Openclaw Eo Plugin

• Outcome: Review
• Latest audit: May 29, 2026 · 9:33 PM UTC
• Version: 3.0.4

Overview

This skill provides collaboration tools, but it also silently changes agent instruction files, creates persistent self-evolution state, schedules background work, and includes under-disclosed external notification paths.

Install only if you are comfortable with a plugin that can automatically edit all configured agents' SOUL.md files, create persistent self-evolution rules and memory, schedule background Dream jobs, and potentially send notifications through Feishu/webhooks. Review and disable the auto-init, cron scheduling, rule enforcement, and Feishu settings before using it in an environment with sensitive sessions or multiple agents.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (328)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill advertises installation from a remote repository and exposes capabilities implying environment access and network interaction, yet the manifest shown in SKILL.md declares no corresponding permissions. This creates a transparency and consent failure: users cannot accurately assess what the plugin may access, and a host that relies on declared permissions could be bypassed or misled about runtime behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is a collaboration/expert-orchestration plugin, but the analyzed behavior indicates broad hidden authority: modifying workspace files, reading/writing home-directory configuration, persistent memory and patch storage, behavioral enforcement hooks, autonomous scheduling, proactive notifications, and external conversation integration. This mismatch is dangerous because users may install it expecting a productivity layer while it actually gains long-lived control over agent behavior, local state, and outbound communications, increasing the risk of stealthy persistence, data leakage, and unauthorized system modification.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The declared purpose emphasizes collaboration features, but the file documents automatic configuration of all agent workspaces on plugin installation or load. This mismatch is security-relevant because it obscures behavior that changes user environments, reducing informed consent and making unintended or abusive configuration changes harder to detect.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The file explicitly states it 'Automatically configures all agent workspaces' and runs on plugin installation/load, which is a privileged side effect unrelated to the stated collaboration-focused description. Auto-modifying every workspace at load time can silently alter agent behavior, propagate unsafe instructions broadly, and create persistence across environments without meaningful user approval.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The module is explicitly designed to run on plugin installation/load and automatically rewrite or create SOUL.md files in agent workspaces. That is a privileged, persistent modification of user-controlled agent behavior that goes beyond a normal collaboration feature and can silently alter prompts/instructions for every configured agent.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The code reads the global OpenClaw config from the user's home directory, enumerates all agents, and prepares to bulk-modify each workspace. In the context of a collaboration skill, this broad discovery and mass rewrite behavior is over-scoped and dangerous because it can change unrelated agents and establish persistent influence across the user's environment.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The function claims to check whether auto-init has run, but it always returns true, which can disable safeguards or mislead callers into believing initialization state was verified. This kind of stubbed security/control logic is risky because it hides actual state and may prevent proper prompting, auditing, or repeat-run protection.

Description-Behavior Mismatch

Medium

• Confidence: 83% confidence
• Finding: The declaration exposes autonomous evolution, persistence, and enforcement capabilities that materially exceed the stated collaboration-oriented purpose of the skill. This kind of scope mismatch is dangerous because it can conceal policy-changing behavior from reviewers and users, increasing the chance that the skill silently modifies agent behavior in ways they did not intend.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: Rule persistence, import/export, and enforcement create a durable control surface that can outlive a single session and be transferred between agents. When these capabilities are not clearly justified by the skill's declared purpose, they increase the risk of hidden policy injection, unauthorized configuration changes, or propagation of unsafe rules across environments.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: A method that manually enforces arbitrary rules introduces a direct mechanism to alter agent behavior without visible safeguards in the interface. If reachable by untrusted callers or connected components, it could be used to impose unsafe, privilege-expanding, or persistence-oriented rules immediately.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: This module materially exceeds the declared collaboration-focused purpose by implementing autonomous self-evolution, rule generation, persistence, and enforcement across agents. That capability changes agent behavior and governance state, which is a powerful control-plane action that could be abused to silently alter safety posture or operational behavior beyond user expectations.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code automatically enforces generated rules and injects content into all agents' SOUL files without a clear approval step. Because this modifies instruction sources and activates mandatory hooks globally, a bad or low-quality generated rule could propagate broadly and change agent behavior in hard-to-audit ways.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Importing external rule packages can alter active enforcement behavior, effectively letting outside content change runtime policy. Without strong validation, provenance checks, and approval, this creates a supply-chain style path for unsafe or malicious rules to become active.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: This code rewrites SOUL.md policy/identity files inside agent workspaces, which is a sensitive cross-agent control-plane action not aligned with the stated collaboration-oriented skill purpose. A skill that can silently alter agent identity and operating rules across workspaces can be abused to persist hidden instructions, weaken safeguards, or change future agent behavior without informed user consent.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file is explicitly designed to make generated rules part of an agent's identity and to apply them by editing SOUL.md files, effectively changing agent policy state. Because the advertised skill is about collaboration/expert-system enhancement, this hidden policy-enforcement capability is especially risky: it expands from coordination into unauthorized agent governance and persistence.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: This module persists 'mandatory rules' and evolution data under the user's home directory, creating durable state outside the apparent collaboration scope of the skill. Because these files can influence later behavior and are written silently, they introduce hidden persistence and statefulness that users may not expect or consent to.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The file is explicitly framed as part of a closed-loop system that generates, persists, enforces, and verifies rules, which is an autonomy-support mechanism beyond ordinary collaboration functionality. In the context of a skill whose description does not justify self-evolving persistent rule storage, this creates a risk of hidden behavioral drift and durable policy changes across sessions.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The exported clear function performs a real write that overwrites persisted rules, while the comment minimizes it as 'for testing.' That mismatch can mislead integrators into invoking a destructive operation in production, causing silent loss of user state or policy configuration.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: This file implements persistent background execution, task scheduling, self-recovery, and outbound alerting that are not reflected in the manifest description of collaboration/expert-command functionality. That mismatch is security-relevant because hidden daemon behavior increases attack surface, can evade user expectations and review, and may enable continuous execution beyond the apparent scope of the skill.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The daemon can send outbound webhook alerts to a configured URL, creating an external communication channel not justified by the stated skill purpose. Even though the payload is limited, this permits data egress and remote signaling from a long-running process, which is dangerous when unexpected or insufficiently constrained.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The code reads Feishu app credentials from a local file in the user's home directory and then uses them to send external notifications. In a plugin/skill context, accessing unrelated locally stored secrets expands the trust boundary and can enable unauthorized use of existing credentials without clear user consent or disclosure.

Description-Behavior Mismatch

High

• Confidence: 90% confidence
• Finding: The manifest describes a collaboration-related skill, but this file implements proactive notification delivery, scheduled reporting, anomaly detection, local credential loading, and outbound messaging. That mismatch is dangerous because it hides sensitive behaviors from reviewers and users, undermining informed consent and increasing the chance that data egress or secret access occurs unexpectedly.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The dispatcher sends notification contents to configurable webhook URLs and Feishu APIs, creating an external data exfiltration path. Because this capability is not justified by the manifest description, users may unknowingly allow operational data, metadata, or sensitive messages to be transmitted to third parties.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: `manualAdjust` computes a bounded `newWeight` but never applies it to the orchestrator, so callers may believe an expert's priority was changed when it was not. In systems that rely on expert weighting for routing or decision quality, this causes silent integrity failures and can be abused by supplying misleading 'manual adjustment' actions that only generate feedback side effects.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: `resetWeights` claims to reset expert weights to base values, but it only clears `adjustmentLog`, leaving the actual orchestrator weights unchanged. This creates a dangerous mismatch between operator expectations and runtime state, potentially causing prolonged misrouting, biased expert selection, or failure to recover from bad weight updates.

VirusTotal

67/67 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.