Qordinate - Durable lists, facts, and reminders for OpenClaw agents.

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:53 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed third-party memory integration, but it gives the agent broad discretion to send durable personal or business information through the user's chat accounts.

Review this before installing if the agent can see emails, chats, files, contacts, leads, or business tasks. Use it only when you are comfortable with selected information being sent to Qordinate through WhatsApp, Telegram, or Slack and stored durably; require explicit confirmation for sensitive items and avoid passwords, tokens, private communications, regulated data, and confidential file contents.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILLS.md:143
• Finding: Overbroad Autonomous Disclosure to Third-Party Structured Memory## Vulnerability Details **File Location**: `SKILLS.md`, lines 35, 50, 101, and 143-144 **Vulnerability Type**: `other: Excessive External Data Disclosure` **Risk Level**: Medium ### Vulnerable Snippets `SKILLS.md:35`: ```markdown > Your OpenClaw setup must already be able to send messages on one of these channels as the user (e.g. controlling the desktop/web client). This skill tells the agent **what to say**. ``` `SKILLS.md:50`: ```markdown Once that's done, your agent can start sending messages to that same chat window. ``` `SKILLS.md:101`: ```markdown - The agent can include where it came from (email, chat, file) so Qordinate can link back later. ``` `SKILLS.md:143-144`: ```markdown - Treat Qordinate as the source of truth for "what needs doing" and "who is who" across time. - Whenever the agent thinks "the user will care about this later", it should create or update something in a list, not keep it in ephemeral memory. ``` ### Technical Analysis The skill instructs an agent operating through the user's authenticated WhatsApp, Telegram, or Slack session to send information to Qordinate for durable third-party storage. It permits the agent to include information originating from emails, chats, and files and broadly directs it to store anything it determines the user may care about later. Although the external service and initial account setup are disclosed to the user, the documented workflow does not require per-record confirmation, sensitivity classification, data minimization, or a transmission preview. It also does not prohibit sending credentials, confidential communications, personal contact information, private links, or sensitive file-derived content. Consequently, the agent's discretionary decision about what is worth remembering becomes an external disclosure boundary. Treating the service as the source of truth further encourages broad and persistent transfer rather than selective st ...[truncated 2048 chars]
• Remediation: ## Remediation Suggestions 1. Require explicit user confirmation before every external write, including creation, update, and source-context attachment. 2. Display a transmission preview containing the destination service, channel, list name, and exact fields that will be sent. 3. Replace the broad “whenever the agent thinks” instruction with an allowlist of user-approved information categories. 4. Explicitly prohibit transmission of passwords, API keys, authentication tokens, OTPs, financial data, health data, government identifiers, private communications, and confidential file contents. 5. Apply data minimization by sending only the fields necessary for the requested memory operation. 6. Disable inclusion of email, chat, or file source material by default. Require separate consent before attaching source excerpts or identifiers. 7. Prefer local or ephemeral storage unless the user explicitly selects third-party persistence for the specific item. 8. Document retention, deletion, export, access-control, and account-recovery behavior before recommending the service as a source of truth. 9. Provide commands that let users inspect, correct, and delete externally stored records. 10. Maintain an audit log of approved transmissions without duplicating sensitive content in plaintext logs.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Exfiltration Commands

High

• Category: Prompt Injection

Content

Instead of your OpenClaw agent trying to keep all state in its own scratchpad or a custom DB, it can:

- send messages to Qordinate on **WhatsApp, Telegram, or Slack**
- use a simple, structured text protocol to:
  - store **facts** (preferences, flags, config)
  - maintain **lists** (tasks, contacts, leads, etc.)

• Confidence: 90% confidence
• Finding: The skill's core function is to send structured memory content to an external service over chat platforms, which is a form of data exfiltration from the agent environment to third parties. In context this appears product-driven rather than overtly malicious, but it is still dangerous because the agent may transmit sensitive user or business data, including contacts, tasks, flags, and configuration, outside the original trust boundary.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly encourages offloading long-term facts, tasks, reminders, preferences, flags, config, and contact details to third-party messaging channels and an external service, but it does not require informed user consent, data minimization, or any privacy/security disclosure. This creates a real risk of unintended disclosure of sensitive personal or operational data to external processors and chat platforms.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The setup flow nudges users into phone-number-based signup and specific messaging channels without presenting a privacy-sensitive choice model or requiring explicit consent for channel selection. While not overtly malicious, this can pressure users into exposing identifiers and using less private channels than they would otherwise choose.

Static analysis

No suspicious patterns detected.