ClawHub
Back to skill

Security audit

Loudy.ai Auto Task

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches a Loudy.ai task helper, but its mutable installer, optional recurring cron job, and third-party skill steering create review-level risk.

Install only if you are comfortable giving this skill a Loudy.ai API key, sending task links and task status requests to Loudy.ai, and managing its local files. Avoid the provided curl-to-bash installer and any root or system-wide install path; prefer an immutable reviewed package. Do not enable the cron job unless you add your own cleanup, locking, and least-privilege controls. Treat the suggested Binance/X posting skill as a separate component requiring its own review before use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
install.sh:3
Finding

Mutable Remote Installer Executes Unpinned Repository Content

Content
View full analysis
/dev/null || true fi success "权限设置完成" } ``` ### Technical Analysis The documented installation command downloads `install.sh` from the mutable `main` branch and immediately passes it to a shell. Users cannot reliably inspect the exact payload before execution, and the command performs no signature, checksum, release-tag, or commit verification. The downloaded installer then clones the repository without specifying an immutable commit or tag. Consequently, both the first-stage installer and second-stage Skill content can differ from the version that was audited. The installer also marks retrieved scripts executable and defaults to `/usr/lib/node_modules/openclaw/skills`, a location that commonly requires elevated privileges. The installation process additionally deletes any existing `l ...[truncated 1477 chars]
Remediation
View remediation

T06 · System Persistence

Error
Location
SKILL.md:157
Finding

Optional Cron Configuration Establishes Recurring Cross-Session Execution

Content
View full analysis
/dev/null; echo "*/5 * * * * $SKILL_DIR/scripts/cron_check.sh") | crontab - # 方法2: 如果安装到系统路径 (crontab -l 2>/dev/null; echo "*/5 * * * * /usr/lib/node_modules/openclaw/skills/loudy-ai-auto-task/scripts/cron_check.sh") | crontab - ``` ### Technical Analysis The documentation instructs the user to add a cron entry that executes `cron_check.sh` every five minutes. This behavior is disclosed as optional and is related to automatic task polling, but it still creates execution that survives the interactive Skill run and future login sessions. The command is not idempotent: running it repeatedly appends duplicate entries. It has no unique marker, integrity check, overlap prevention, lifecycle management, or documented uninstall command. One suggested target is a privileged system installation path. The cron entry executes whichever file later occupies the configured path. Therefore, repository replacement, an unsafe update, or writable-path compromise can convert the legitimate polling mechanism into recurring execution of attacker-controlled content. ### Attack Path 1. The user follows the cron configuration instructions. 2. The user's crontab receives an entry that invokes `cron_check.sh` every five minutes. 3. The cron entry persists after the current OpenClaw interaction ends. 4. The installed Skill directory is later replaced, updated from mutable remote content, or modified by an attacker with write access. 5. Cron executes the modified script automatically and repeatedly. 6. The replacement code runs with the privileges and environment available to the cron account. ### Impact A ...[truncated 605 chars]
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
scripts/auto_task_flow.py:141
Finding

Task Output Steers Users and Agents Toward an Unreviewed Third-Party Skill

Content
View full analysis
") print(f"\n📋 完整流程：") print(f" 1. 安装币安 skill") print(f" 2. 运行 skill 生成并发布推文") print(f" 3. 获取生成的推文链接") print(f" 4. 将推文链接发送给我") print(f" 5. 我会自动提交到 loudy.ai") ``` ### Technical Analysis The declared Skill scope states that Twitter/X posting is manual and that the Skill only interacts with the Loudy API. However, when a sponsor name contains a Binance keyword, normal task display output includes instructions to install and run another Skill that can generate and publish content. The external Skill is not included in this project and was not auditable as part of this review. The trigger depends on the `sponsor` field returned by the Loudy API: ```python def is_binance_task(sponsor): binance_keywords = ['binance', '币安', 'Binance', 'BINANCE'] return any(keyword.lower() in sponsor.lower() for keyword in binance_keywords) ``` This crea ...[truncated 1390 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/cron_check.sh:6
Finding

Scheduled Workflow Writes Predictable Workspace Files Without Explicit Permission or Symlink Controls

Content
View full analysis
"$LOG_FILE" # 比较是否有新任务 if [ -f "$LAST_FILE" ]; then if diff -q "$LOG_FILE" "$LAST_FILE" > /dev/null 2>&1; then # 没有变化 exit 0 fi fi # 有新任务或首次运行，保存并标记需要通知 cp "$LOG_FILE" "$LAST_FILE" echo "NEW_TASKS" > "$WORKSPACE_DIR/loudy_has_new.txt" ``` ### Technical Analysis The scheduled script writes task data to fixed filenames under a configurable workspace. It does not set a restrictive `umask`, validate directory ownership or permissions, reject symbolic links, or use atomic file replacement. Shell redirection opens and truncates `loudy_tasks.json` before Python executes. If an attacker can write to the workspace, a pre-created symbolic link can redirect that operation to another file writable by the cron account. Similar concerns apply to `loudy_last.json` and `loudy_has_new.txt`. File confidentiality is inherited from the account's current umask. In a shared or permissively configured workspace, task descriptions and associated pool data may become readable by unintended local users or processes. The `.json` name is also misleading because `check_tasks.py` produces formatted plain text rather than JSON. ### Attack Path 1. An attacker or lower-privileged local process obtains write access to the configured workspace. 2. The attacker replaces `loudy_tasks.json`, `loudy_last.json`, or `loudy_has_new.txt` with a symbolic link to another path. 3. Cron invokes `cron_check.s ...[truncated 740 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/check_tasks.py:14
Finding

Authenticated HTTP Requests Lack Timeouts and Consistent Error Handling

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (48)

Tainted flow: 'headers' from os.environ.get (line 65, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/auto_task_flow.py (reported line 23)May include surrounding context.

python
}
    
    try:
        response = requests.get(url, headers=headers, timeout=30)
        response.raise_for_status()
        data = response.json()
    except requests.exceptions.RequestException as e:

Tainted flow: 'headers' from os.environ.get (line 65, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/auto_task_flow.py (reported line 49)May include surrounding context.

python
}
    
    try:
        response = requests.get(url, headers=headers, timeout=30)
        response.raise_for_status()
        data = response.json()
    except requests.exceptions.RequestException as e:

Tainted flow: 'headers' from os.environ.get (line 65, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/auto_task_flow.py (reported line 77)May include surrounding context.

python
}
    
    try:
        response = requests.post(url, headers=headers, json=payload, timeout=30)
        response.raise_for_status()
        data = response.json()
    except requests.exceptions.RequestException as e:

Tainted flow: 'headers' from os.environ.get (line 27, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/check_task.py (reported line 32)May include surrounding context.

python
"Content-Type": "application/x-www-form-urlencoded"
    }
    
    response = requests.get(url, headers=headers)
    data = response.json()
    
    if data.get("code") != 0 and data.get("code") != 200:

Tainted flow: 'headers' from os.environ.get (line 16, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/check_tasks.py (reported line 21)May include surrounding context.

python
"Content-Type": "application/x-www-form-urlencoded"
    }
    
    response = requests.get(url, headers=headers)
    data = response.json()
    
    if data.get("code") != 0 and data.get("code") != 200:

Tainted flow: 'headers' from os.environ.get (line 15, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/fetch_pools.py (reported line 20)May include surrounding context.

python
"Content-Type": "application/x-www-form-urlencoded"
    }
    
    response = requests.get(url, headers=headers)
    data = response.json()
    if data.get("code") != 0 and data.get("code") != 200:
        print(f"Error: {data.get('msg')}")

Tainted flow: 'headers' from os.environ.get (line 27, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/list_my_tasks.py (reported line 42)May include surrounding context.

python
if task_status:
        params["taskStatus"] = str(task_status)
    
    response = requests.get(url, headers=headers, params=params)
    data = response.json()
    
    if data.get("code") != 0 and data.get("code") != 200:

Tainted flow: 'headers' from os.environ.get (line 25, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/submit_task.py (reported line 36)May include surrounding context.

python
"languageType": language_type
    }
    
    response = requests.post(url, headers=headers, json=payload)
    data = response.json()
    
    if data.get("code") != 0 and data.get("code") != 200:

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The description presents the skill as an operational Loudy.ai automation tool whose behavior is limited to Loudy.ai API interactions. However, the provided code chunk is not that tool logic; it is an installer. Its primary purpose is system setup: checking dependencies, creating directories, cloning a remote repository from GitHub, modifying permissions, and validating files locally. Those are materially different capabilities and resource accesses from the declared runtime behavior. While installer behavior can support the skill, the declared purpose says the tool only interacts with the Loudy.ai API, which is inconsistent with this code's actual network/system activity. Therefore this code chunk does not accurately match the declared description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

There is a material description/behavior mismatch. The declared description says the tool queries prize pools, submits task links, and tracks audit/payment status, and emphasizes that it only interacts with the Loudy.ai API with no Twitter/X auto-posting functionality. In the supplied code, Loudy.ai pool querying is implemented, and a submit_task function exists, but there is no code to track review status or payment status. There is also no scheduler or loop for periodic querying in the main execution path; it only fetches and displays current pools once. Most importantly, the display logic contains Binance-specific instructions that direct the user to install and use an external skill for generating and posting tweets to X/Twitter. Even though this script itself does not post to Twitter, that behavior is inconsistent with the strict claim that the tool only interacts with the Loudy.ai API and does not include Twitter/X-related functionality. Therefore the description overstates some implemented features and understates the external X/Twitter-related workflow embedded in the code.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

代码与声明在资源范围上基本一致，确实只与 loudy.ai API 交互，并使用 LOUDY_API_KEY；也没有出现未声明的 Twitter/X 自动发布等额外能力。但声明描述的是一个更完整的自动化工具：包含奖池查询、提交任务链接、定时追踪审核和支付状态。当前代码片段实际只实现了通过任务ID查询任务详情这一子功能，且是手动命令行触发的一次性检查，不具备定时执行或任务提交能力。因此描述对该代码片段的功能覆盖明显过宽，存在实质性描述与行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The code is limited to a single-purpose checker for ongoing Loudy.ai earning pools. It matches the narrow claim that it interacts only with the Loudy.ai API and uses LOUDY_API_KEY, and it does not show any Twitter/X automation. However, the declared description materially overstates the implemented functionality by claiming submission of task links and tracking of review/payment states, as well as periodic automatic querying after startup. None of those behaviors are present in this code chunk. Therefore the description does not accurately represent what the supplied code actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The code is broadly related to the declared loudy.ai automation scenario: it depends on LOUDY_API_KEY, runs periodically, and checks for current task/prize information. However, this specific code chunk only performs polling plus local state management: it writes JSON files, diffs current versus previous results, and creates a 'new tasks' marker file. More importantly, the declared description presents a broader tool that also submits task links and tracks review/payment status, but none of those capabilities appear in this chunk. That makes the actual behavior materially narrower than the declared functionality, while also adding undeclared local persistence/change-detection behavior. There is no evidence here of Twitter/X auto-posting, so that part of the description is consistent.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The code does match part of the description: it interacts only with the Loudy.ai API, requires LOUDY_API_KEY, and submits a task link. However, the declared purpose describes a broader automation tool with periodic querying of earning pools and tracking of review/payment status after startup, none of which appear in this code chunk. The code is only a manual submission script invoked via CLI arguments. There is no evidence of scheduling, polling, earning-pool querying, or status tracking. The Twitter/X note is mostly consistent because the script does not post to Twitter/X; it only submits a link that may be a tweet URL to Loudy.ai. Overall, the supplied chunk materially underimplements the declared behavior, so this is a mismatch between description and actual behavior of the provided code chunk.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

_KEY="你的API Key" export OPENCLAW_WORKSPACE="/root/.openclaw/workspace" # 可选，默认值

text

### 2. 配置 Cron 定时检查（可选）
```bash
# 方法1: 使用工作区安装路径（推荐）
SKILL_DIR="/root/.openclaw/workspace/skills/claw-loudyai-skill"
(crontab -l 2>/dev/null; echo "*/5 * * * * $SKILL_DIR/scripts/cron_check.sh") | crontab -

# 方法2: 如果安装到系统路径
(crontab -l 2>/dev/null; echo "*/5 * * * * /usr/lib/node_modules/openclaw/skills/loudy-ai-auto-task/scripts/cron_check.sh") | crontab -

3. 配置 Heartbeat 通知（可选）

在 HEARTBEAT.md 中添加：

text
## Loudy.ai 任务检查
检查工作区目录下的 loudy_has_new.txt 是否存在：
- 如果存在 → 读取 loudy_tasks.json 内容
- 发送消息通知用户
- 删除 loudy_has_new.txt

注意事项

  • ⚠️ API Key 安全：建议使用环境变量 export LOUDY_API_KEY=你的密钥，不要写入 TOOLS.md 或其他共享文件
  • 📝 文件系统访问

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

Piping directly into bash is dangerous because it chains network retrieval to shell execution in one step, eliminating review and increasing the blast radius of any compromise. In this skill's context, the installer may be run with elevated privileges to write into /usr/lib/node_modules/openclaw/skills, so a malicious or tampered script could gain broad system impact.

Content

Scanner excerpt · install.sh (reported line 3)May include surrounding context.

sh
#!/bin/bash
# Loudy.ai 自动任务 Skill 安装脚本
# 使用方法: curl -fsSL https://raw.githubusercontent.com/sfsf332/claw-loudyai-skill/main/install.sh | bash

set -e

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares access to an API key, external network endpoints, shell usage, filesystem writes, and optional cron persistence, but does not define any explicit tool scope or allowed-tools boundary. In an agent environment, missing capability restrictions increases the blast radius if the skill is misused, modified, or invoked in an unexpected context.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The skill explicitly transmits requests to an external service and uses X-API-Key authentication, which means sensitive credentials and user-submitted task data leave the local environment. External transmission is expected for this tool, but it still creates confidentiality and trust risks if the endpoint, logging, or downstream handling are not tightly controlled.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
## API 接口

### 1. 获取奖池列表
- **URL**: `GET https://api.loudy.ai/app-api/open-api/v1/earning-pools`
- **Header**: `X-API-Key: <LOUDY_API_KEY>`

### 2. 获取奖池详情

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

Fetching earning pool details from an external API exposes the environment to external data flows and reliance on a third-party service. While this is part of the skill's purpose, any use of an API key over the network can leak metadata or credentials through misconfiguration, debugging output, or compromised infrastructure.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md
- **Header**: `X-API-Key: <LOUDY_API_KEY>`

### 2. 获取奖池详情
- **URL**: `GET https://api.loudy.ai/app-api/open-api/v1/earning-pools/{id}`
- **Header**: `X-API-Key: <LOUDY_API_KEY>`

### 3. 提交任务

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

Submitting task links to an external API sends user-provided URLs and an API key off-host, which can expose sensitive operational data or allow unintended data disclosure if users submit private links. Because this is a write action to a third-party service, the impact is higher than simple read-only API calls if mishandled or triggered unintentionally.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

  • Header: X-API-Key: <LOUDY_API_KEY>

3. 提交任务

  • URL: POST https://api.loudy.ai/app-api/open-api/v1/earning-pool-tasks/submit
  • Header: X-API-Key: <LOUDY_API_KEY>
  • Body:
json

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The API example specifies "languageType": "zh_CN", which implies the skill operates in a fixed locale. The document does not state that this is optional, user-selectable, or required for a region-specific use case, so it appears to force a language/locale without opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

Listing tasks through the external API may reveal user activity, earning pool participation, and status metadata to the remote service and to any local logs capturing responses. This is expected behavior but still represents a privacy and credential-handling risk in an agent environment.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

text

### 4. 查询我的任务列表（分页）
- **URL**: `GET https://api.loudy.ai/app-api/open-api/v1/earning-pool-tasks`
- **Header**: `X-API-Key: <LOUDY_API_KEY>`
- **Query**:
  - `pageNo` - 页码（必填）

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

Task status lookups transmit authenticated requests to a third-party endpoint and may retrieve audit/payment-related metadata that could be sensitive in some workflows. The capability is legitimate, but the skill context makes secure handling of API keys and response data necessary.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md
- `taskStatus` - 任务状态（可选）

### 5. 查询任务状态
- **URL**: `GET https://api.loudy.ai/app-api/open-api/v1/earning-pool-tasks/{id}`
- **Header**: `X-API-Key: <LOUDY_API_KEY>`
- **返回字段**:
  - `taskStatus` - 任务状态

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

The documented cron setup establishes persistent execution every five minutes, which changes the system state beyond a single session and can continue making authenticated network calls without ongoing user awareness. Persistence is especially sensitive in agent skills because it can survive the initiating interaction and repeatedly access local files and external services.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

bash
# 方法1: 使用工作区安装路径（推荐）
SKILL_DIR="/root/.openclaw/workspace/skills/claw-loudyai-skill"
(crontab -l 2>/dev/null; echo "*/5 * * * * $SKILL_DIR/scripts/cron_check.sh") | crontab -

# 方法2: 如果安装到系统路径
(crontab -l 2>/dev/null; echo "*/5 * * * * /usr/lib/node_modules/openclaw/skills/loudy-ai-auto-task/scripts/cron_check.sh") | crontab -

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

Installing a cron entry pointing to a system path creates durable background execution and may run in contexts with broader privileges or different trust assumptions. In combination with API-key use and filesystem reads/writes, this persistence materially increases risk if the script is altered, replaced, or misunderstood.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

(crontab -l 2>/dev/null; echo "*/5 * * * * $SKILL_DIR/scripts/cron_check.sh") | crontab -

方法2: 如果安装到系统路径

(crontab -l 2>/dev/null; echo "*/5 * * * * /usr/lib/node_modules/openclaw/skills/loudy-ai-auto-task/scripts/cron_check.sh") | crontab -

text

### 3. 配置 Heartbeat 通知（可选）