QQBot Send Local Media

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:15 AM UTC
• Version: 1.0.1

Overview

This skill coherently stages user-requested local files for QQBot sending and cleans up temporary copies, with one limited cleanup-scope caveat.

Install only if you want agents to send local files through QQBot. Be aware that the helper can delete files inside ~/.openclaw/media/qqbot/ when invoked with --cleanup, so agents should use only the exact staged path printed during the same send operation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/stage_media.py:20

Finding

Cleanup Operation Can Delete Unrelated Files in the QQBot Relay Directory

Content

View full analysis

None: staged = path.expanduser() if not staged.is_absolute(): staged = staged.resolve() dest_dir = DEST_DIR.resolve() staged = staged.resolve() try: staged.relative_to(dest_dir) except ValueError: raise RuntimeError(f'ERROR: refusing to delete file outside staged directory: {staged}') if not staged.exists() or not staged.is_file(): raise RuntimeError(f'ERROR: staged file not found: {staged}') staged.unlink() ``` ### Technical Analysis The cleanup function verifies only that the supplied path resolves beneath `~/.openclaw/media/qqbot/` and identifies an existing regular file. It does not verify that the file: - Was created by `stage_media.py`. - Was created for the current media-send operation. - Matches the exact output of the preceding staging command. - Is associated with an authenticated cleanup token or operation identifier. This behavior contradicts the security guarantees in `SKILL.md`, which state that cleanup is allowed only for the exact path returned by the current staging operation. Documentation-level instructions do not enforce this invariant in the executable code. The use of `Path.resolve()` and `relative_to()` prevents straightforward path traversal and resolved symlink escapes outside the relay directory. However, any unrelated regular file located inside that directory remains an accepted deletion target. ### Attack Path 1. An existing file is present under `~/.openclaw/media/qqbot/`, whether created by another send operation, another process, or the user. 2. An attacker who can influence the cleanup argument, or an erroneous caller, selects that existing file rather than the path ret ...[truncated 1056 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill instructs the agent to invoke a local Python script that copies files and later deletes staged files, which clearly requires file-write capability, yet the skill declares no explicit tool scope or permission boundary. This creates a governance gap: an agent may perform filesystem mutations without transparent declaration or restriction, increasing the risk of misuse or unintended writes/deletes if the script or inputs behave unexpectedly.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

When the user wants a file sent through QQ, complete the full send flow instead of only returning a path.

For local files, always create a dedicated staged copy first, send that staged copy, and then delete only the staged copy returned by the staging script.

Never delete the original source file.

Static analysis

No suspicious patterns detected.