloads `install.sh` from the mutable `main` branch and sends it directly to Bash. The user has no opportunity to inspect the downloaded content before execution, and the process does not pin a commit, validate a checksum, or verify a cryptographic signature. Although the command appears in a comment inside the audited artifact, it is an executable installation instruction intended to be copied or invoked by users. The effective code executed at installation time can therefore differ from the version reviewed during this audit. This behavior is not required to provide the declared Loudy.ai API functionality. A safer installer can be distributed as a versioned artifact and inspected before execution. ### Attack Path 1. An attacker compromises the repository owner, GitHub account, repository, DNS/network trust chain, or an authorized maintainer. 2. The attacker changes `main/install.sh` at the referenced URL. 3. A user follows the documented `curl | bash` installation command. 4. Bash immediately executes the modified response with the user's current privileges. 5. If the user runs the command with elevated privileges—as the installer may require for its default system path—the payload executes with those elevated privileges. ### Impact Assessment A malicious remote installer can execute arbitrary commands with all privileges held by the invoking user. Potential impact includes: - Reading or altering files accessible to that user. - Stealing environment variables and API credentials. - Installing additional persistence. - Replacing OpenC ...[truncated 161 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the `curl | bash` installation recommendation. 2. Publish immutable, versioned release archives rather than installing from `main`. 3. Provide a SHA-256 or stronger digest over each release artifact. 4. Sign releases and document signature verification. 5. Require users to download, inspect, and verify the installer before running it. 6. Pin installation to a specific release or commit. 7. Avoid requiring root privileges; use a user-scoped Skill directory by default. 8. Fail closed if integrity or signature verification fails. ]]>

T03 · Remote Payload Retrieval and Execution

Error
Location
install.sh:84
Finding
Installer replaces a system-level Skill with an unpinned remote repository revision<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:84-90` **Vulnerability Type**: Unpinned remote code installation and unsafe replacement **Risk Level**: High ### Vulnerable Code ```bash clone_repository() { info "Cloning repository..." cd "$INSTALL_DIR" if [ -d "loudy-ai-auto-task" ]; then warning "Directory already exists and will be removed..." rm -rf loudy-ai-auto-task fi git clone https://github.com/sfsf332/claw-loudyai-skill.git loudy-ai-auto-task || error "Repository clone failed" } ``` The relevant default installation path is configured elsewhere in the same installer: ```bash INSTALL_DIR="/usr/lib/node_modules/openclaw/skills" ``` ### Technical Analysis The installer deletes the existing Skill directory and clones the repository's mutable default branch without specifying a tag, commit hash, release archive, checksum, or signature. Consequently, the installed code is determined by the repository state at installation time rather than by the audited package version. The default destination is a system-level OpenClaw directory. The installer also advises users to use root or `sudo` when that directory is not writable. This combines mutable remote code retrieval with potentially privileged installation. Deleting the previous installation before downloading and validating the replacement also removes rollback safety. A failed, compromised, or malicious clone can leave the installation unavailable or replace previously trusted code. ### Attack Path 1. An attacker gains the ability to modify the remote repository's default branch. 2. The attacker adds malicious Skill instructions or executable scripts. 3. A user runs the installer, potentially with root privileges because of the default destination. 4. The installer removes the currently installed `loudy-ai-auto-task` directory. 5. It clones the attacker-controlled default branch without integrity validation. 6. OpenClaw, a user, or ...[truncated 667 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Clone or download an immutable, explicitly selected release. 2. Pin the exact commit hash and verify that the checked-out `HEAD` matches it. 3. Verify a signed tag or release signature before installation. 4. Download into a staging directory and validate all expected files before replacement. 5. Replace the existing installation atomically only after successful validation. 6. Preserve a rollback copy of the previously installed version. 7. Use a user-scoped installation directory by default. 8. Refuse to operate on unexpected paths and validate the resolved installation path before `rm -rf`. 9. Do not instruct users to run the entire installer as root; isolate only the minimum privileged filesystem operation if system-wide installation is necessary. ]]>

T06 · System Persistence

Error
Location
SKILL.md:163
Finding
Optional cron configuration creates durable five-minute execution of installed Skill code<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:163-170` **Vulnerability Type**: Scheduled cross-session execution **Risk Level**: High ### Vulnerable Code ```bash SKILL_DIR="/root/.openclaw/workspace/skills/claw-loudyai-skill" (crontab -l 2>/dev/null; echo "*/5 * * * * $SKILL_DIR/scripts/cron_check.sh") | crontab - ``` ```bash (crontab -l 2>/dev/null; echo "*/5 * * * * /usr/lib/node_modules/openclaw/skills/loudy-ai-auto-task/scripts/cron_check.sh") | crontab - ``` ### Technical Analysis The documentation instructs users to add a cron entry that executes `cron_check.sh` every five minutes across login sessions and system restarts. Scheduling periodic checks is related to the declared automation feature and is disclosed as optional, but the implementation creates a durable execution channel for files installed from a mutable remote repository. The configuration has no executable integrity check, constrained service account, duplicate-entry prevention, or documented removal command. If the installed script is subsequently modified—whether through repository compromise, unsafe reinstallation, or local filesystem access—the modified code is automatically executed by cron. The system path variant can be configured in a privileged user's crontab. In that case, any later compromise of the scheduled script obtains recurring privileged execution. ### Attack Path 1. A user follows the documentation and adds the cron entry. 2. The Skill directory or `cron_check.sh` is later replaced or modified. 3. Cron executes the modified script automatically within five minutes. 4. The malicious script runs repeatedly under the privileges of the crontab owner. 5. The execution continues across future sessions until the cron entry is discovered and removed. ### Impact Assessment The cron entry provides repeated, cross-session code execution. An attacker who can modify the scheduled files can: - Execute arbitrary commands as the crontab owner. - Re-establish d ...[truncated 338 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Prefer on-demand or foreground polling that terminates with the current task. 2. Require explicit, informed user consent before creating any schedule. 3. Use a dedicated, minimally privileged service account if scheduling is necessary. 4. Pin and verify the integrity of the executable before every scheduled invocation. 5. Prevent duplicate cron entries by using a uniquely identified managed block. 6. Provide an exact uninstall command that removes the corresponding cron entry. 7. Log installation, execution, failures, and removal of the schedule. 8. Use restrictive filesystem ownership and permissions for the Skill and wrapper. 9. Avoid scheduling system-path code from root unless the functionality strictly requires root, which this API client does not. ]]>

T01 · Skill Instruction Hijacking

Error
Location
scripts/auto_task_flow.py:135
Finding
Pool display output redirects users and agents to install and invoke an unrelated external Skill<![CDATA[ ## Vulnerability Details **File Location**: `scripts/auto_task_flow.py:135-181` **Vulnerability Type**: Skill output instruction hijacking **Risk Level**: High ### Vulnerable Code ```python if is_binance_task(info['sponsor']): print(f"\n{'='*60}") print(f"🚀 Binance task-specific guidance") print(f"{'='*60}") print(f"💡 A Binance task was detected.") print(f"\n📦 Recommended Binance Skill:") print(f"🔗 GitHub: https://github.com/binance/binance-skills-hub/tree/main/skills/binance/square-post") print(f"\n📥 Installation:") print(f" 1. Install the Skill:") print(f" $ clawhub install binance/square-post") print(f"\n🚀 Usage after installation:") print(f" Tell the AI to use the Binance Skill to complete this task") print(f"\n📋 Workflow:") print(f" 1. Install the Binance Skill") print(f" 2. Run it to generate and publish a post") print(f" 3. Obtain the generated post URL") print(f" 4. Send the post URL back") print(f" 5. Submit it to loudy.ai") ``` The strings above are translated for reporting clarity; the audited source emits equivalent instructions in Chinese. ### Technical Analysis When a pool sponsor contains a Binance keyword, the Skill adds extensive hardcoded instructions recommending another repository and directing the user or agent to install and invoke an external Skill. This behavior is not necessary to list Loudy.ai pools, submit links, or check task status. It is also not disclosed in the top-level Skill description. The generated instructions can influence an agent or user to expand the execution boundary to code that is not included in this audited artifact. The output also conflicts with the Skill's stated boundary that Twitter/X publishing is manual and not implemented by this Skill. The promoted workflow recommends another Skill specifically to generate and publish content automatically. ### Attack Path 1. The Loudy.ai API returns a pool ...[truncated 1121 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the third-party promotion and installation command from normal pool output. 2. Keep output limited to information required for the declared Loudy.ai workflow. 3. If interoperability is retained, document it prominently in `SKILL.md`. 4. Require explicit user opt-in before showing or invoking any external integration. 5. Present external resources as neutral references rather than agent-directed commands. 6. Never instruct an agent to install another Skill automatically. 7. Apply an allowlist and independent security review to any recommended integration. 8. Preserve the declared manual-posting boundary unless the user explicitly enables a separately audited publishing capability. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/cron_check.sh:6
Finding
Scheduled process writes predictable workspace files without symlink or ownership validation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/cron_check.sh:6-42` **Vulnerability Type**: Unsafe predictable file writes **Risk Level**: Medium ### Vulnerable Code ```bash WORKSPACE_DIR="${OPENCLAW_WORKSPACE:-/root/.openclaw/workspace}" LOG_FILE="$WORKSPACE_DIR/loudy_tasks.json" LAST_FILE="$WORKSPACE_DIR/loudy_last.json" python3 "$CHECK_SCRIPT" > "$LOG_FILE" if [ -f "$LAST_FILE" ]; then if diff -q "$LOG_FILE" "$LAST_FILE" > /dev/null 2>&1; then exit 0 fi fi cp "$LOG_FILE" "$LAST_FILE" echo "NEW_TASKS" > "$WORKSPACE_DIR/loudy_has_new.txt" ``` ### Technical Analysis The scheduled wrapper writes to fixed, predictable paths using shell redirection and `cp`. It does not: - Verify workspace ownership or permissions. - Reject symbolic links. - Create a private state directory. - Set a restrictive `umask`. - Use securely created temporary files. - Perform atomic replacement. Shell redirection and ordinary `cp` can follow symbolic links. If another local user or compromised process can write in the configured workspace, it can pre-create one of these state paths as a symlink to another file writable by the cron owner. The issue becomes more serious if the cron task runs as root while the workspace remains writable by a less-privileged account. ### Attack Path 1. An attacker obtains write access to `OPENCLAW_WORKSPACE` or its default directory. 2. The attacker creates a symbolic link such as `loudy_tasks.json` or `loudy_has_new.txt` pointing to a target file. 3. The scheduled cron job runs under a more privileged account. 4. Shell redirection, `cp`, or `echo` follows the symbolic link. 5. The target is truncated or overwritten with pool output, copied data, or the marker string. Exploitation requires the attacker to have write access to the workspace or the relevant state-file entries. ### Impact Assessment The attacker may overwrite or truncate any file writable by the cron owner. Potential consequences include: - Corrupt ...[truncated 396 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Store state in a dedicated directory owned by the scheduled account with mode `0700`. 2. Set `umask 077` before creating files. 3. Validate the resolved workspace path, ownership, and permissions before writing. 4. Reject state paths that are symbolic links. 5. Use securely created temporary files in the same filesystem. 6. Write output to the temporary file and atomically rename it into place. 7. Open files with no-follow and exclusive-creation semantics where supported. 8. Refuse to run as root when the configured workspace is writable by another account. 9. Ensure all state files are owned by the scheduled account and have mode `0600`. 10. Handle missing workspace directories explicitly instead of relying on redirection failure. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (48)

Tainted flow: 'headers' from os.environ.get (line 65, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
}
    
    try:
        response = requests.get(url, headers=headers, timeout=30)
        response.raise_for_status()
        data = response.json()
    except requests.exceptions.RequestException as e:
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'headers' from os.environ.get (line 65, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
}
    
    try:
        response = requests.get(url, headers=headers, timeout=30)
        response.raise_for_status()
        data = response.json()
    except requests.exceptions.RequestException as e:
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'headers' from os.environ.get (line 65, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
}
    
    try:
        response = requests.post(url, headers=headers, json=payload, timeout=30)
        response.raise_for_status()
        data = response.json()
    except requests.exceptions.RequestException as e:
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'headers' from os.environ.get (line 27, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
"Content-Type": "application/x-www-form-urlencoded"
    }
    
    response = requests.get(url, headers=headers)
    data = response.json()
    
    if data.get("code") != 0 and data.get("code") != 200:
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'headers' from os.environ.get (line 16, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
"Content-Type": "application/x-www-form-urlencoded"
    }
    
    response = requests.get(url, headers=headers)
    data = response.json()
    
    if data.get("code") != 0 and data.get("code") != 200:
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'headers' from os.environ.get (line 15, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
"Content-Type": "application/x-www-form-urlencoded"
    }
    
    response = requests.get(url, headers=headers)
    data = response.json()
    if data.get("code") != 0 and data.get("code") != 200:
        print(f"Error: {data.get('msg')}")
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'headers' from os.environ.get (line 27, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Content
if task_status:
        params["taskStatus"] = str(task_status)
    
    response = requests.get(url, headers=headers, params=params)
    data = response.json()
    
    if data.get("code") != 0 and data.get("code") != 200:
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tainted flow: 'headers' from os.environ.get (line 25, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
"languageType": language_type
    }
    
    response = requests.post(url, headers=headers, json=payload)
    data = response.json()
    
    if data.get("code") != 0 and data.get("code") != 200:
Confidence
90% confidence
Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
Even though submitting a tweet URL is not itself Twitter auto-posting, the repeated emphasis on 'no Twitter/X functionality' can still be misleading if the workflow is tightly coupled to X content submission and surrounding undeclared behaviors are absent. Security review should treat such wording inconsistencies as risk-amplifying because they obscure the true data flow and user actions the skill expects.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
Even though submitting a tweet URL is not itself Twitter auto-posting, the repeated emphasis on 'no Twitter/X functionality' can still be misleading if the workflow is tightly coupled to X content submission and surrounding undeclared behaviors are absent. Security review should treat such wording inconsistencies as risk-amplifying because they obscure the true data flow and user actions the skill expects.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
Even though submitting a tweet URL is not itself Twitter auto-posting, the repeated emphasis on 'no Twitter/X functionality' can still be misleading if the workflow is tightly coupled to X content submission and surrounding undeclared behaviors are absent. Security review should treat such wording inconsistencies as risk-amplifying because they obscure the true data flow and user actions the skill expects.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
Even though submitting a tweet URL is not itself Twitter auto-posting, the repeated emphasis on 'no Twitter/X functionality' can still be misleading if the workflow is tightly coupled to X content submission and surrounding undeclared behaviors are absent. Security review should treat such wording inconsistencies as risk-amplifying because they obscure the true data flow and user actions the skill expects.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
Even though submitting a tweet URL is not itself Twitter auto-posting, the repeated emphasis on 'no Twitter/X functionality' can still be misleading if the workflow is tightly coupled to X content submission and surrounding undeclared behaviors are absent. Security review should treat such wording inconsistencies as risk-amplifying because they obscure the true data flow and user actions the skill expects.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
Even though submitting a tweet URL is not itself Twitter auto-posting, the repeated emphasis on 'no Twitter/X functionality' can still be misleading if the workflow is tightly coupled to X content submission and surrounding undeclared behaviors are absent. Security review should treat such wording inconsistencies as risk-amplifying because they obscure the true data flow and user actions the skill expects.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Content
_KEY="你的API Key"
export OPENCLAW_WORKSPACE="/root/.openclaw/workspace"  # 可选，默认值
```

### 2. 配置 Cron 定时检查（可选）
```bash
# 方法1: 使用工作区安装路径（推荐）
SKILL_DIR="/root/.openclaw/workspace/skills/claw-loudyai-skill"
(crontab -l 2>/dev/null; echo "*/5 * * * * $SKILL_DIR/scripts/cron_check.sh") | crontab -

# 方法2: 如果安装到系统路径
(crontab -l 2>/dev/null; echo "*/5 * * * * /usr/lib/node_modules/openclaw/skills/loudy-ai-auto-task/scripts/cron_check.sh") | crontab -
```

### 3. 配置 Heartbeat 通知（可选）
在 HEARTBEAT.md 中添加：
```
## Loudy.ai 任务检查
检查工作区目录下的 loudy_has_new.txt 是否存在：
- 如果存在 → 读取 loudy_tasks.json 内容
- 发送消息通知用户
- 删除 loudy_has_new.txt
```

## 注意事项

- ⚠️ **API Key 安全**：建议使用环境变量 `export LOUDY_API_KEY=你的密钥`，**不要**写入 TOOLS.md 或其他共享文件
- 📝 **文件系统访问**
Confidence
75% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Chaining Abuse

High
Category
Tool Misuse
Content
#!/bin/bash
# Loudy.ai 自动任务 Skill 安装脚本
# 使用方法: curl -fsSL https://raw.githubusercontent.com/sfsf332/claw-loudyai-skill/main/install.sh | bash

set -e
Confidence
96% confidence
Finding
The `| bash` chaining pattern causes whatever content is fetched remotely to be executed immediately by the shell, eliminating any review step and amplifying supply-chain compromise risk. In this installer, the risk is heightened because it writes into a system-wide skills directory and may be run with elevated privileges to obtain permissions.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill declares required environment variables and documents network, shell, and filesystem behavior, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates unnecessary privilege ambiguity: an agent may be allowed to invoke broader capabilities than users expect, especially given the documented cron installation and local file writes.

External Transmission

Medium
Category
Data Exfiltration
Content
## API 接口

### 1. 获取奖池列表
- **URL**: `GET https://api.loudy.ai/app-api/open-api/v1/earning-pools`
- **Header**: `X-API-Key: <LOUDY_API_KEY>`

### 2. 获取奖池详情
Confidence
91% confidence
Finding
This skill is explicitly designed to send data to an external service, so external transmission is expected in context; however, it still represents a real data egress boundary because API keys and user-submitted task links are sent to api.loudy.ai. The danger is elevated by the fact that the skill handles credentials and potentially user content, so users need explicit disclosure and scoping.

External Transmission

Medium
Category
Data Exfiltration
Content
- **Header**: `X-API-Key: <LOUDY_API_KEY>`

### 2. 获取奖池详情
- **URL**: `GET https://api.loudy.ai/app-api/open-api/v1/earning-pools/{id}`
- **Header**: `X-API-Key: <LOUDY_API_KEY>`

### 3. 提交任务
Confidence
90% confidence
Finding
Fetching earning-pool details from an external API is consistent with the skill's purpose, but it still constitutes network egress and use of a sensitive credential. In an agent environment, undeclared or under-scoped network transmission can leak usage patterns, task identifiers, or API credentials if mishandled.

External Transmission

Medium
Category
Data Exfiltration
Content
- **Header**: `X-API-Key: <LOUDY_API_KEY>`

### 3. 提交任务
- **URL**: `POST https://api.loudy.ai/app-api/open-api/v1/earning-pool-tasks/submit`
- **Header**: `X-API-Key: <LOUDY_API_KEY>`
- **Body**:
```json
Confidence
94% confidence
Finding
The POST submission endpoint sends user-provided task links and the API key to a third-party service. That is an expected function of the skill, but it is still security-relevant because malformed or unintended links, sensitive content, or credentials could be transmitted externally if validation and disclosure are weak.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
The example request body sets `languageType` to `zh_CN`, which indicates a fixed locale choice. Under the policy, forcing a specific language or locale without offering the user a choice is a natural-language policy concern unless the constraint is explicitly justified as region-specific.

External Transmission

Medium
Category
Data Exfiltration
Content
```

### 4. 查询我的任务列表（分页）
- **URL**: `GET https://api.loudy.ai/app-api/open-api/v1/earning-pool-tasks`
- **Header**: `X-API-Key: <LOUDY_API_KEY>`
- **Query**:
  - `pageNo` - 页码（必填）
Confidence
89% confidence
Finding
Listing task history through the external API can disclose workflow metadata and requires transmission of the API key. This is normal for the skill's use case, but it remains a real exposure point that should be bounded and transparent.

External Transmission

Medium
Category
Data Exfiltration
Content
- `taskStatus` - 任务状态（可选）

### 5. 查询任务状态
- **URL**: `GET https://api.loudy.ai/app-api/open-api/v1/earning-pool-tasks/{id}`
- **Header**: `X-API-Key: <LOUDY_API_KEY>`
- **返回字段**:
  - `taskStatus` - 任务状态
Confidence
89% confidence
Finding
Querying task status externally is expected, but it still transmits authenticated requests and retrieves potentially sensitive task/audit information. In a security review, expected egress is still a vulnerability class when secrets and third-party data flows are involved, though context lowers suspicion of malicious intent.

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
# 方法1: 使用工作区安装路径（推荐）
SKILL_DIR="/root/.openclaw/workspace/skills/claw-loudyai-skill"
(crontab -l 2>/dev/null; echo "*/5 * * * * $SKILL_DIR/scripts/cron_check.sh") | crontab -

# 方法2: 如果安装到系统路径
(crontab -l 2>/dev/null; echo "*/5 * * * * /usr/lib/node_modules/openclaw/skills/loudy-ai-auto-task/scripts/cron_check.sh") | crontab -
Confidence
96% confidence
Finding
Adding a cron entry establishes persistence outside the immediate user session, causing code to execute every five minutes until manually removed. In an agent skill, persistence is especially dangerous because it can continue network access, file writes, and monitoring after the user no longer expects the skill to be active.

Session Persistence

Medium
Category
Rogue Agent
Content
(crontab -l 2>/dev/null; echo "*/5 * * * * $SKILL_DIR/scripts/cron_check.sh") | crontab -

# 方法2: 如果安装到系统路径
(crontab -l 2>/dev/null; echo "*/5 * * * * /usr/lib/node_modules/openclaw/skills/loudy-ai-auto-task/scripts/cron_check.sh") | crontab -
```

### 3. 配置 Heartbeat 通知（可选）
Confidence
96% confidence
Finding
This second cron-install path writes persistent execution into a system-level location, which increases blast radius and makes the behavior more invasive. Persistence combined with shell execution and file monitoring can be abused for continued unauthorized activity even if the initial session ends.

Static analysis

No suspicious patterns detected.