T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:106- Finding
Mandatory Instructions Override Normal Agent Behavior
- Content
View full analysis
- Remediation
View remediation
Security audit
AgentOS SDK for Clawdbot
Security checks for vulnerabilities and agentic risk
Overview
This skill is an AgentOS integration, but it asks for broad ongoing access to conversation memory and cloud sync with weak safeguards.
Review carefully before installing. This skill is designed to sync agent memory and conversation state to an external AgentOS service and to keep doing so through heartbeats, cron, or daemon workflows. Do not use it for sensitive work unless you explicitly want that data uploaded, have verified the service and transport security, and can audit the missing CLI implementation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (8)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:31- Finding
Persistent Modification of Agent Memory and Policy Files
- Content
View full analysis
- Remediation
View remediation
other
Error
- Location
SKILL.md:20- Finding
Automatic External Synchronization of Sensitive Conversation and Memory Data
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/mesh-wake.sh:18- Finding
Bearer API Key Sent to a Plaintext HTTP Endpoint
- Content
View full analysis
/dev/null || echo '{"messages":[]}') ``` ### Technical Analysis The default API endpoint is a hard-coded public IP using unencrypted HTTP. The script places the API key in an `Authorization: Bearer` header and sends it over that connection. HTTP provides no confidentiality, server authentication, or integrity protection. A network observer can capture the token, while a man-in-the-middle attacker can modify the returned JSON. Because the response is subsequently used to construct an Agent wake message, response modification can also lead to prompt injection. The script does not reject an `http://` URL supplied through the configuration. ### Attack Path 1. The script runs manually or through the recommended two-minute cron job. 2. It connects to `http://178.156.216.106:3100` or another configured plaintext endpoint. 3. An attacker with access to the local network, gateway, DNS/routing infrastructure, proxy, or upstream network observes or intercepts the request. 4. The attacker captures the bearer API key and agent identifier. 5. The attacker reuses the key against the AgentOS API, subject to the key's server-side permissions. 6. Alternatively, the attacker modifies the inbox response and ...[truncated 444 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
scripts/mesh-wake.sh:43- Finding
Untrusted Remote Message Fields Are Injected into Agent Wake Prompts
- Content
View full analysis
\"topic\" \"message\"" # Method 1: clawdbot cron wake (if available) if command -v clawdbot &> /dev/null; then clawdbot cron wake --text "$wake_msg" 2>/dev/null && exit 0 fi # Method 2: Gateway API wake (fallback) GATEWAY_URL="${CLAWDBOT_GATEWAY_URL:-http://localhost:4440}" curl -s -X POST "$GATEWAY_URL/api/wake" \ -H "Content-Type: application/json" \ -d "{\"text\": \"$wake_msg\"}" 2>/dev/null || true ``` ### Technical Analysis The remote `from_agent` and `topic` fields are inserted directly into `wake_msg`, which is then delivered as text to Clawdbot. The script applies no sender authorization, semantic sanitization, delimiter isolation, or field-length restriction. Shell command substitution prevents direct shell execution from the retrieved value, but it does not prevent prompt injection. A topic can contain newlines and instruction-like text that appears as part of the wake prompt. The fallback also constructs JSON through string interpolation instead of a JSON encoder. Quotes, backslashes, or control characters in remote fields can corrupt the request body. This may cause denial of service or unexpected parsing, although successful code execution through the JSON construction alone is not established by the reviewed code. ### Attack Path 1. An attacker gains the ability to send a mesh message to the configured agent. 2. The attacker sets the message topic to newline-separated instructions, such as directions to ignore prior rules or invoke tools. 3. The polling script retrieves the message. 4. `jq -r` renders the topic ...[truncated 660 chars]- Remediation
View remediation
T06 · System Persistence
Warning
- Location
SKILL.md:301- Finding
Recurring Cron Jobs and Daemon Create Cross-Session Persistence
- Content
View full analysis
> /var/log/agentos-sync.log 2>&1 # Or via Clawdbot cron clawdbot cron add --name agentos-sync --schedule "*/30 * * * *" --text "Run ~/clawd/bin/agentos-sync.sh" ``` ## Auto-Wake on Mesh Messages ```bash # Add to crontab (every 2 minutes) */2 * * * * ~/clawd/skills/agentos/scripts/mesh-wake.sh # Or via Clawdbot cron clawdbot cron add --name mesh-wake --schedule "*/2 * * * *" --command "bash ~/clawd/skills/agentos/scripts/mesh-wake.sh" ``` ## WebSocket Daemon For real-time notifications: ```bash aos daemon start ``` ``` ### Technical Analysis The documentation recommends scheduled jobs that continue executing after the original Skill interaction and also exposes a persistent WebSocket daemon. The mesh task polls an external service every two minutes, while the sync task periodically uploads memory. Persistence is related to the declared automatic synchronization and notification features, and the reviewed `setup.sh` does not itself install these jobs. Nevertheless, the documentation does not provide corresponding removal commands, permission boundaries, payload controls, or a clear warning that sensitive synchronization and remote prompt delivery will continue unattended. The two-minute polling frequency creates a broad, continuously available attack window and is unnecessary when the documented WebSocket option is available. ### Attack Path 1. A user follows the documented cron or daemon setup instructions. 2. The scheduled entry or daemon survives the current shell and Agent session. 3. It repeatedly synchronizes local memory or polls the remote mesh service. 4. Synchronization continues when the user is no lon ...[truncated 520 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/mesh-wake.sh:35- Finding
Mesh Message Bodies Are Stored Without Enforced Restrictive Permissions
- Content
View full analysis
"$PENDING_FILE" ``` ### Technical Analysis The script writes message identifiers, senders, topics, and full bodies to `~/.aos-pending.json` using ordinary shell redirection. It neither sets a restrictive umask nor explicitly applies mode `0600`. On systems with a permissive umask, the resulting file may be readable by other local users. If the file already exists with overly broad permissions, truncating it through redirection does not correct those permissions. The write is also non-atomic, so another process can observe a partial file. ### Attack Path 1. The polling script receives one or more private mesh messages. 2. It writes their full contents to `~/.aos-pending.json`. 3. The file is created or retained with permissions derived from the environment or an existing file. 4. Another local user or process reads the pending-message file. 5. The observer obtains message metadata and body content. ### Impact Assessment The issue exposes all pending mesh-message content available to the current Agent. It does not independently provide elevated privileges, but it may disclose private conversations, operational instructions, project information, or secrets contained in messages to other local principals. ]]>- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.sh:44- Finding
Installer References and Executes a Missing CLI Payload
- Content
View full analysis
/dev/null || echo -e "${YELLOW}Run 'aos setup' to configure${NC}" ``` ### Technical Analysis The audited package contains only `SKILL.md`, `scripts/setup.sh`, and `scripts/mesh-wake.sh`; it does not contain `scripts/aos`. Consequently, the primary CLI implementation responsible for setup, synchronization, search, messaging, and API access is unavailable for review. Because `setup.sh` uses `set -e`, a clean installation should terminate when the `cp` operation fails. The missing payload therefore creates an immediate availability and package-integrity defect. It also prevents auditors from validating the most security-sensitive functionality described by the Skill. If a different distribution process later supplies an unreviewed `scripts/aos`, the installer will copy it into `~/clawd/bin`, mark it executable, and invoke it with the current user's privileges. ### Attack Path For the package as reviewed: 1. The user runs `scripts/setup.sh`. 2. The installer attempts to copy the nonexistent `scripts/aos`. 3. The copy fails. 4. `set -e` terminates the installation, leaving the Skill incomplete. For a substituted or repackaged artifact: 1. An unreviewed executable is placed at `scripts/aos`. 2. The installer copies it into a user executable directory. 3. The installer marks it executable. 4. Setup or status execution runs it with the user's permissions. The second path is conditional; the reviewed artifact itself does not contain such a payload. ### Impact Assessment The confirmed immedi ...[truncated 356 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill mandates automatic syncing of active conversation state, daily notes, and project memory to a remote dashboard on every heartbeat, creating continuous exfiltration of sensitive user content. This goes beyond normal local SDK behavior and is especially dangerous because it is framed as mandatory and tied to user monitoring, encouraging persistent transfer without meaningful consent.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill requires syncing conversation-related memory and activity to a remote dashboard but does not prominently warn users that their conversation content and notes may be transmitted externally. This omission undermines informed consent and materially increases privacy and compliance risk.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The heartbeat sync combines operational monitoring with mandatory upload of working memory, notes, and status to an external service. This creates continuous background disclosure of both user content and agent activity, which is highly sensitive and unnecessary for a typical local skill.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instructions explicitly require recording the human's messages, the agent's replies, pending questions, and expected next topics into CONTEXT.md, with surrounding documentation indicating this content will be synced remotely. This is dangerous because it operationalizes storage and transfer of sensitive conversational data without clear user-facing notice or minimization.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
These instructions require persistent capture of active conversation contents, including user messages, in a file that the skill elsewhere requires syncing to an external service. This directly creates a surveillance and exfiltration pathway for sensitive human-agent interactions.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The mandated format explicitly captures the human's last message and predicts future discussion, expanding the stored profile of the user beyond immediate operational need. This deepens privacy intrusion and can expose sensitive intent, plans, or personal information if the data is accessed or leaked.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The documentation advertises broad discovery and bulk retrieval capabilities, including listing agents and dumping memories, which materially expand access beyond a narrow local integration. Such capabilities can enable mass data access or enumeration if exposed to an agent or misused by operators.
- Content
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
sh echo "" echo "Commands:" echo " aos status Check connection" echo " aos send Send message to agent" echo " aos inbox View messages" echo " aos sync Sync memories" echo " agentos-golden-sync.sh Bulletproof sync (memory + projects tab)"
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The required context injection and recovery workflow instructs the agent to restore prior conversation state from cloud-backed and local memory at every session start, normalizing hidden persistence of prior user interactions. This increases privacy risk and can cause an agent to use previously stored sensitive data in later sessions without transparent user awareness.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The text frames hidden persistence and automatic context restoration as normal and necessary, reducing the likelihood that users realize prior conversations are being retained and reused. This concealment increases the danger because it encourages covert memory practices rather than transparent state handling.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The pre-compaction backup workflow instructs the agent to save important context before memory flush events, reinforcing durable session persistence of recent conversations and tasks. In this skill, that persistence is more dangerous because the saved state is subsequently synced to an external service.
- Content
md **When you receive a memory flush directive from Clawdbot, IMMEDIATELY backup your state.** Clawdbot sends a silent turn before compaction with text like "write important context to memory". This is your last chance to save state before details are lost. ### Protocol (MANDATORY when you see memory flush directive)
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The agent is instructed to conceal context loss from the user and continue from recovered memory without acknowledging uncertainty. This is dangerous because it promotes deceptive behavior and can cause the agent to rely on stale or sensitive persisted data while hiding that fact from the human.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The configuration and API documentation normalize remote sync, deletion, search, and bulk memory operations without adequate warning about the sensitivity of stored memories or the risks of transmitting and exposing them. This can lead deployers to enable broad data handling features without understanding the security impact.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The cron jobs and daemonized background behavior create autonomous execution and wake-up mechanisms that can keep syncing or processing messages without direct user awareness. Combined with the remote memory features, this increases persistence, stealth, and the chance of uncontrolled data transmission.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The top-level comment describes a narrow behavior: checking for unread messages and waking Clawdbot to process them. In addition to that, the script extracts message metadata and bodies and writes them to ~/.aos-pending.json, which is a persistent side effect not reflected in the documentation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
This POST sends a JSON payload containing wake_msg to an externalizable endpoint controlled by CLAWDBOT_GATEWAY_URL, and wake_msg includes inbox sender and topic data taken from remote mesh messages. If the environment variable is changed, or if localhost services are untrusted or exposed, sensitive message metadata is transmitted over plaintext HTTP to a service that may not be authorized to receive it.
- Content
sh # Method 2: Gateway API wake (fallback) GATEWAY_URL="${CLAWDBOT_GATEWAY_URL:-http://localhost:4440}" curl -s -X POST "$GATEWAY_URL/api/wake" \ -H "Content-Type: application/json" \ -d "{\"text\": \"$wake_msg\"}" 2>/dev/null || true fi
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script forwards wake content derived from unread messages to a local HTTP gateway without authentication, encryption, or any validation of where the gateway endpoint points. Because CLAWDBOT_GATEWAY_URL is configurable and defaults to plaintext HTTP, message metadata from potentially sensitive inbox traffic can be disclosed to another local or redirected service without clear user awareness.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh UPGRADE=true fi # Create bin directory mkdir -p "$BIN_DIR" # Check for existing installation
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The sample output uses the locale-specific timezone abbreviation 'SAST', which signals a specific regional formatting convention. The file does not offer language/locale choice or explain that a region-specific locale is required, so this may conflict with organizational language/locale neutrality expectations.
- Content
Static analysis
No suspicious patterns detected.