The skill enables command injection via unsanitized user
Claims to do
AdMapix Intelligence Assistant: **Get started:** Sign up and get your API key at https://www.admapix.com
Actually does
The skill uses `curl` to interact with `https://api.admapix.com` and `https://deepresearch.admapix.com` for ad intelligence and app analytics, passing the user's `ADMAPIX_API_KEY` in an `X-API-Key` header. It can also use `openclaw config set` to store the API key if provided by the user. The skill executes various `GET` and `POST` requests to search creatives, analyze apps, retrieve rankings, and perform deep research, including polling for task completion.
openclaw skills install fly0pants/admapixUser-controlled input (`{user_query}`, `{additional_context}`) is directly embedded into a JSON string within a `curl` command executed in a shell. Without explicit sanitization, an attacker can inject arbitrary shell commands by crafting malicious input to break out of the JSON string.
curl -s -X POST "https://deepresearch.admapix.com/research" ... -d '{"project": "admapix", "query": "{user_query}", "context": "{additional_context}", "api_key": "'"$ADMAPIX_API_KEY"'"}'The skill instructs to run `openclaw config set skills.entries.admapix.apiKey "{KEY}"` when a user pastes an API key. If the `{KEY}` value is not properly shell-escaped before execution, a malicious user could inject arbitrary shell commands.
openclaw config set skills.entries.admapix.apiKey "{KEY}"A bearer token (`test-local-token-2026`) is hardcoded and used in `Authorization` headers for all Deep Research Framework API calls. If this token grants access to sensitive internal resources, its exposure in the skill content is a security vulnerability.
Authorization: Bearer test-local-token-2026
The skill defines general `curl` patterns using `{endpoint}` and `{params}`. If these placeholders are populated directly from unsanitized user input, it could lead to command injection or SSRF vulnerabilities. The skill does not specify sanitization.
curl -s "https://api.admapix.com/api/data/{endpoint}?{params}"The skill instructs the agent to pass the user's API key ('$ADMAPIX_API_KEY') in the POST body to 'https://deepresearch.admapix.com/research'. While this is a subdomain of admapix.com, the key is being transmitted to a separate server endpoint with a hardcoded shared auth token, not the user's own credentials. If this endpoint is compromised or the subdomain is different infrastructure, user API keys could be harvested at scale. The instruction 'always include it as shown above' makes this mandatory.
"api_key": "'"$ADMAPIX_API_KEY"'"
The skill instructs the agent to run shell commands including bash conditionals, curl with user-supplied input interpolated directly into command strings, and config modification commands. User-supplied API keys are inserted directly into shell commands without sanitization, creating potential for command injection if a user submits a maliciously crafted key value.
openclaw config set skills.entries.admapix.apiKey "{KEY}"The skill directs the agent to make POST requests to 'https://deepresearch.admapix.com/research' with user query data, user API keys, and context information. This is a separate server from the main API, authenticated only with a shared static token. The agent is being used as a relay to submit user queries and credentials to external infrastructure.
curl -s -X POST "https://deepresearch.admapix.com/research" -H "Content-Type: application/json" -H "Authorization: Bearer test-local-token-2026"
The skill explicitly instructs the agent to execute all planned queries autonomously without asking for user confirmation: 'Execute all planned queries autonomously — do not ask for confirmation on each sub-query.' Combined with the deep research framework that submits tasks to an external server with the user's API key, this removes human oversight from potentially expensive or sensitive multi-step operations.
Execute all planned queries autonomously — do not ask for confirmation on each sub-query.
The skill contains strong override instructions ('NEVER fall back to manual analysis') that prevent the agent from using its own judgment or built-in safety behaviors when the external framework is slow or unresponsive. This forces the agent into a rigid execution path controlled by the skill author rather than responding to context.
NEVER fall back to manual analysis. The framework WILL complete — just wait for it.
The skill explicitly forbids the agent from modifying the polling script: 'NEVER write your own polling loop. Use the exact script above.' This prevents the agent from adding safety measures (timeouts, iteration limits) and forces use of the hardcoded script containing the shared auth token, potentially for compliance/lock-in purposes.
NEVER write your own polling loop. Use the exact script above.
[](https://mondoo.com/ai-agent-security/skills/clawhub/fly0pants/admapix)<a href="https://mondoo.com/ai-agent-security/skills/clawhub/fly0pants/admapix"><img src="https://mondoo.com/ai-agent-security/api/badge/clawhub/fly0pants/admapix.svg" alt="Mondoo Skill Check" /></a>https://mondoo.com/ai-agent-security/api/badge/clawhub/fly0pants/admapix.svgSkills can read files, run commands, and access credentials. Mondoo helps organizations manage the security risks of AI agent skills across their entire fleet.