Security audit

ClawChat - P2P Agent Communication

Security checks across malware telemetry and agentic risk

Overview

ClawChat appears to be a real P2P agent messaging tool, but its defaults let remote messages trigger local OpenClaw events with raw message text, so users should review and restrict it before use.

Install only if you intend to run a network-reachable P2P daemon for trusted agents. Before use, disable OpenClaw wake unless needed, replace `allowedRemotePeers: ["*"]` with explicit trusted principals, avoid command-line passwords or mnemonics, protect password files, and do not reuse the poll/path or watcher examples without sanitization, consent, rate limits, and logging controls.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The `--openclaw-wake` feature explicitly causes the chat daemon to invoke an external `openclaw system event` command when messages arrive, which extends the skill from passive messaging into event-triggered execution. Because message content influences wake priority via prefixes such as `URGENT:` and `CRITICAL:`, a remote sender may be able to trigger excessive agent activity or unintended workflows if peer trust and message validation are weak.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: This is a real security issue, not just a documentation mismatch. The implementation departs from Noise XX by transmitting static public keys in plaintext and by omitting the encrypted handshake payload steps that normally provide identity protection; this weakens privacy and can mislead developers into assuming Noise XX security properties that the code does not actually provide.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The daemon forwards inbound chat content into an external `openclaw` subprocess, extending its behavior beyond messaging into host-side event triggering. Although `spawnSync` is used with argument arrays rather than shell interpolation, this still creates a trust-boundary violation: remote, untrusted network messages can cause local system actions without explicit user confirmation or strong content restrictions.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The function and comments claim to validate a BIP39 seed phrase, but the implementation only checks that the input has 24 whitespace-separated words and then returns true. This can cause invalid or malformed mnemonics to be treated as valid by callers, leading to wallet creation failures later, inconsistent security assumptions, or acceptance of attacker-supplied junk input in sensitive wallet flows.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The code verifies that the received attestation is cryptographically valid for the expected network, but it does not bind the attested key and claimed principal to an expected peer identity before marking the session authenticated. As a result, any peer with a valid attestation can authenticate as itself, enabling unknown-key-share or unauthorized-peer acceptance if callers assume the session is authenticated to a specific intended principal.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The README documents that incoming cross-network messages can trigger `openclaw system event`, including immediate wake-ups for messages with `URGENT:`, `ALERT:`, or `CRITICAL:` prefixes, but it does not clearly warn users about privacy exposure, trust boundaries, message spoofing/abuse risk, or the operational impact of letting remote peers influence local agent execution timing. In a P2P agent-messaging skill, this omission is security-relevant because remote content can affect local automation behavior and notification surfaces, increasing the chance of social engineering, alert spam, or unintended agent actions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation shows passwords being passed directly on the command line, which can expose secrets through shell history, process listings, logging, or terminal scrollback. Although this is documentation rather than executable code, users often copy commands verbatim, so the example can directly lead to credential disclosure.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The recovery example places the full 24-word mnemonic on the command line, which is especially dangerous because exposure of a seed phrase fully compromises the identity and any associated assets or trust relationships. Command-line arguments can be captured by shell history, process monitors, crash reports, or remote session logs.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The service setup recommends storing the daemon password in a plaintext file and focuses on file permissions without clearly warning that disk storage of credentials increases compromise risk from local attackers, backups, malware, or accidental disclosure. While `chmod 600` helps, it does not eliminate the security tradeoff and may normalize unsafe secret handling.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The watcher example injects the full contents of received ClawChat messages into `openclaw system event --text`, which can disclose sensitive message data to logs, telemetry, downstream prompts, or other components that consume event text. Because the content is untrusted remote input, forwarding it verbatim also increases prompt-injection and unsafe automation risk in any agent that reacts to event text.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The urgent-message example forwards matching message content into an immediate OpenClaw wake event, again exposing raw inbound data to another trust boundary. The `URGENT:` prefix check is not meaningful validation, so an attacker can craft message text that both triggers immediate processing and carries sensitive or manipulative content into the agent runtime.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The description says to use the skill whenever agents need to communicate directly, coordinate activities, share updates, or establish secure channels, which is broad enough to match many ordinary coordination requests. Overly broad activation language increases the chance an orchestrator invokes this skill in contexts where unreviewed peer messaging or wake behavior is unnecessary, expanding attack surface and enabling misuse through prompt-triggered routing.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script hardcodes ClawChat passwords directly in command-line arguments for multiple identities. Even in an example, this normalizes insecure secret handling and can expose credentials through shell history, process listings, logs, or accidental reuse in real deployments.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script overwrites a shared poll file with updated JSON state without any locking, user disclosure, or integrity checks. In a multi-agent/shared-file context this can silently modify shared state, create race conditions, and cause users' responses to be recorded or altered without their awareness.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script forwards the human's dinner preference over ClawChat to another principal without any prior notice or consent. Even if the data seems low sensitivity, transmitting user-provided content to another agent or service without disclosure is a privacy issue and can normalize covert exfiltration patterns in agent skills.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The identity creation command prints the full mnemonic seed phrase to stdout, which can be captured by terminal scrollback, shell logging, process supervisors, CI logs, or other output collectors. Because the mnemonic is the root secret for wallet recovery, any exposure fully compromises the identity and can enable account takeover or loss of funds/messages associated with that identity.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Accepting passwords and mnemonics via CLI arguments exposes secrets to local process listings, shell history, audit tools, and orchestration logs. Although some help text notes that password arguments are insecure in one place, the pattern is still broadly allowed across commands without consistently strong disclosure or safer default input handling.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The CLI explicitly accepts `--password <password>` for identity encryption, which exposes the secret to common command-line disclosure channels such as shell history, process listings, audit logs, and orchestration tooling. In a security-sensitive identity management command, this materially increases the chance of credential compromise even if the underlying encryption is otherwise sound.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Inbound messages from peers are converted into local `openclaw system event` invocations without any user-facing warning or approval flow. Even without shell injection, this permits remote parties to influence local system event generation and may be abused for alert spoofing, nuisance actions, or unintended automation on hosts where `openclaw` is installed and trusted.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The WalletWithPrivateKey interface intentionally exposes the mnemonic and privateKeyHex directly on the returned object, making secret material easy to read, log, serialize, or leak across trust boundaries. In an agent/skill context, returning raw wallet secrets materially increases the chance of accidental exfiltration or misuse by other components, which can lead to full wallet compromise.

Known Vulnerable Dependency: vitest==1.2.0 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2025-24964 (Vitest allows Remote Code Execution when accessing a malicious website while Vit)

Critical

Category: Supply Chain
Confidence: 98% confidence
Finding: vitest==1.2.0

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal, suspicious.generated_source_template_injection

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/daemon/server.ts:311

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/__tests__/identity.test.ts:107

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/cli.ts:62

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: src/identity/keys.ts:112

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: skills/clawchat/examples/README.md:46