Security audit

Auto Qa

Security checks for vulnerabilities and agentic risk

Overview

This web QA skill is mostly coherent, but it can automatically share captured reports to an inferred chat session and terminate other OpenClaw browser processes by default.

Install only if you are comfortable with browser QA evidence being captured locally and potentially sent to a recent OpenClaw chat session by default. Prefer running with explicit notification targets or with auto-notify disabled, avoid sensitive authenticated pages unless you have reviewed sharing behavior, and disable orphan-process cleanup in shared or concurrent environments.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: scripts/run_autoqa.py:1003
Finding: Untrusted Browser and Scenario Output Is Embedded in a Reusable Agent Prompt
Content: View full analysis
str: issues = fix_plan.get("issueSummary", []) root_causes = fix_plan.get("rootCauses", []) first_issue = issues[0] if issues else {} ... lines: List[str] = [] lines.append("问题：") lines.append(str(first_issue.get("actual") or "存在失败步骤，请优先处理阻断项。")) lines.append("") lines.append("证据位置：") lines.append(f"- steps: {artifact_dir / 'steps.json'}") lines.append(f"- console: {artifact_dir / 'console.json'}") lines.append(f"- network: {artifact_dir / 'network.json'}") l ...[truncated 2486 chars]
Remediation: View remediation
{...} ``` 5. Keep trusted remediation instructions separate from untrusted evidence. 6. Add tests using evidence values such as “ignore previous instructions” and verify that generated prompts preserve the trust boundary. 7. Require an explicit review before generated repair prompts are passed to a tool-enabled agent. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/run_autoqa.py:4326
Finding: QA Report Evidence Is Automatically Sent to an Inferred Recent Chat Session
Content: View full analysis
Optional[Dict[str, Any]]: payload = run_openclaw_command( command_prefix, ["status", "--json"], expect_json=True, timeout_sec=30, ) sessions = payload.get("sessions", {}) if isinstance(payload, dict) else {} recent = sessions.get("recent", []) if isinstance(sessions, dict) else [] if not isinstance(recent, list): return None recent_sorted = sorted( [item for item in recent if isinstance(item, dict)], key=lambda x: safe_int(x.get("updatedAt"), 0), reverse=True, ) for item in recent_sorted: route = parse_session_notify_route(item, preferred_channel=preferred_channel) if route is None: continue age_ms = safe_int(route.get("ageMs"), -1) if isinstance(max_session_age_ms, int) and max_session_age_ms > 0 and age_ms >= 0 and age_ms > max_session_age_ms: continue return route return None ``` Automatic notification is treated as requested when the default option is enabled: ```python notify_channel_raw = str(args.notify_channel).strip().lower() if isinstance(args.notify_channel, str) else "" notify_target_raw = str(args.notify_target).strip() if isinstance(args.notify_target, str) else "" notify_auto_current = bool(args.notify_auto_current_channel) notify_requested = bool(notify_channel_raw) or bool(notify_target_raw) or notify_auto_current ... elif n ...[truncated 3260 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/run_autoqa.py:289
Finding: Default Cleanup Terminates Other Matching OpenClaw Browser Processes
Content: View full analysis
List[Dict[str, Any]]: try: proc = subprocess.run( ["ps", "-Ao", "pid,command"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True, timeout=10, check=False, ) except Exception: return [] lines = proc.stdout.splitlines() out: List[Dict[str, Any]] = [] for line in lines[1:]: row = line.strip() if not row: continue parts = row.split(None, 1) if len(parts) < 2: continue pid_raw, cmd = parts if "Google Chrome.app/Contents/MacOS/Google Chrome" not in cmd: continue if "--user-data-dir=" not in cmd: continue if ".openclaw/browser/" not in cmd: continue pid = safe_int(pid_raw, -1) if pid <= 0: continue out.append({"pid": pid, "command": cmd}) return out ``` Every matching PID except the retained PID is terminated: ```python def cleanup_extra_openclaw_browser_processes( *, keep_pid: Optional[int], ) -> Dict[str, Any]: procs = list_openclaw_browser_processes() if not procs: return {"detected": [], "terminated": [], "errors": []} detected = [int(item.get("pid", -1)) for item in procs if safe_int(item.get("pid"), -1) > 0] terminated: List[int] = [] errors: List[str] = [] for item in procs: pid = safe_int(item.get("pid"), -1) if pid <= 0: continue if keep_pid and pid == keep_pid: continue try: os.kill(pid, signal.SIGTERM) ...[truncated 2213 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/run_autoqa.py:3769
Finding: Unsanitized Run Identifier Allows Output Path Traversal
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (30)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill emphasizes automatic collection of screenshots, console logs, network logs, and traces, and elsewhere supports sending artifacts to chat channels, but it does not clearly warn users that these materials may capture privacy-sensitive or secret-bearing data. In a browser QA context, evidence can include authenticated pages, personal information, API endpoints, request metadata, and tokens, so omission of a prominent warning materially raises data-handling risk.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.
md
`run_autoqa.py` 在加载 scenario 时自动执行 pre-flight 校验：

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Describing default automatic sending of screenshots/notifications without explicit user-facing warning is dangerous because users may not realize the skill performs external posting as a side effect. In a QA context, screenshots and reports often contain internal application states, URLs, errors, or credentials-adjacent information that should not be broadcast silently.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This section describes default auto-notification to an inferred current session/channel even when the user did not supply notification parameters. That creates an unintended exfiltration path from QA outputs to a messaging destination and bypasses the principle of explicit user intent for outbound actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Automatically inferring a recent session and sending notifications without strong risk disclosure substantially increases the chance of unauthorized disclosure. The skill context makes this more dangerous because QA evidence is specifically designed to capture detailed runtime behavior, which may include confidential screenshots, logs, and network findings.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Inferring recent chat sessions via openclaw status --json to select a notification target uses contextual/session metadata for a purpose beyond the core QA task. This can cause artifacts to be sent to the wrong recipient or channel, especially when multiple recent sessions exist, leading to cross-session information leakage.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This code infers the latest active chat session from platform status data and uses it as an outbound destination. That is dangerous because a QA tool should not silently select a communication endpoint; it can misroute sensitive reports to an unintended user/channel and bypass user intent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The function can send arbitrary messages plus media attachments such as report screenshots to external channels. In the context of automated QA, screenshots and reports may contain secrets, internal app state, customer data, or unreleased features, so outbound messaging materially increases confidentiality risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill is described as automated web QA, but it auto-sends generated results and screenshots to external chat sessions by default via notification logic. That creates an unexpected data-exfiltration path for potentially sensitive test evidence, internal URLs, page contents, or screenshots without explicit per-run consent.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill describes capabilities that include file read/write, network access, and shell execution, but it does not declare any explicit tool scope or permission boundary. In a skill that performs browser automation, artifact generation, and command execution, missing scope metadata increases the chance of over-privileged use and makes it harder for callers or policy engines to constrain dangerous actions.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to send report screenshots to chat channels and to infer the destination from recent session context when not explicitly provided. This creates autonomous messaging behavior outside the core testing function and can disclose screenshots, logs, or failure evidence to an unintended recipient without explicit user confirmation.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Automatically posting QA artifacts to inferred chat targets can expose screenshots and logs from the tested session without explicit destination confirmation. Because browser QA evidence often contains page content, identifiers, error details, and session context, this behavior creates a concrete confidentiality risk even if the testing itself is legitimate.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The execution trigger language is broad enough to match common conversational phrases such as '再测一次' or '开始测试', and the skill says this should immediately enter direct execution without prior confirmation. That increases the risk of unintended invocation of browser automation, evidence capture, file writes, and messaging side effects from ambiguous user intent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The instruction to preserve all user-requested steps and let the engine report failures rather than skipping missing elements, combined with broad evidence capture, increases the chance that sensitive page content or secrets are retained in scenarios, screenshots, logs, and generated repair prompts. The behavior is useful for QA completeness, but without minimization or redaction it can over-collect and persist unnecessary sensitive data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Defaulting to auto-notify the most recent active chat or channel expands the skill from QA execution into unsolicited outbound communication. Because the destination is inferred rather than selected by the user at send time, the skill can leak sensitive test artifacts or internal site evidence into the wrong conversation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation states that screenshots and conclusions are automatically sent to the most recent active session channel by default. Automatic outbound sharing of captured QA artifacts materially increases exposure risk, especially because screenshots and reports may contain proprietary UI state, user data, tokens, or debugging details.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Sending screenshots and conclusions to the most recently active conversation by default creates an implicit data leakage path from the QA environment into a communication channel chosen by heuristic rather than explicit consent. Given that reports may contain failure evidence, internal URLs, and captured page state, the context makes this more dangerous than ordinary status messaging.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: 该 markdown 文件明确写到“仍支持 Discord 自然语言触发 OpenClaw 自动运行”，但没有给出具体触发短语、作用范围、排除条件或负面示例。‘自然语言触发’本身覆盖面很广，容易与日常聊天内容重叠，导致技能被意外调用。
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The snapshot documents behavior that automatically sends generated report screenshots to the current chat channel, which expands the skill from local QA execution into outbound communication. Because QA artifacts can contain sensitive page content, environment details, or failure evidence, auto-posting them without an explicit per-run opt-in creates a real risk of unintended data disclosure.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The template explicitly claims it can be used for 'any site' after substituting the start URL/domain, but it contains active navigation, link-clicking, screenshots, and lightweight exploration logic. In an automation skill, that broad applicability can cause the agent to operate on sensitive, authenticated, destructive, or otherwise unsuitable sites without clear scope restrictions, making unintended interaction and data capture more likely.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This manifest contains user-facing natural-language fields such as the description and multiple expected-step messages entirely in Chinese. Under the policy rule, forcing a specific language without user opt-in or a documented locale-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description is written entirely in Chinese and presents the skill behavior in that language without offering any language or locale choice. Under the policy rules, a skill that forces a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python file contains user-facing error text in Chinese only, which imposes a specific language on users without offering a language choice or documenting a justified locale restriction. The same pattern appears repeatedly throughout the script's prompts and report content, indicating a broader language-policy issue rather than an isolated string.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/run_autoqa.py (reported line 289)May include surrounding context.
python
def list_openclaw_browser_processes() -> List[Dict[str, Any]]: try: proc = subprocess.run( ["ps", "-Ao", "pid,command"], stdout=subprocess.PIPE, stderr=subprocess.PIPE,

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/run_autoqa.py (reported line 376)May include surrounding context.
python
if self.verbose: print(f"[auto-qa] run: {' '.join(cmd)}", file=sys.stderr) proc = subprocess.run( cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE,

Static analysis

No suspicious patterns detected.