openclaw-qqbot-send-skill
Warn
Audited by Gen Agent Trust Hub on Sep 12, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATIONMETADATA_POISONINGINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The installation process involves cloning a repository from an unverified GitHub account (ZJunCher/openclaw-qqbot-send-skill).
- [COMMAND_EXECUTION]: The skill instructions demonstrate using subprocess.run to execute a local Python script (scripts/stage_media.py), allowing for potential command execution controlled by the agent.
- [DATA_EXFILTRATION]: The skill facilitates the transmission of local files to an external service (QQBot) using XML-like tags. This creates a risk of exfiltrating sensitive system or configuration files (e.g., SSH keys or environment variables) if they are within the 10 MB size limit.
- [METADATA_POISONING]: There is a discrepancy between the stated author (ara.so — Hermes Skills collection) and the source code location provided in the installation instructions, which points to a personal GitHub account (ZJunCher).
- [INDIRECT_PROMPT_INJECTION]: The skill has an attack surface where it ingests untrusted file paths from the environment or user input. Ingestion points: File paths passed to the stage_media.py script in SKILL.md. Boundary markers: No explicit delimiters or warnings are used to prevent the agent from processing sensitive system paths. Capability inventory: The skill uses subprocess.run for execution and performs file system operations including copying and deletion. Sanitization: The skill normalizes file extensions and checks for existence but lacks restricted path validation to prevent access to sensitive directories.
Audit Metadata