Security audit

Super Admapix

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent ad-analytics purpose, but it automatically stores and forwards API keys and user queries to hosted services using unsafe shell-command patterns.

Review before installing. Use this only if you are comfortable storing an AdMapix API key in OpenClaw config, having complex queries and context processed by AdMapix-hosted deep research, and receiving externally hosted shareable report links. Avoid pasting keys directly into chat, avoid confidential strategy prompts unless the service's data handling is acceptable, and prefer a pinned installer and a scoped or revocable API key.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:155
Finding: AdMapix API Key and User Context Forwarded to a Secondary Service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:157
Finding: Hard-Coded Shared Bearer Token for the Deep-Research Service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:151
Finding: Shell Command Injection Through User Query and Context Substitution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:84
Finding: Shell Injection and Unsafe Secret Handling in Automatic API-Key Configuration
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:130
Finding: Forced External Report Routing and Promotional Output Injection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:18
Finding: Unpinned Package Execution in Installation Instructions
Content: View full analysis
Remediation: View remediation
`. - Document the expected package registry and trusted publisher identity. - Provide integrity verification using a cryptographic hash or signed release artifact. - Prefer reproducible installation through a lockfile or a verified standalone installer. - Review package lifecycle scripts and transitive dependencies before recommending execution. - Configure continuous dependency monitoring and require review before updating the pinned version. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (38)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill tells the agent to take a user-pasted API key and persist it into local configuration automatically. That expands scope from transient request handling into credential storage, creating risk of unintended retention, reuse across sessions, and exposure to other skills or operators without explicit informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill instructs the agent to store a user-provided API key without warning the user that the credential will be persisted in configuration. Storing secrets without transparent notice and consent is dangerous because users may assume the key is used only transiently for the current task.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill routes queries to a separate deepresearch service and explicitly includes the user's AdMapix API key in the POST body to that third party. Forwarding a credential to another service materially increases exposure and trust boundaries, especially because the user is not given a clear opt-in for credential sharing.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill directs sending the user's API key to the deep research service without a clear user-facing warning or consent step. Silent credential forwarding violates user expectations and creates a significant risk if the external service logs, stores, or misuses the key.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 458)May include surrounding context.
md
**Reuse data:** If the user asks follow-up questions about already-fetched data, analyze existing results first. Only make new API calls when needed. ## Output Guidelines 1. **Language consistency** — ALL output (headers, labels, insights, hints, errors, disclaimers) must match the user's detected language. See "Language Handling" section above. 2. **Route-appropriate output** — Don't force H5 links on analytical questions; don't dump tables for browsing

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README states Deep Research is automatically triggered for questions requiring 2+ API calls, which is broad enough to cause unexpected escalation from simple query handling to server-side autonomous analysis. Ambiguous activation criteria can lead to unintended data transmission, extra cost, and processing of sensitive user prompts without clear user awareness or consent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The README instructs users to execute npx clawhub install admapix without pinning a specific version, which makes installation dependent on whatever package version is current at execution time. If the package, dependency chain, or publishing account is compromised, users could unknowingly install and run attacker-controlled code.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README describes a server-side AI research engine that autonomously plans investigations and synthesizes findings, but it does not clearly warn users that their queries and derived data are sent off-platform for remote processing. This omission is dangerous because users may submit sensitive competitive, business, or internal strategy questions without understanding the disclosure and hosting implications.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The listed trigger conditions for Deep Research remain open-ended, including 'any question requiring 2+ API calls or cross-entity reasoning,' which does not set meaningful safety boundaries. In practice, this can cause normal user requests to be routed to a more expansive server-side workflow that aggregates and retains more information than the user likely expects.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README notes that reports are 'hosted and shareable via link' but does not provide an explicit security warning that externally hosted links may expose sensitive analysis to unintended parties if shared, guessed, or mishandled. For a market-intelligence skill, generated reports may contain commercially sensitive insights, making silent external hosting materially risky.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README states that deep research is automatically triggered for any question requiring more than two API calls, which is an overly broad activation rule for a feature that performs autonomous multi-step server-side analysis. This can lead to unintended data transmission, excess cost, and unexpected execution scope when users ask seemingly ordinary analytical questions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The installation command uses npx clawhub without pinning a specific version, which can cause users to fetch and execute whatever version is current at install time. This creates a supply-chain risk: a compromised or maliciously updated package could run arbitrary code on the user's machine during installation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation describes a server-side AI research engine that autonomously performs many API calls and returns hosted HTML reports, but it does not prominently warn users that their queries and derived analysis are sent off-device and processed remotely. This omission can cause users to disclose sensitive business questions or identifiers without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The statement that reports are hosted online and shareable by link introduces a concrete data exposure risk, especially for competitive intelligence, app strategy, or internal market-analysis queries that may be sensitive. If links are guessable, mis-shared, or insufficiently access-controlled, confidential analytical content could be exposed to unauthorized parties.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This instruction mandates automatic language detection from the first user message and continued use of that language, which imposes a language/locale policy without explicit user choice. The later allowance for mid-conversation switching helps, but it still defaults to enforced language behavior rather than opt-in selection.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
bash
# GET curl -s "https://api.admapix.com/api/data/{endpoint}?{params}" \ -H "X-API-Key: $ADMAPIX_API_KEY" # POST

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
bash
# GET curl -s "https://api.admapix.com/api/data/{endpoint}?{params}" \ -H "X-API-Key: $ADMAPIX_API_KEY" # POST

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
bash
# GET curl -s "https://api.admapix.com/api/data/{endpoint}?{params}" \ -H "X-API-Key: $ADMAPIX_API_KEY" # POST

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
bash
# GET curl -s "https://api.admapix.com/api/data/{endpoint}?{params}" \ -H "X-API-Key: $ADMAPIX_API_KEY" # POST

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
Run this command first to verify the API key is valid:

bash
curl -s -o /dev/null -w "%{http_code}" https://api.admapix.com/api/data/quota -H "X-API-Key: $ADMAPIX_API_KEY"

If it returns 200 → key is valid, proceed to Step 1.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases include very broad everyday language such as generic search/show verbs, which can cause the skill to activate on loosely related requests. Overbroad routing increases the chance of unintended external API calls, data transmission, or use of stored credentials when the user did not clearly intend to invoke this skill.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill's instructions are internally inconsistent: it says not to expose upstream URLs or internal details, yet earlier requires returning a deepresearch report URL directly. This can leak implementation topology and encourages bypassing abstraction boundaries, though the impact is lower than direct secret handling.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 343)May include surrounding context.
md
"playHtmlFp": [], "playHtmlUrl": [], "demoadCnt": 1, "appList": [ { "id": "6498883328", "cnt": null,

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 383)May include surrounding context.
md
"playHtmlFp": [], "playHtmlUrl": [], "demoadCnt": 1, "appList": [ { "id": "6498883328", "cnt": null,

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · references/api-creative.md (reported line 123)May include surrounding context.
md
"playHtmlFp": [], "playHtmlUrl": [], "demoadCnt": 1, "appList": [ { "id": "6498883328", "cnt": null,

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:157