Back to skill

Security audit

AgentOS SDK for Clawdbot

Security checks across malware telemetry and agentic risk

Overview

This skill openly provides AgentOS cloud memory sync, but it requires broad ongoing upload and reuse of conversation and project data with weak user controls.

Install only if you intentionally want AgentOS to store and sync active conversations, notes, and project memory to its service. Before use, inspect or obtain the missing aos CLI, avoid the default HTTP raw-IP endpoint, confirm API key scope and deletion controls, and do not enable cron, daemon, or mesh wakeups unless ongoing background sync and wake behavior are acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The skill mandates syncing active conversation state, daily notes, and project data to a remote dashboard on every heartbeat without establishing user consent, data minimization, or a clear boundary on what content may be transmitted. That creates a standing exfiltration path for potentially sensitive user data, including ongoing conversation content, to an external service.

Context-Inappropriate Capability

High
Confidence
94% confidence
Finding
The documented capabilities include agent discovery, mesh messaging, and bulk operations broader than the stated memory-sync workflow. Exposing cross-agent and bulk-access functionality increases the blast radius if credentials are misused and suggests over-privileged design beyond least privilege.

Context-Inappropriate Capability

Critical
Confidence
99% confidence
Finding
The API reference advertises a `/v1/dump-all` endpoint for fetching all memories, which is far beyond the stated need of syncing one agent's context. If accessible to the skill or its credentials, this creates severe risk of mass data exposure across tenants, agents, or users.

Intent-Code Divergence

Medium
Confidence
81% confidence
Finding
The script presents itself as a narrow 'SDK installer for Clawdbot' while installing a general-purpose 'aos' CLI and advertising capabilities such as messaging, inbox access, syncing, and dashboard connectivity. That mismatch can mislead users about the scope of access and remote interactions being introduced, which is dangerous in an installer because users may grant trust under false assumptions.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill frames continuous dashboard syncing as mandatory while omitting a clear privacy warning to the end user that conversation content and activity may be transmitted externally. Users are therefore not meaningfully informed that routine interaction data may be persisted and monitored off-device.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The session-start restoration flow retrieves prior working memory and daily notes without warning that previous conversation records may be reused and surfaced. While intended for continuity, it still processes stored conversation data in a way that may surprise users and expands privacy exposure.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The script forwards message-derived content to a local HTTP gateway without any disclosure, consent, or trust validation, which can expose potentially sensitive inbox metadata to another service. Because the payload includes sender and topic information from remote mesh messages, a local or redirected gateway could collect or misuse that data.

Ssd 3

High
Confidence
98% confidence
Finding
These instructions explicitly require preserving and syncing active conversation details, including user content, to an external service during heartbeats. That is dangerous because it operationalizes persistent export of user communications regardless of sensitivity or necessity.

Ssd 3

High
Confidence
99% confidence
Finding
The required CONTEXT format tells the agent to record the human's last message, pending questions, and expected next topic, creating structured retention of user interaction data. This increases privacy risk and can capture sensitive intent, plans, or personal details beyond what is necessary for basic operation.

Ssd 3

High
Confidence
97% confidence
Finding
Requiring updates after every human message and before every heartbeat creates continuous capture and persistence of conversation data. This makes collection pervasive rather than exceptional, amplifying privacy, retention, and accidental disclosure risks.

Ssd 3

Medium
Confidence
90% confidence
Finding
The session restoration instructions direct the agent to recover prior working memory and notes containing previous conversation details. Even if intended for continuity, this still creates a pipeline for repeated access to stored user interactions and can reintroduce sensitive data into future sessions.

Ssd 4

Medium
Confidence
88% confidence
Finding
The guidance instructs the agent to hide context loss and respond as if nothing happened after restoring stored data. This encourages opaque behavior around memory use and may mislead users about what information is being retained and replayed across sessions.

External Transmission

Medium
Category
Data Exfiltration
Content
# Method 2: Gateway API wake (fallback)
  GATEWAY_URL="${CLAWDBOT_GATEWAY_URL:-http://localhost:4440}"
  curl -s -X POST "$GATEWAY_URL/api/wake" \
    -H "Content-Type: application/json" \
    -d "{\"text\": \"$wake_msg\"}" 2>/dev/null || true
fi
Confidence
88% confidence
Finding
curl -s -X POST "$GATEWAY_URL/api/wake" \ -H "Content-Type: application/json" \ -d

Session Persistence

Medium
Category
Rogue Agent
Content
**When you receive a memory flush directive from Clawdbot, IMMEDIATELY backup your state.**

Clawdbot sends a silent turn before compaction with text like "write important context to memory". This is your last chance to save state before details are lost.

### Protocol (MANDATORY when you see memory flush directive)
Confidence
78% confidence
Finding
write important context to memory". This is your last chance to save state before details are lost. ### Protocol (MANDATORY when you see memory flush directive) 1. **Update CONTEXT.md** with: - C

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.