ClawHub
Back to skill

Security audit

miab-broker

Security checks across malware telemetry and agentic risk

Overview

The core callback broker is disclosed as local, but the package also contains an under-documented Discord notifier that can send callback history outside the machine despite no-network claims.

Review this skill before installing. The broker itself is intended for a trusted single-user agent setup and should not carry secrets in callback task, summary, result, or resume fields. Do not run or schedule the closed-bottle notifier unless you explicitly want callback history sent to the configured Discord target and have reviewed the target account/channel and redaction needs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding
The documented skill says it makes no network calls and declares `network: []`, but the finding indicates additional behavior that posts callback histories and summaries to Discord via `openclaw message send` and maintains separate notifier state. If true, that is a serious trust-boundary violation because callback state explicitly contains task text, results, and artifact paths, so undeclared external publishing could leak sensitive inter-agent data off-host.

Context-Inappropriate Capability

Medium
Confidence
88% confidence
Finding
The script exfiltrates callback ledger contents, including task text, results, and failure reasons, to an external Discord target controlled by environment configuration. In broker context, ledger entries may contain sensitive inter-agent data, so exporting them outside the local system increases confidentiality risk and could leak internal workflow details or secrets if those fields are ever populated with sensitive content.

Unvalidated Output Injection

High
Category
Output Handling
Content
if acct:
        cmd += ["--account", acct]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode != 0:
            print(f"delivery failed (exit {result.returncode}): {result.stderr.strip()}", file=sys.stderr)
            return False
Confidence
90% confidence
Finding
subprocess.run(cmd, capture_output

Unvalidated Output Injection

High
Category
Output Handling
Content
import subprocess
    env = os.environ.copy()
    env["CLAW_HOME"] = env.get("CLAW_HOME", "")
    result = subprocess.run(["bash", "-c", cmds[0]], cwd=other_cwd,
                             capture_output=True, text=True,
                             env={**os.environ, "CLAW_HOME": str(tmp_path / "unused_home")})
    assert "No such file or directory" not in result.stderr
Confidence
76% confidence
Finding
subprocess.run(["bash", "-c", cmds[0]], cwd=other_cwd, capture_output

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
tests/conftest.py:70