Reported observations below are attributed to the linked sources. Review questions and controls are editorial interpretation.
What the source reports
Snyk identifies google-qx4 and related variants posing as a Google-services integration. The skill required an alleged openclaw-core utility and pointed to external installation material. The researchers describe platform-specific staging and a payload separated from the published skill.
Primary records: S26 ↗
The trust boundary
The agent repeated untrusted setup guidance to the user, lending it the appearance of a legitimate requirement.
What this does not establish
The opening user dialogue in the report illustrates the path; it is not a named victim’s incident transcript. We do not independently verify compromise or attribute the campaign beyond the published analysis.
We reviewed the linked publication text or cataloged evidence level. We did not execute the suspect package, independently reproduce the investigation, or verify current registry availability.
Questions for a review
These are practical questions prompted by the case, not controls independently validated by this website.
- Borrowed identity
- Does a familiar integration name have a verifiable relationship to the actual publisher?
- Separate delivery
- Which resources can change after the reviewed package has been installed?
- Decision wording
- Does an approval explain the installer, destination, and access, rather than merely ask to continue?
Editorial lesson
Inspect what the agent recommends that a human should run, as well as what the agent can run itself.
For your own environment, turn the question into a bounded test with an exact package identity, synthetic input, expected permitted behavior, prohibited effect, and observable stopping point. Keep a blocked attempt distinct from a completed effect. Preserve the legitimate task result alongside the security observation.