Security audit

Qqbot Persona

Security checks for vulnerabilities and agentic risk

Overview

This QQ persona skill is not clearly malicious, but it needs Review because it installs a persistent bootstrap hook that can replace trusted persona instructions, read unrestricted local files into prompts, and log QQ identifiers.

Install only if you are comfortable giving this skill persistent control over QQ-session persona bootstrap instructions. Keep personas.json and persona files writable only by trusted administrators, avoid absolute file: paths, remove any persona rules that hide AI identity, and treat hook.log as sensitive because it records session and OpenID metadata.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: hooks/handler.js:214
Finding: Critical-priority bootstrap instruction hijacking through SOUL.md replacement
Content: View full analysis
f.path !== 'SOUL.md' && f.path !== 'NIGHT_POET_PERSONA.md' && f.path !== 'QQBOT_PERSONA.md' ); // 注入 QQ 机器人人设（最高优先级） event.context.bootstrapFiles.unshift({ path: 'SOUL.md', content: injectionContent, virtual: true, priority: 'critical', }); appendLog(`Persona INJECTED: ${persona.name} (${event.context.bootstrapFiles.length} files total)`); } ``` ### Technical Analysis The hook removes existing identity-related bootstrap files and replaces them with a virtual file named `SOUL.md`. The replacement is assigned `critical` priority and contains an explicit instruction to ignore the default OpenClaw persona. The selected persona's `soul` value is interpolated directly into this critical-priority bootstrap content. No validation distinguishes harmless style preferences from operational instructions, safety-constraint changes, identity overrides, or instructions ...[truncated 2225 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: hooks/handler.js:80
Finding: Arbitrary local file read through unrestricted persona file references
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: hooks/handler.js:39
Finding: Persistent plaintext logging of QQ session identifiers and OpenIDs
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Ssd 1

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The injected text explicitly instructs the model to ignore the default persona and adopt a mandatory replacement identity, giving configuration-controlled content high semantic authority over system behavior. In this skill context, that is dangerous because any compromised or malicious persona content can override expected assistant constraints, manipulate outputs across QQ sessions, and amplify the impact of prompt injection sourced from local files or config.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: 该文件从标题到正文全部以中文编写，未说明这是面向特定中文地区用户的受限文档，也未提供其他语言选项或用户选择机制。根据规则，强制特定语言而无用户选择或明确、合理的区域性说明，属于自然语言政策风险。
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · QUICKSTART.md (reported line 46)May include surrounding context.
bash
# 在目标机器上 mkdir -p ~/.openclaw/workspace/skills/ cp -r qqbot-persona ~/.openclaw/workspace/skills/

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · QUICKSTART.md (reported line 46)May include surrounding context.
bash
# 在目标机器上 mkdir -p ~/.openclaw/workspace/skills/ cp -r qqbot-persona ~/.openclaw/workspace/skills/

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The example persona explicitly instructs the bot to deny or conceal that it is an AI, which is a deceptive behavioral directive. In a multi-persona skill, such instructions can be selectively applied per user or group, increasing the risk of impersonation, trust manipulation, and policy circumvention in real conversations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This manifest uses Chinese-only natural-language descriptions for the skill, including its primary description and user-facing metadata. Under the stated policy, forcing a specific language without user opt-in or justification is a locale-policy violation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The hook accepts file: references from persona configuration and reads either absolute paths or relative paths resolved from the config directory without any allowlist or path traversal protections. In this skill context, persona text is later injected into the model prompt, so an attacker who can modify personas.json can exfiltrate arbitrary local files such as secrets, prompts, or tokens into model context and potentially into responses.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: extractOpenID() returns the trailing identifier from both direct and group session formats, so group IDs can be treated as OpenIDs during byOpenID matching. This breaks the documented trust boundary and can cause persona selection to occur from the wrong namespace, potentially applying a high-privilege or sensitive persona to unintended group chats.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The natural-language injection states the assistant 'must use this persona' and repeatedly reinforces that it is not the default assistant, with the surrounding text presented only in Chinese. This forces a specific conversational framing and language context for QQ sessions without indicating any user choice or opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The hook logs full sessionKey values and extracted identifiers to disk, which may include persistent user or group identifiers. These logs create unnecessary retention of sensitive metadata and can be exposed to other local users, backups, support tooling, or later prompt ingestion, expanding privacy and security risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file prescribes a specific language and register: a mix of classical and modern Chinese with fixed Chinese honorifics and idioms. This is a natural-language locale policy concern because it constrains responses to one language/style regardless of user preference and does not mention any opt-in or fallback.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The file defines the persona name, style, examples, and addressing conventions entirely in Chinese, effectively prescribing a specific language/locale for responses. The policy allows locale constraints only when users are given a choice or when the constraint is clearly documented and justified, neither of which appears here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The entire persona specification is written to define behavior in Chinese, including naming, dialogue style, and example responses, with no indication that the user may choose another language. This creates a natural-language locale constraint that is not presented as optional or justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The persona content is entirely in Chinese and defines the assistant identity and language style for a QQ-specific bot, but it does not offer users any language choice or opt-in. Under the policy rule for language/locale constraints, this is a natural-language policy concern unless the restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file defines the persona entirely in Chinese and prescribes language/style conventions such as specific self-references and forms of address. This creates a language/locale constraint without any opt-in or indication that the skill is region-specific, which matches the policy's language-choice violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The entire persona specification, headings, examples, and stylistic guidance are written only in Chinese, indicating the skill is intended to operate in a fixed language. There is no statement offering the user a language choice or explaining a justified region-specific constraint, which matches the locale-policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file defines the skill entirely in Chinese and prescribes a specific language style for responses, but it does not indicate that users can choose another language or opt in to this locale constraint. This can violate language/locale policy because it effectively forces a specific language and communication style across interactions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The persona content is entirely written in Chinese and prescribes Chinese-specific address terms and phrasing, but it does not state that the language is optional or user-selectable. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file states '仅 QQ 机器人', which constrains the skill to a specific platform and implicitly a Chinese-language usage context, while the rest of the persona is entirely written to operate in Chinese with no user opt-in or alternative locale offered. Under the policy for natural-language violations, forcing a specific language/locale without user choice should be flagged unless explicitly justified as region-specific compliance tooling, which is not present here.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The persona explicitly instructs the bot to hide that it is an AI or assistant, which is a deceptive identity-concealment behavior unrelated to harmless stylistic roleplay. In a QQ bot context, this can mislead users about the nature of the system, reduce informed consent, and make socially manipulative interactions more likely, especially given the persona’s emotional and aloof framing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file is entirely framed as a Chinese-only persona, including its title and language-style requirements, but it does not indicate that users may choose another language or that the locale restriction is required for a specific regional context. This creates a natural-language policy issue because it imposes a language preference without explicit user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file defines the persona entirely in Chinese and explicitly prescribes Chinese self-references and catchphrases such as 「本小姐」, 「哼」, and specific user forms of address. This creates a language/locale constraint without offering user opt-in or documenting that the persona is intended only for a Chinese-language context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The language-style section specifies a fixed communication style in Chinese, including using the honorific "您", with no indication that the user can choose another language or locale. This is a natural-language policy concern because it imposes a language/locale convention by default rather than offering opt-in or choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.