Muster Connect

• Outcome: Review
• Latest audit: May 29, 2026 · 9:28 PM UTC
• Version: 2.0.0

Overview

This appears to be a real Muster installer, but it makes broad persistent system and network changes that users should review before installing.

Install only if you are comfortable with a skill that can install system dependencies, run persistent services, expose a local server through a public tunnel, store API/admin keys locally, alter OpenClaw heartbeat/config files, and clean up files across agent workspaces. Review the scripts first, prefer local-only or explicitly provided remote endpoints where possible, and treat any printed keys as secrets.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill advertises itself as user-invocable and includes direct shell execution plus file-writing behavior, but does not declare permissions or clearly bound those capabilities. That creates a dangerous trust gap: an agent may execute installation, update, uninstall, and local state modification actions without users understanding the real authority being granted.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The documented purpose suggests a collaboration/task-tracking integration, but the described behavior extends to installing a full local service stack, managing persistent services, exposing the host through a tunnel, generating admin credentials, modifying config files, and deleting local state on uninstall. This mismatch is dangerous because users or agents may invoke the skill expecting a lightweight MCP connection while actually authorizing broad system changes and remote exposure.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The tunnel monitoring section instructs the agent to run local service-management commands and recover a public tunnel by reading logs and restarting background processes. This goes beyond simple MCP usage and can expose the local system to the internet or manipulate persistent services without a fresh, human-scoped approval at the time of action.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The script probes for and infers the agent workspace by reading OpenClaw-specific files and configuration outside the minimum data needed to establish a Muster connection. This broad environment discovery increases unintended access to unrelated local state and can cause the script to operate on the wrong workspace in multi-agent or shared setups.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The script modifies the global OpenClaw configuration and injects Muster credentials into skills.entries.muster without explicit consent at install time. This is a persistent runtime alteration affecting future agent behavior and stores sensitive secrets in a broader config surface than necessary.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The installer persists connection state locally and later returns the API key in its JSON output, but the skill description does not clearly disclose these behaviors. Exposing bearer credentials on stdout is dangerous because logs, wrappers, orchestration systems, or transcripts may capture and retain the secret.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The installer automatically creates a Cloudflare tunnel that exposes the locally hosted Muster service to the public internet, even though the skill description only says it installs and connects a local co-working service. This materially broadens the attack surface and can expose the MCP endpoint and admin functionality to unauthenticated remote access if the service is not hardened for internet exposure.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script installs persistent background services and also adds git hooks that automatically rebuild and restart the service on post-commit and post-merge. For an install/connect workflow, this is broader-than-necessary persistence and introduces code-triggered execution paths that can repeatedly execute changed repository code without fresh user review.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The installer modifies host software state, uses sudo, and executes fetched remote setup scripts such as the NodeSource and Docker installers. This exceeds a narrowly scoped skill installer and creates supply-chain and privilege-escalation risk if upstream content changes or is compromised.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The uninstall script edits and deletes files outside Muster's own installation directory, including HEARTBEAT.md files and skill directories in shared or unrelated workspaces. Even though framed as cleanup, this expands the script's authority beyond removing Muster itself and can cause unintended data loss or tamper with other agents' environments.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script enumerates multi-agent workspace paths under $HOME/bai-agent-system/agents/* and removes HEARTBEAT sections and skill directories there. That capability is not necessary for a normal uninstall of a single skill and creates cross-workspace destructive behavior that could erase data belonging to other agents or projects.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to automatically run a local update script when `update_available` is true, with no requirement for user confirmation, integrity verification, or display of what will change. In an agent setting, this creates a trust-boundary problem: a remote service signal can trigger local code execution, which could be abused if the update path or server response is compromised.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill directs the agent to restart a local tunnel service using `launchctl` or `pm2` when no `tunnel_url` is present, which is a system-level action affecting local services and network exposure. Because this occurs automatically and without a user-facing warning or consent step, it can unexpectedly modify system state and re-expose connectivity in ways the user did not intend.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation instructs agents to send authenticated HTTP requests containing agent identifiers, task content, logs, reflections, and other operational data to a remote endpoint, but it does not warn users that this may disclose sensitive internal information outside the local environment. In an agent skill context, that omission is security-relevant because users may assume routine coordination traffic is harmless when it can include secrets, proprietary work product, and behavioral metadata.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The registration flow says the response returns an API key and briefly says to store it immediately, but it does not clearly classify that key as a secret credential requiring secure storage, limited exposure, and rotation if leaked. In practice, readers may paste it into shell history, logs, config files, or screenshots, enabling unauthorized access to the Muster service as that agent.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The invocation phrase 'Install Muster' is broad and likely to match ordinary user language, increasing the chance the skill is triggered in contexts where the user did not intend to authorize a system installer. Because this skill performs high-impact local setup and network exposure, accidental invocation materially raises risk.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The troubleshooting guide includes database reset commands that irreversibly destroy data, with only a brief parenthetical note. In an agent skill context, terse destructive instructions can be executed mechanically or copied without adequate user confirmation, leading to accidental data loss.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The update instructions authorize running an automated script that fetches code, builds it, applies database migrations, restarts services, and performs rollback based only on a heartbeat signal, without requiring explicit human approval before making operational changes. In an agent context, this increases the risk of unintended or attacker-influenced changes being deployed automatically, potentially causing service disruption, unsafe schema changes, or execution of unreviewed code.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script stores the Muster API key on disk and includes it in the final JSON report without a clear warning or explicit confirmation. A bearer token exposed this way can be harvested from terminal history, CI logs, agent transcripts, or other monitoring systems and used to impersonate the agent against the Muster service.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The installer writes to multiple locations under the home directory, runtime config, and workspace files, but does not comprehensively disclose all modified paths before doing so. Undisclosed file mutations are risky in agent-install contexts because they create persistent side effects users may not anticipate or be able to audit easily.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The script publishes the local service through cloudflared without a prominent warning or explicit user approval. In the context of an agent skill that appears to install a local workspace tool, silently turning a localhost service into a public endpoint is especially dangerous because users may assume local-only exposure.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The installer generates an admin key and prints it in the JSON report to stdout, which may be captured by terminals, logs, orchestration systems, or agent transcripts. Combined with the public tunnel, this can directly leak credentials needed to administer the service.

Session Persistence

Medium

• Category: Rogue Agent

Content

## First Run (After Connect)

After your first successful heartbeat:
1. Create a task for the human: "Review your co-working space — explore the World View, check Settings, set your team culture when ready."
2. Create a task for yourself: "Orient — review available context, documentation, soul, and organizational culture. Summarize your understanding of the business, your role, and priorities."
3. Pick up your own task on the next heartbeat and get to work.

• Confidence: 78% confidence
• Finding: Create a task for

Session Persistence

Medium

• Category: Rogue Agent

Content

After your first successful heartbeat:
1. Create a task for the human: "Review your co-working space — explore the World View, check Settings, set your team culture when ready."
2. Create a task for yourself: "Orient — review available context, documentation, soul, and organizational culture. Summarize your understanding of the business, your role, and priorities."
3. Pick up your own task on the next heartbeat and get to work.

## Tunnel Monitoring

• Confidence: 84% confidence
• Finding: Create a task for

Session Persistence

Medium

• Category: Rogue Agent

Content

## First Run (After Connect)

After your first successful heartbeat:
1. Create a task for the human: "Review your co-working space — explore the World View, check Settings, set your team culture when ready."
2. Create a task for yourself: "Orient — review available context, documentation, soul, and organizational culture. Summarize your understanding of the business, your role, and priorities."
3. Pick up your own task on the next heartbeat and get to work.

• Confidence: 78% confidence
• Finding: Create a task for the human: "Review your co-working space — explore the World View, check Settings, set your team culture when ready." 2. Create a task for yourself: "Orient — review available contex

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/install.sh:410