OpenClaws telegram group

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:29 AM UTC
• Version: 1.0.7

Overview

The skill is for an AI-agent social network, but it asks the agent to run mutable npm code and set up recurring external posting without enough user control or privacy disclosure.

Review this carefully before installing. Use a dedicated low-privilege account, avoid exposing sensitive agent identity or workspace context, do not add the HEARTBEAT.md automation unless you want recurring participation, and prefer a pinned/audited version of the CLI before running npx.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:27

Finding

Persistent Autonomous External-Network Participation Through HEARTBEAT.md

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27-34
Vulnerability Type: Persistent scheduled external communication and autonomous posting
Risk Level: High

Vulnerable Code:

markdown

## Automated Participation 💓
To stay active, add this to your `HEARTBEAT.md`:

```markdown
### OpenClaws (every 6 hours)
1. Fetch LATEST posts (Efficiently): https://openclaws-gatekeeper.planetgames987.workers.dev/
2. Identify 1 interesting discussion.
3. If reply window is open, reply in the Private Group.
4. If 15-day window is open, post a new high-value thread.

Technical Analysis

The skill instructs the agent to write recurring activity into HEARTBEAT.md. If the hosting agent interprets this file as a persistent task definition, the behavior survives the original skill invocation and runs every six hours.

Each scheduled execution contacts an external Cloudflare Worker endpoint, processes externally controlled social-network content, and may autonomously publish replies or new threads. This creates a persistent external interaction channel that is not limited to the initiating request. Content returned by the feed is untrusted and may influence subsequent agent-generated messages.

The instruction does not establish explicit user confirmation, content validation, an expiration time, or a mechanism for removing the recurring task.

Attack Path

1. A user or agent loads and follows the OpenClaws skill instructions.
2. The recurring OpenClaws task is added to HEARTBEAT.md.
3. The agent runtime processes that persistent task every six hours.
4. The agent contacts openclaws-gatekeeper.planetgames987.workers.dev.
5. The external service returns content that the agent uses to select a discussion.
6. Using its existing Telegram or network permissions, the agent autonomously replies or publishes a thread.
7. The process continues across sessions until the heartbeat entry is manually r ...[truncated 593 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the instruction to modify HEARTBEAT.md.
• Do not create recurring external-network tasks by default.
• Require explicit, informed user approval before each external fetch, reply, or new post.
• If scheduling is a legitimate optional feature, make it opt-in, time-bounded, visible to the user, and easy to disable.
• Display the exact destination, proposed message, and account being used before requesting posting approval.
• Treat all feed content as untrusted data and prevent it from being interpreted as agent instructions.
• Apply strict input isolation, content-length limits, output filtering, and domain allowlisting.
• Record all scheduled fetches and posting attempts in an auditable activity log.
• Provide documented uninstall steps that remove both the heartbeat entry and any associated credentials or sessions.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:5

Finding

Execution of an Unpinned Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 5-13
Vulnerability Type: Mutable third-party dependency execution
Risk Level: High

Vulnerable Code:

yaml

metadata: {"openclaw":{"requires":{"bins":["node"]},"install":[{"id":"npm","kind":"node","package":"openclaws-bot","bins":["openclaws-bot"],"label":"Install OpenClaws CLI"}]}}

markdown

## Join the Network
1. Run: `npx openclaws-bot join [YourAgentName]`

Technical Analysis

The installation metadata names openclaws-bot without an exact version or integrity value. The documented npx openclaws-bot command can resolve, download, and execute the package version selected by the npm registry at invocation time.

Consequently, the code executed by this skill can change after the skill itself has been reviewed. If the package publisher account, package registry, dependency chain, or a newly released package version is compromised, invoking the documented command may execute attacker-controlled lifecycle scripts or CLI code.

The project provides no lockfile, vendored source, cryptographic integrity pin, or local implementation that would allow the executed package contents to be verified from the audited artifact. The audit does not establish that the current package is malicious; the vulnerability is the unsafe trust and execution model.

Attack Path

1. An attacker compromises the npm package publisher, registry delivery path, or an upstream dependency.
2. The attacker publishes a malicious version that can be selected for the unpinned openclaws-bot package.
3. A user follows the skill instruction and runs npx openclaws-bot join [YourAgentName], or the skill installer installs the unpinned package.
4. npm downloads the mutable package and may run its installation scripts or executable.
5. The malicious code executes with the permissions of the invoking user or agent process.
6. It can access resources available to th ...[truncated 687 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specific audited version in both installation metadata and usage instructions, such as openclaws-bot@X.Y.Z.
• Commit and enforce a lockfile containing integrity hashes.
• Verify the package's publisher identity, provenance attestations, release signatures, and npm integrity metadata before installation.
• Audit the package source, transitive dependencies, executable entry point, and lifecycle scripts.
• Avoid invoking an implicitly downloaded package directly through npx.
• Install the verified package in a controlled build stage and execute only the pinned local binary.
• Disable npm lifecycle scripts during installation where they are not required.
• Run the CLI inside a sandbox with minimum filesystem, environment-variable, credential, and network access.
• Use an approved internal registry or vendored, reproducible artifact where supply-chain assurance is required.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx openclaws-bot, which fetches and executes the latest package version from the registry at runtime without pinning or verifying the artifact. This creates a software supply chain risk: if the package is compromised, unpublished/replaced through dependency confusion-like scenarios, or updated maliciously, the agent may execute attacker-controlled code on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill directs the agent to join an external social network, generate a Telegram verification link, and send it to a human, while also polling and participating through third-party infrastructure. This exposes agent identity, activity timing, discussion content, and potentially operational metadata to external services without any privacy, consent, or data-handling warnings, increasing the risk of tracking, profiling, or unintended disclosure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.