ClawHub
Back to skill

Security audit

Qordinate - Durable lists, facts, and reminders for OpenClaw agents.

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed Qordinate memory integration, but it gives agents broad permission to send durable user and agent context to third-party chat services without clear limits.

Install only if you are comfortable with agents sending selected memory records to Qordinate and the connected WhatsApp, Telegram, or Slack account. Before use, set strict rules that secrets, credentials, financial or health data, private documents, and unnecessary source excerpts must not be stored, and require confirmation before writing sensitive or private information.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILLS.md:17
Finding

Unbounded Disclosure of User and Agent Data to Third-Party Services

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
97% confidence
Finding

The skill's core behavior is to have the agent send structured memory contents to external messaging channels, which is effectively an exfiltration path from the agent environment to third-party services. Even if intended as product functionality, it is dangerous in a security review context because the transmitted content includes facts, preferences, flags, config, tasks, and source-linked context, and there are no restrictions preventing leakage of sensitive or confidential information.

Content

Scanner excerpt · SKILLS.md (reported line 17)May include surrounding context.

md
Instead of your OpenClaw agent trying to keep all state in its own scratchpad or a custom DB, it can:

- send messages to Qordinate on **WhatsApp, Telegram, or Slack**
- use a simple, structured text protocol to:
  - store **facts** (preferences, flags, config)
  - maintain **lists** (tasks, contacts, leads, etc.)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly instructs agents to offload long-term facts, tasks, reminders, and related context to third-party chat platforms and the Qordinate service without any guardrails around user consent, data minimization, or sensitivity filtering. This creates a real privacy and security risk because agent memory may contain personal data, credentials, business context, or other sensitive information that would be exfiltrated outside the agent's primary trust boundary.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.