ClawHub
Back to skill

Security audit

QQBot Send

Security checks for vulnerabilities and agentic risk

Overview

This skill sends user-requested files through QQBot and its local staging behavior is disclosed and purpose-aligned, though users should understand staged copies may remain on disk.

Install this only if you want your agent to send files through QQBot. Before sending sensitive files, confirm the path and recipient, and periodically clean ~/.openclaw/media/qqbot/ if you do not want staged copies retained locally.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README explicitly documents a workflow that copies arbitrary local files into a persistent relay directory and allows direct sending of local or remote media, but it does not mention any consent prompt, retention behavior, or user-facing warning about exfiltration and local persistence. In an agent skill context, this increases the risk of unintended disclosure of sensitive local files or silent forwarding of remote content because the operation is framed as automatic and "safest" without clarifying privacy or transfer boundaries.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill instructs the agent to run a staging script that copies local files into a relay directory, which is a file-write capability, but it declares no explicit tool scope or permissions. That creates a mismatch between stated and actual capabilities, increasing the chance of unauthorized file operations or unsafe invocation in environments that rely on manifest scoping for policy enforcement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The description is broad enough to trigger on generic requests involving local files, attachments, downloads, or QQ sending, which can cause the skill to activate in situations the user did not clearly intend. In this skill's context, unintended invocation is risky because activation can lead directly to local file staging and outbound transmission, increasing exfiltration risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill describes a built-in staging flow that copies local files into ~/.openclaw/media/qqbot/, but the user-facing description does not prominently disclose that local files will be duplicated before transmission. This reduces transparency and informed consent, and in context is more dangerous because it handles arbitrary local absolute paths and performs both local copying and external delivery.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.