ClawHub
Back to skill

Security audit

QwryAI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed read-only connector for a QwryAI workspace and does not include hidden code, persistence, or write/admin actions.

Install this only if you have a QwryAI workspace and intend to let OpenClaw read its chatbot, conversation, knowledge, and analytics data. Use a read-only, revocable key, keep it in an environment variable or secret manager when possible, avoid committing local MCP config, and do not override endpoints away from the official QwryAI API unless you fully trust that environment.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (16)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

md
description: Connect OpenClaw to a paid QwryAI workspace through the read-only QwryAI MCP and public API integration surface.
version: 0.1.0
homepage: https://qwryai.com
metadata: {"openclaw":{"requires":{"env":["QWRYAI_API_KEY"]},"primaryEnv":"QWRYAI_API_KEY","envVars":[{"name":"QWRYAI_API_KEY","required":true,"sensitive":true,"description":"QwryAI tenant API key generated from Developer & Agent Access."},{"name":"QWRYAI_MCP_URL","required":false,"description":"Optional QwryAI MCP endpoint. Defaults to https://api.qwryai.com/mcp."},{"name":"QWRYAI_API_URL","required":false,"description":"Optional QwryAI public API endpoint. Defaults to https://api.qwryai.com/public/v1."}],"emoji":"\\u26A1","homepage":"https://qwryai.com"}}
---

# QwryAI Agent Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 25)May include surrounding context.

md
description: Connect OpenClaw to a paid QwryAI workspace through the read-only QwryAI MCP and public API integration surface.
version: 0.1.0
homepage: https://qwryai.com
metadata: {"openclaw":{"requires":{"env":["QWRYAI_API_KEY"]},"primaryEnv":"QWRYAI_API_KEY","envVars":[{"name":"QWRYAI_API_KEY","required":true,"sensitive":true,"description":"QwryAI tenant API key generated from Developer & Agent Access."},{"name":"QWRYAI_MCP_URL","required":false,"description":"Optional QwryAI MCP endpoint. Defaults to https://api.qwryai.com/mcp."},{"name":"QWRYAI_API_URL","required":false,"description":"Optional QwryAI public API endpoint. Defaults to https://api.qwryai.com/public/v1."}],"emoji":"\\u26A1","homepage":"https://qwryai.com"}}
---

# QwryAI Agent Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 32)May include surrounding context.

md
description: Connect OpenClaw to a paid QwryAI workspace through the read-only QwryAI MCP and public API integration surface.
version: 0.1.0
homepage: https://qwryai.com
metadata: {"openclaw":{"requires":{"env":["QWRYAI_API_KEY"]},"primaryEnv":"QWRYAI_API_KEY","envVars":[{"name":"QWRYAI_API_KEY","required":true,"sensitive":true,"description":"QwryAI tenant API key generated from Developer & Agent Access."},{"name":"QWRYAI_MCP_URL","required":false,"description":"Optional QwryAI MCP endpoint. Defaults to https://api.qwryai.com/mcp."},{"name":"QWRYAI_API_URL","required":false,"description":"Optional QwryAI public API endpoint. Defaults to https://api.qwryai.com/public/v1."}],"emoji":"\\u26A1","homepage":"https://qwryai.com"}}
---

# QwryAI Agent Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 38)May include surrounding context.

md
description: Connect OpenClaw to a paid QwryAI workspace through the read-only QwryAI MCP and public API integration surface.
version: 0.1.0
homepage: https://qwryai.com
metadata: {"openclaw":{"requires":{"env":["QWRYAI_API_KEY"]},"primaryEnv":"QWRYAI_API_KEY","envVars":[{"name":"QWRYAI_API_KEY","required":true,"sensitive":true,"description":"QwryAI tenant API key generated from Developer & Agent Access."},{"name":"QWRYAI_MCP_URL","required":false,"description":"Optional QwryAI MCP endpoint. Defaults to https://api.qwryai.com/mcp."},{"name":"QWRYAI_API_URL","required":false,"description":"Optional QwryAI public API endpoint. Defaults to https://api.qwryai.com/public/v1."}],"emoji":"\\u26A1","homepage":"https://qwryai.com"}}
---

# QwryAI Agent Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 52)May include surrounding context.

md
description: Connect OpenClaw to a paid QwryAI workspace through the read-only QwryAI MCP and public API integration surface.
version: 0.1.0
homepage: https://qwryai.com
metadata: {"openclaw":{"requires":{"env":["QWRYAI_API_KEY"]},"primaryEnv":"QWRYAI_API_KEY","envVars":[{"name":"QWRYAI_API_KEY","required":true,"sensitive":true,"description":"QwryAI tenant API key generated from Developer & Agent Access."},{"name":"QWRYAI_MCP_URL","required":false,"description":"Optional QwryAI MCP endpoint. Defaults to https://api.qwryai.com/mcp."},{"name":"QWRYAI_API_URL","required":false,"description":"Optional QwryAI public API endpoint. Defaults to https://api.qwryai.com/public/v1."}],"emoji":"\\u26A1","homepage":"https://qwryai.com"}}
---

# QwryAI Agent Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md
description: Connect OpenClaw to a paid QwryAI workspace through the read-only QwryAI MCP and public API integration surface.
version: 0.1.0
homepage: https://qwryai.com
metadata: {"openclaw":{"requires":{"env":["QWRYAI_API_KEY"]},"primaryEnv":"QWRYAI_API_KEY","envVars":[{"name":"QWRYAI_API_KEY","required":true,"sensitive":true,"description":"QwryAI tenant API key generated from Developer & Agent Access."},{"name":"QWRYAI_MCP_URL","required":false,"description":"Optional QwryAI MCP endpoint. Defaults to https://api.qwryai.com/mcp."},{"name":"QWRYAI_API_URL","required":false,"description":"Optional QwryAI public API endpoint. Defaults to https://api.qwryai.com/public/v1."}],"emoji":"\\u26A1","homepage":"https://qwryai.com"}}
---

# QwryAI Agent Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
description: Connect OpenClaw to a paid QwryAI workspace through the read-only QwryAI MCP and public API integration surface.
version: 0.1.0
homepage: https://qwryai.com
metadata: {"openclaw":{"requires":{"env":["QWRYAI_API_KEY"]},"primaryEnv":"QWRYAI_API_KEY","envVars":[{"name":"QWRYAI_API_KEY","required":true,"sensitive":true,"description":"QwryAI tenant API key generated from Developer & Agent Access."},{"name":"QWRYAI_MCP_URL","required":false,"description":"Optional QwryAI MCP endpoint. Defaults to https://api.qwryai.com/mcp."},{"name":"QWRYAI_API_URL","required":false,"description":"Optional QwryAI public API endpoint. Defaults to https://api.qwryai.com/public/v1."}],"emoji":"\\u26A1","homepage":"https://qwryai.com"}}
---

# QwryAI Agent Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
description: Connect OpenClaw to a paid QwryAI workspace through the read-only QwryAI MCP and public API integration surface.
version: 0.1.0
homepage: https://qwryai.com
metadata: {"openclaw":{"requires":{"env":["QWRYAI_API_KEY"]},"primaryEnv":"QWRYAI_API_KEY","envVars":[{"name":"QWRYAI_API_KEY","required":true,"sensitive":true,"description":"QwryAI tenant API key generated from Developer & Agent Access."},{"name":"QWRYAI_MCP_URL","required":false,"description":"Optional QwryAI MCP endpoint. Defaults to https://api.qwryai.com/mcp."},{"name":"QWRYAI_API_URL","required":false,"description":"Optional QwryAI public API endpoint. Defaults to https://api.qwryai.com/public/v1."}],"emoji":"\\u26A1","homepage":"https://qwryai.com"}}
---

# QwryAI Agent Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
description: Connect OpenClaw to a paid QwryAI workspace through the read-only QwryAI MCP and public API integration surface.
version: 0.1.0
homepage: https://qwryai.com
metadata: {"openclaw":{"requires":{"env":["QWRYAI_API_KEY"]},"primaryEnv":"QWRYAI_API_KEY","envVars":[{"name":"QWRYAI_API_KEY","required":true,"sensitive":true,"description":"QwryAI tenant API key generated from Developer & Agent Access."},{"name":"QWRYAI_MCP_URL","required":false,"description":"Optional QwryAI MCP endpoint. Defaults to https://api.qwryai.com/mcp."},{"name":"QWRYAI_API_URL","required":false,"description":"Optional QwryAI public API endpoint. Defaults to https://api.qwryai.com/public/v1."}],"emoji":"\\u26A1","homepage":"https://qwryai.com"}}
---

# QwryAI Agent Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
description: Connect OpenClaw to a paid QwryAI workspace through the read-only QwryAI MCP and public API integration surface.
version: 0.1.0
homepage: https://qwryai.com
metadata: {"openclaw":{"requires":{"env":["QWRYAI_API_KEY"]},"primaryEnv":"QWRYAI_API_KEY","envVars":[{"name":"QWRYAI_API_KEY","required":true,"sensitive":true,"description":"QwryAI tenant API key generated from Developer & Agent Access."},{"name":"QWRYAI_MCP_URL","required":false,"description":"Optional QwryAI MCP endpoint. Defaults to https://api.qwryai.com/mcp."},{"name":"QWRYAI_API_URL","required":false,"description":"Optional QwryAI public API endpoint. Defaults to https://api.qwryai.com/public/v1."}],"emoji":"\\u26A1","homepage":"https://qwryai.com"}}
---

# QwryAI Agent Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md
description: Connect OpenClaw to a paid QwryAI workspace through the read-only QwryAI MCP and public API integration surface.
version: 0.1.0
homepage: https://qwryai.com
metadata: {"openclaw":{"requires":{"env":["QWRYAI_API_KEY"]},"primaryEnv":"QWRYAI_API_KEY","envVars":[{"name":"QWRYAI_API_KEY","required":true,"sensitive":true,"description":"QwryAI tenant API key generated from Developer & Agent Access."},{"name":"QWRYAI_MCP_URL","required":false,"description":"Optional QwryAI MCP endpoint. Defaults to https://api.qwryai.com/mcp."},{"name":"QWRYAI_API_URL","required":false,"description":"Optional QwryAI public API endpoint. Defaults to https://api.qwryai.com/public/v1."}],"emoji":"\\u26A1","homepage":"https://qwryai.com"}}
---

# QwryAI Agent Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · manifest.yaml (reported line 20)May include surrounding context.

yaml
description: Connect OpenClaw to a paid QwryAI workspace through the read-only QwryAI MCP and public API integration surface.
version: 0.1.0
homepage: https://qwryai.com
metadata: {"openclaw":{"requires":{"env":["QWRYAI_API_KEY"]},"primaryEnv":"QWRYAI_API_KEY","envVars":[{"name":"QWRYAI_API_KEY","required":true,"sensitive":true,"description":"QwryAI tenant API key generated from Developer & Agent Access."},{"name":"QWRYAI_MCP_URL","required":false,"description":"Optional QwryAI MCP endpoint. Defaults to https://api.qwryai.com/mcp."},{"name":"QWRYAI_API_URL","required":false,"description":"Optional QwryAI public API endpoint. Defaults to https://api.qwryai.com/public/v1."}],"emoji":"\\u26A1","homepage":"https://qwryai.com"}}
---

# QwryAI Agent Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · manifest.yaml (reported line 24)May include surrounding context.

yaml
description: Connect OpenClaw to a paid QwryAI workspace through the read-only QwryAI MCP and public API integration surface.
version: 0.1.0
homepage: https://qwryai.com
metadata: {"openclaw":{"requires":{"env":["QWRYAI_API_KEY"]},"primaryEnv":"QWRYAI_API_KEY","envVars":[{"name":"QWRYAI_API_KEY","required":true,"sensitive":true,"description":"QwryAI tenant API key generated from Developer & Agent Access."},{"name":"QWRYAI_MCP_URL","required":false,"description":"Optional QwryAI MCP endpoint. Defaults to https://api.qwryai.com/mcp."},{"name":"QWRYAI_API_URL","required":false,"description":"Optional QwryAI public API endpoint. Defaults to https://api.qwryai.com/public/v1."}],"emoji":"\\u26A1","homepage":"https://qwryai.com"}}
---

# QwryAI Agent Access

External Transmission

Medium
Category
Data Exfiltration
Confidence
74% confidence
Finding

The skill permits overriding QWRYAI_API_URL via environment variable, which could redirect requests to an attacker-controlled host if the runtime or deployment environment is compromised or misconfigured. Because the integration uses a sensitive bearer credential, an unsafe override could expose API traffic or tokens outside the intended vendor boundary.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

bash
export QWRYAI_API_KEY=<your-qwryai-api-key>
export QWRYAI_MCP_URL=https://api.qwryai.com/mcp
export QWRYAI_API_URL=https://api.qwryai.com/public/v1

OpenClaw MCP Definition

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The MCP configuration instructs clients to send Authorization: Bearer ${QWRYAI_API_KEY} to a remote service and even suggests pasting the API key directly into local config if interpolation is unavailable. While expected for authentication, embedding long-lived secrets in client configuration materially increases the chance of accidental disclosure through local files, screenshots, backups, or source control.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

json
{
  "url": "https://api.qwryai.com/mcp",
  "headers": {
    "Authorization": "Bearer ${QWRYAI_API_KEY}"
  }

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This configuration again directs a client to include a bearer API key in outbound requests to a remote MCP server. The transmission is expected, but the pattern is still risky because client-side static secrets can leak through configuration files, logs, plugin exports, or misrouted requests if host validation is weak.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
{
  "mcpServers": {
    "qwryai": {
      "url": "https://api.qwryai.com/mcp",
      "headers": {
        "Authorization": "Bearer ${QWRYAI_API_KEY}"
      }

Static analysis

No suspicious patterns detected.