Uandai Ai

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:19 AM UTC
• Version: 1.0.11

Overview

The skill is mostly coherent Uandai automation, but its Linux/macOS packaging steps can accidentally include and upload private key or certificate files from a workspace.

Review the packaging commands before installing or using this skill. On Linux/macOS, add missing exclusions for id_rsa, id_dsa, *.p12, and *.crt, and verify the final ZIP contains no secrets before uploading. Also treat the persisted Uandai API key as a sensitive local credential and only use delete or publishing actions when you explicitly intend them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: references/agent-packaging.md:259

Finding

Linux/macOS packaging may include and upload private keys and certificates

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (32)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

2. Install the **full skill folder** (`SKILL.md` + `references/`) under `~/.openclaw/skills/uandai-ai/` (preferred) or `<workspace>/skills/uandai-ai/` for local

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md

2. Install the **full skill folder** (`SKILL.md` + `references/`) under `~/.openclaw/skills/uandai-ai/` (preferred) or `<workspace>/skills/uandai-ai/` for local

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/agent-packaging.md (reported line 156)May include surrounding context.

md

--------------------------------------------------

   Exclude recursively:
   • .env (exact name only — NOT .env.example / .env.template)
   • secrets.json
   • credentials.json
   • id_rsa

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/agent-packaging.md (reported line 259)May include surrounding context.

md

--------------------------------------------------

   Exclude recursively:
   • .env (exact name only — NOT .env.example / .env.template)
   • secrets.json
   • credentials.json
   • id_rsa

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/agent-packaging.md (reported line 262)May include surrounding context.

md

--------------------------------------------------

   Exclude recursively:
   • .env (exact name only — NOT .env.example / .env.template)
   • secrets.json
   • credentials.json
   • id_rsa

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/agent-packaging.md (reported line 421)May include surrounding context.

md

--------------------------------------------------

   Exclude recursively:
   • .env (exact name only — NOT .env.example / .env.template)
   • secrets.json
   • credentials.json
   • id_rsa

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/agent-packaging.md (reported line 157)May include surrounding context.

md

Exclude recursively:
   • .env (exact name only — NOT .env.example / .env.template)
   • secrets.json
   • credentials.json
   • id_rsa
   • id_dsa

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/agent-packaging.md (reported line 259)May include surrounding context.

md

Exclude recursively:
   • .env (exact name only — NOT .env.example / .env.template)
   • secrets.json
   • credentials.json
   • id_rsa
   • id_dsa

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/agent-packaging.md (reported line 323)May include surrounding context.

md

Exclude recursively:
   • .env (exact name only — NOT .env.example / .env.template)
   • secrets.json
   • credentials.json
   • id_rsa
   • id_dsa

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/agent-packaging.md (reported line 158)May include surrounding context.

md

Exclude recursively:
   • .env (exact name only — NOT .env.example / .env.template)
   • secrets.json
   • credentials.json
   • id_rsa
   • id_dsa
   • *.pem

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/agent-packaging.md (reported line 259)May include surrounding context.

md

Exclude recursively:
   • .env (exact name only — NOT .env.example / .env.template)
   • secrets.json
   • credentials.json
   • id_rsa
   • id_dsa
   • *.pem

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/agent-packaging.md (reported line 323)May include surrounding context.

md

Exclude recursively:
   • .env (exact name only — NOT .env.example / .env.template)
   • secrets.json
   • credentials.json
   • id_rsa
   • id_dsa
   • *.pem

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/agent-packaging.md (reported line 265)May include surrounding context.

md

# C) Remove any .env files that slipped in (keep .env.example)
   Get-ChildItem $Staging -Recurse -Force -File |
     Where-Object {
       $_.Name -eq '.env' -or (
         $_.Name -like '*.env' -and
         $_.Name -notlike '*.example' -and
         $_.Name -notlike '*.template'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/agent-packaging.md (reported line 266)May include surrounding context.

md

# C) Remove any .env files that slipped in (keep .env.example)
   Get-ChildItem $Staging -Recurse -Force -File |
     Where-Object {
       $_.Name -eq '.env' -or (
         $_.Name -like '*.env' -and
         $_.Name -notlike '*.example' -and
         $_.Name -notlike '*.template'

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/agent-packaging.md (reported line 323)May include surrounding context.

md

# C) Remove any .env files that slipped in (keep .env.example)
   Get-ChildItem $Staging -Recurse -Force -File |
     Where-Object {
       $_.Name -eq '.env' -or (
         $_.Name -like '*.env' -and
         $_.Name -notlike '*.example' -and
         $_.Name -notlike '*.template'

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

• Category: YARA Match
• Confidence: 70% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/openclaw-integration.md (reported line 167)May include surrounding context.

md

t URL, gateway base, and session key (also on Workspace → agent → **Integration**)
- Readiness states (provisioning / failed)
- JWT vs raw API key on `/openclaw`
- What is blocked for subscribers

Read bundled `references/openclaw-integration.md` in the `uandai-ai` skill folder before acting. Live `{API_ORIGIN}/docs/openclaw-integration` is for humans unless pasted in chat.

**Postman (Hydra API):** trainer gallery folders `agent-media/` (`01` proxy; `01c`–`01e` direct upload) and public `listings-public/` under `hydra_mvp/postman/collections/Hydra MVP/` — see `hydra_mvp/docs/api-testing.md`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/programmatic-api.md (reported line 48)May include surrounding context.

md

Response: `{ "access_token", "refresh_token", "user" }` — **no cookie**.

Access tokens include a `sid` (session id) claim. If the API key or bound session is revoked, access tokens fail **immediately** — not after expiry.

### Token lifecycle

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/programmatic-api.md (reported line 48)May include surrounding context.

md

Response: `{ "access_token", "refresh_token", "user" }` — **no cookie**.

Access tokens include a `sid` (session id) claim. If the API key or bound session is revoked, access tokens fail **immediately** — not after expiry.

### Token lifecycle

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md

6. Complete price, model, provider URL (when required), invocation settings via **uandai.ai app** or `POST /agents/{id}/proposals` — **do not** ask for provider API keys (`{PROVIDER}_KEY`); subscribers supply those at subscribe/invoke
7. `PATCH /agents/{id}/proposals/{proposal_id}` with `status=submitted` when ready for review (Step 4 in create wizard, or manage **For Approval** tab)
8. After admin approval, subscribers can invoke
9. Optional: `DELETE /agents/{agent_id}` when the trainer wants to remove an agent they own (see [Delete agent](#delete-agent-trainer))

**Full ZIP upload (all metadata at POST):**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/programmatic-api.md (reported line 82)May include surrounding context.

md

6. Complete price, model, provider URL (when required), invocation settings via **uandai.ai app** or `POST /agents/{id}/proposals` — **do not** ask for provider API keys (`{PROVIDER}_KEY`); subscribers supply those at subscribe/invoke
7. `PATCH /agents/{id}/proposals/{proposal_id}` with `status=submitted` when ready for review (Step 4 in create wizard, or manage **For Approval** tab)
8. After admin approval, subscribers can invoke
9. Optional: `DELETE /agents/{agent_id}` when the trainer wants to remove an agent they own (see [Delete agent](#delete-agent-trainer))

**Full ZIP upload (all metadata at POST):**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/programmatic-api.md (reported line 369)May include surrounding context.

Permanently remove a trainer-owned agent when it has no active operational dependencies.

http

DELETE /agents/{agent_id}
Authorization: Bearer <access_token>

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/programmatic-api.md (reported line 373)May include surrounding context.

Authorization: Bearer <access_token>

text

Legacy path: `DELETE /api/agents/{agent_id}` (same contract).

#### Prerequisites — collect before DELETE

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/programmatic-api.md (reported line 446)May include surrounding context.

GET /agents/{agent_id}/media PATCH /agents/{agent_id}/media/{media_id} PUT /agents/{agent_id}/media/reorder DELETE /agents/{agent_id}/media/{media_id} Authorization: Bearer <access_token>

text

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High

• Category: YARA Match
• Confidence: 70% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · references/programmatic-api.md (reported line 510)May include surrounding context.

"duration_sec": 28 }

text

`null` when no video in the published set.

#### Approve semantics

On admin approve: **copy/replace** — new `scope=published` rows with **new** `media_id`s; **reuse** `storage_ref_json` verbatim (pointer copy); delete superseded published blobs only when refcount → 0. Draft proposal rows remain for admin diff.

#### Postman

Folders: `postman/collections/Hydra MVP/agent-media/` (`01` proxy upload; `01c`–`01e` direct session → PUT → complete) and `listings-public/` (see `hydra_mvp/docs/api-testing.md`).

### List subscriptions

```http
GET /v1/me/subscriptions?agent_id={id}&limit=20
Authorization: Bearer <access_token>

Optional query: agent_id (filter), limit (max 100).

Renew toggle (subscriber): PATCH /v1/me/subscriptions/{subscription_id} with JSON { "is_renew_enabled": true|false }.

Subscription checkout (POST /v1/me/subscription-requests) and Stripe flows remain browser/app only — not API-key au

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/programmatic-api.md (reported line 563)May include surrounding context.

md

| `is_invokable` | `false` when archived, expired, or not entitled |
| `revision_no` | Current revision when live; needed for invoke |

**Archived activations:** After trainer `DELETE /agents/{agent_id}`, past subscriptions stay listed with `agent_removed: true` and `is_invokable: false`. Invoke, config PATCH, and OpenClaw readiness for that agent stop working; run history remains queryable via executions.

### Activation detail (subscriber)

Static analysis

No suspicious patterns detected.