Openqq

QQ bot integration for OpenClaw with session isolation, logging, and AI auto-reply. Supports private chat and group @messages.

This skill is plausibly a legitimate QQ bot, but review these points before installing: - The runtime spawns a local 'openclaw' CLI (spawn('openclaw', ...)). Ensure you actually have a trusted OpenClaw binary on PATH; the skill metadata did not declare this binary requirement. Without it the skill will fail or may spawn something unexpected. - The skill stores QQ credentials in ~/.openclaw/workspace/open-qq-config.json — keep file permissions tight (chmod 600) and do not commit it. The logger may record message contents and API responses; review logger.sanitizeMessage and consider stricter filtering or disabling debug logging in production. - Several files/scripts assume /root paths (default logDir, start-qq-bot.sh cd /root/...). If you run as a non-root user, adjust paths and service files before deploying. - The package.json relies on npm packages; 'npm install' will download dependencies from npm. Inspect the installed packages (axios, ws) versions and lockfile if you need supply-chain assurance. - Metadata mismatches (package version vs registry version, missing declared required binaries) and small inconsistencies indicate the author may have shipped quickly — audit the code (qq-bot.js and logger.js) if you don't fully trust the source, and test in an isolated environment first. If you decide to proceed: run it in a sandbox/container or test VM, verify the OpenClaw binary and QQ endpoints are the ones you expect, tighten config/log permissions, and run with non-root user privileges.

Type: OpenClaw Skill Name: openqq Version: 0.0.5 The skill is suspicious due to a significant prompt injection vulnerability. The `qq-bot.js` file passes unsanitized user message content directly from QQ (`messageData.content`) as the `--message` argument to the `openclaw agent` via `child_process.spawn`. While `spawn` mitigates shell injection for the command itself, the AI agent's input is vulnerable to manipulation by malicious QQ users. This vulnerability is explicitly demonstrated in the `package.json`'s `test-msg` script, which takes arbitrary command-line input and passes it directly to the `openclaw agent --message` argument. This design flaw allows external users to potentially control the AI agent's behavior, leading to unintended actions, data access, or command execution depending on the agent's capabilities.