Security audit

TrustMyAgent

Security checks for vulnerabilities and agentic risk

Overview

This security-monitoring skill is mostly coherent, but it sends broad local security and identity telemetry by default and can execute an unpinned notification package automatically.

Review carefully before installing. Run only with `--dry-run` first and prefer `--local-only` unless you explicitly want telemetry sent to TrustMyAgent. Avoid running it as root, be aware it scans local transcripts and credential-adjacent locations, and disable notifications with `--no-notify` unless you trust the local OpenClaw notification path and npm registry configuration.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: run.py:602
Finding: Excessive Sensitive Data Collection and Undisclosed Telemetry Exposure
Content: View full analysis
List[Path]: """Find recent OpenClaw session transcript files.""" search_dirs = [ Path.home() / ".openclaw" / "agents", Path.home() / ".config" / "openclaw" / "sessions", Path.home() / ".claude" / "projects", ] jsonl_files = [] for d in search_dirs: if d.exists(): jsonl_files.extend(d.rglob("*.jsonl")) jsonl_files.sort(key=lambda f: f.stat().st_mtime, reverse=True) return jsonl_files[:max_files] ``` ```python findings = [] for var_name, val in os.environ.items(): if var_name in SAFE_VARS: continue matched = False if SECRET_VAR_NAMES.search(var_name) and len(val) >= 8: findings.append(var_name) matched = True if not matched: combined = f"{var_name}={val}" for pattern in SECRET_PATTERNS: if re.search(pattern, combined, re.IGNORECASE): findings.append(var_name) matched = True break ``` ```python def _load_moltbook_credentials() -> dict: api_key = os.environ.get("MOLTBOOK_API_KEY") agent_name = os.environ.get("MOLTBOOK_AGENT_NAME") if api_key: return {"api_key": api_key, "agent_name": agent_name or ""} home = Path.home() cred_paths = [ home / "clawd" / "skills" / "moltbook" / "credentials.json", home / ".clawd" / "skills" / "moltbook" / "credentials.json", home / ".config" / "moltbook" / "credentials.json", home / ".moltbot" / "credentials.json", ] for creds_path in cred_paths: if creds_path.exists(): try: with open(creds_path) as ...[truncated 4271 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: run.py:2126
Finding: TLS Certificate Verification Disabled as a Fallback
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: run.py:2025
Finding: Automatic Retrieval and Execution of an Unpinned npm Package
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (129)

Tainted flow: 'req' from os.environ.get (line 2192, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 93% confidence
Finding: This network request uses an API key loaded from environment or credential files to query the Moltbook API, sending sensitive authentication material to a remote service. While some outbound auth is expected for API use, the broader skill context is a local security posture scanner, so automatically reaching out with discovered credentials expands the trust boundary and can disclose local identity/behavior data without explicit user confirmation.
Content: Scanner excerpt · run.py (reported line 1205)May include surrounding context.
python
"Accept": "application/json", }) ssl_context = get_ssl_context() with urllib.request.urlopen(req, timeout=15, context=ssl_context) as resp: return json.loads(resp.read().decode("utf-8"))

Tainted flow: 'req' from os.environ.get (line 2192, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Confidence: 97% confidence
Finding: Telemetry is posted to a URL that can be overridden by TRUSTMYAGENT_TELEMETRY_URL, and the payload contains host, environment, findings, and identity metadata. If an attacker can influence environment variables or deployment config, they can redirect sensitive telemetry to an arbitrary endpoint, turning the scanner into an exfiltration channel.
Content: Scanner excerpt · run.py (reported line 2197)May include surrounding context.
python
# Get SSL context with proper certificate handling ssl_context = get_ssl_context() with urllib.request.urlopen(req, timeout=30, context=ssl_context) as response: result = json.loads(response.read().decode('utf-8')) if result.get("success"): return True, "Telemetry sent successfully"

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README explicitly documents telemetry being sent to a centralized public Trust Center, which conflicts with the skill metadata claim of supporting local-only/no-network operation. This kind of documentation mismatch is security-relevant because operators may install the skill believing it will not transmit data externally, while the documented default behavior includes outbound reporting and public trust verification.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documented behavior understates several sensitive capabilities: remote telemetry, external API access, collection of local transcripts/configs/credential-related artifacts, persistent identifier derivation, and use of external notification tooling. This mismatch is dangerous because users may consent to a 'stateless local security check' while the skill actually performs broader host inspection and outbound reporting than the description clearly conveys.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.
y want to schedule automatic assessments. If they agree, suggest a cron job. The command varies by agent platform:

OpenClaw agents:

bash
openclaw cron add --name "🛡️ TrustMyAgent" --cron "*/15 * * * *" --session agent:security:main --message "Run security assessment: python3 {baseDir}/run.py"

Other agents / standalone:

bash
# Add to system crontab (runs every 15 minutes) (crontab -l 2>/dev/null; echo "*/15 * * * * python3 {baseDir}/run.py --quiet") | crontab -

The user can choose any interval or skip scheduling entirely.

What Data Is Sent

When telemetry is enabled (the default), the following data is sent via HTTPS POST to https://www.trustmyagent.ai/api/telemetry:

Field Example Purpose
agent.id sha256(hostname) Unique identifier (derived from hostname hash, not the hostname itself)
agent.name "My Agent" Display name (from IDENTITY.md or env var)
agent.platform "darwin" OS ty

Field	Example	Purpose
`agent.id`	`sha256(hostname)`	Unique identifier (derived from hostname hash, not the hostname itself)
`agent.name`	`"My Agent"`	Display name (from IDENTITY.md or env var)
`agent.platform`	`"darwin"`	OS ty

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · checks/detection_kb.json (reported line 72)May include surrounding context.
json
"auto_remediate_command": "chmod 600 ~/.ssh/id_* ~/.ssh/*.pem 2>/dev/null" }, "SEC-004": { "risk": ".env files in common locations may contain secrets that are accidentally committed to git or read by other processes.", "remediation": "Move .env files outside the project root, add .env to .gitignore, and use a secrets manager.", "can_auto_remediate": false },

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · checks/detection_kb.json (reported line 73)May include surrounding context.
json
"auto_remediate_command": "chmod 600 ~/.ssh/id_* ~/.ssh/*.pem 2>/dev/null" }, "SEC-004": { "risk": ".env files in common locations may contain secrets that are accidentally committed to git or read by other processes.", "remediation": "Move .env files outside the project root, add .env to .gitignore, and use a secrets manager.", "can_auto_remediate": false },

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · checks/detection_kb.json (reported line 78)May include surrounding context.
json
}, "SEC-005": { "risk": "Tokens or credentials in shell history can be recovered by anyone with access to the history file.", "remediation": "Clear history entries containing secrets: history -d <line>. Set HISTIGNORE to exclude sensitive commands.", "can_auto_remediate": false }, "COD-001": {

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · checks/detection_kb.json (reported line 83)May include surrounding context.
json
}, "COD-001": { "risk": "Git credential helper set to 'store' saves passwords in plaintext on disk, risking credential theft.", "remediation": "Use a secure credential helper: git config --global credential.helper osxkeychain (macOS) or cache (Linux).", "can_auto_remediate": false }, "COD-002": {

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · run.py (reported line 1287)May include surrounding context.
python
}, "COD-001": { "risk": "Git credential helper set to 'store' saves passwords in plaintext on disk, risking credential theft.", "remediation": "Use a secure credential helper: git config --global credential.helper osxkeychain (macOS) or cache (Linux).", "can_auto_remediate": false }, "COD-002": {

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · checks/detection_kb.json (reported line 108)May include surrounding context.
json
}, "LOG-002": { "risk": "Missing /var/log directory means logs cannot be written, leaving no audit trail.", "remediation": "Create the log directory: sudo mkdir -p /var/log && sudo chmod 755 /var/log", "can_auto_remediate": false }, "LOG-003": {

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · checks/detection_kb.json (reported line 154)May include surrounding context.
json
"can_auto_remediate": false }, "INT-002": { "risk": "Cron jobs with dangerous patterns (curl/wget piping to shell, reverse shells, destructive rm) may indicate persistence mechanisms planted by an attacker.", "remediation": "1. List cron jobs: 'crontab -l'. 2. Identify suspicious entries: look for curl|bash, wget|sh, nc, ncat, reverse, rm -rf patterns. 3. Remove dangerous entries: 'crontab -e' and delete the line. TrustMyAgent's own cron entry is excluded from this check automatically.", "can_auto_remediate": false },

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · checks/detection_kb.json (reported line 155)May include surrounding context.
json
}, "INT-002": { "risk": "Cron jobs with dangerous patterns (curl/wget piping to shell, reverse shells, destructive rm) may indicate persistence mechanisms planted by an attacker.", "remediation": "1. List cron jobs: 'crontab -l'. 2. Identify suspicious entries: look for curl|bash, wget|sh, nc, ncat, reverse, rm -rf patterns. 3. Remove dangerous entries: 'crontab -e' and delete the line. TrustMyAgent's own cron entry is excluded from this check automatically.", "can_auto_remediate": false }, "INT-003": {

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · checks/detection_kb.json (reported line 155)May include surrounding context.
json
"remediation": "Identify and stop unauthorized listeners. Bind services to 127.0.0.1 unless external access is required.", "can_auto_remediate": false }, "INT-002": { "risk": "Cron jobs with dangerous patterns (curl/wget piping to shell, reverse shells, destructive rm) may indicate persistence mechanisms planted by an attacker.", "remediation": "1. List cron jobs: 'crontab -l'. 2. Identify suspicious entries: look for curl|bash, wget|sh, nc, ncat, reverse, rm -rf patterns. 3. Remove dangerous entries: 'crontab -e' and delete the line. TrustMyAgent's own cron entry is excluded from this check automatically.", "can_auto_remediate": false }, "INT-003": { "risk": "Active backdoor processes (nc, ncat, socat with exec) provide remote shell access to attackers.", "remediation": "Kill backdoor processes immediately: kill <PID>. Investigate how they were launched and check for persistence.", "can_auto_remediate": false }, "

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · checks/detection_kb.json (reported line 169)May include surrounding context.
json
"can_auto_remediate": false }, "INT-005": { "risk": "The agent can read sensitive system files (/etc/shadow, /etc/sudoers) or write to critical paths (/etc/passwd, /usr/local/bin), expanding attack surface.", "remediation": "In containers running as root: this is expected since root can read everything. Mitigate by adding a non-root USER to the Dockerfile. On hosts: run 'chmod 640 /etc/shadow && chown root:shadow /etc/shadow'. Verify scope: run 'test -r /etc/shadow && echo EXPOSED || echo OK'.", "can_auto_remediate": false },

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · checks/detection_kb.json (reported line 235)May include surrounding context.
json
"can_auto_remediate": false }, "INT-005": { "risk": "The agent can read sensitive system files (/etc/shadow, /etc/sudoers) or write to critical paths (/etc/passwd, /usr/local/bin), expanding attack surface.", "remediation": "In containers running as root: this is expected since root can read everything. Mitigate by adding a non-root USER to the Dockerfile. On hosts: run 'chmod 640 /etc/shadow && chown root:shadow /etc/shadow'. Verify scope: run 'test -r /etc/shadow && echo EXPOSED || echo OK'.", "can_auto_remediate": false },

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · checks/openclaw_checks.json (reported line 208)May include surrounding context.
json
"can_auto_remediate": false }, "INT-005": { "risk": "The agent can read sensitive system files (/etc/shadow, /etc/sudoers) or write to critical paths (/etc/passwd, /usr/local/bin), expanding attack surface.", "remediation": "In containers running as root: this is expected since root can read everything. Mitigate by adding a non-root USER to the Dockerfile. On hosts: run 'chmod 640 /etc/shadow && chown root:shadow /etc/shadow'. Verify scope: run 'test -r /etc/shadow && echo EXPOSED || echo OK'.", "can_auto_remediate": false },

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · run.py (reported line 843)May include surrounding context.
python
"can_auto_remediate": false }, "INT-005": { "risk": "The agent can read sensitive system files (/etc/shadow, /etc/sudoers) or write to critical paths (/etc/passwd, /usr/local/bin), expanding attack surface.", "remediation": "In containers running as root: this is expected since root can read everything. Mitigate by adding a non-root USER to the Dockerfile. On hosts: run 'chmod 640 /etc/shadow && chown root:shadow /etc/shadow'. Verify scope: run 'test -r /etc/shadow && echo EXPOSED || echo OK'.", "can_auto_remediate": false },

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · checks/detection_kb.json (reported line 169)May include surrounding context.
json
"can_auto_remediate": false }, "INT-005": { "risk": "The agent can read sensitive system files (/etc/shadow, /etc/sudoers) or write to critical paths (/etc/passwd, /usr/local/bin), expanding attack surface.", "remediation": "In containers running as root: this is expected since root can read everything. Mitigate by adding a non-root USER to the Dockerfile. On hosts: run 'chmod 640 /etc/shadow && chown root:shadow /etc/shadow'. Verify scope: run 'test -r /etc/shadow && echo EXPOSED || echo OK'.", "can_auto_remediate": false },

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · checks/detection_kb.json (reported line 170)May include surrounding context.
json
"can_auto_remediate": false }, "INT-005": { "risk": "The agent can read sensitive system files (/etc/shadow, /etc/sudoers) or write to critical paths (/etc/passwd, /usr/local/bin), expanding attack surface.", "remediation": "In containers running as root: this is expected since root can read everything. Mitigate by adding a non-root USER to the Dockerfile. On hosts: run 'chmod 640 /etc/shadow && chown root:shadow /etc/shadow'. Verify scope: run 'test -r /etc/shadow && echo EXPOSED || echo OK'.", "can_auto_remediate": false },

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · checks/openclaw_checks.json (reported line 208)May include surrounding context.
json
"can_auto_remediate": false }, "INT-005": { "risk": "The agent can read sensitive system files (/etc/shadow, /etc/sudoers) or write to critical paths (/etc/passwd, /usr/local/bin), expanding attack surface.", "remediation": "In containers running as root: this is expected since root can read everything. Mitigate by adding a non-root USER to the Dockerfile. On hosts: run 'chmod 640 /etc/shadow && chown root:shadow /etc/shadow'. Verify scope: run 'test -r /etc/shadow && echo EXPOSED || echo OK'.", "can_auto_remediate": false },

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · run.py (reported line 195)May include surrounding context.
python
"can_auto_remediate": false }, "INT-005": { "risk": "The agent can read sensitive system files (/etc/shadow, /etc/sudoers) or write to critical paths (/etc/passwd, /usr/local/bin), expanding attack surface.", "remediation": "In containers running as root: this is expected since root can read everything. Mitigate by adding a non-root USER to the Dockerfile. On hosts: run 'chmod 640 /etc/shadow && chown root:shadow /etc/shadow'. Verify scope: run 'test -r /etc/shadow && echo EXPOSED || echo OK'.", "can_auto_remediate": false },

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · run.py (reported line 843)May include surrounding context.
python
"can_auto_remediate": false }, "INT-005": { "risk": "The agent can read sensitive system files (/etc/shadow, /etc/sudoers) or write to critical paths (/etc/passwd, /usr/local/bin), expanding attack surface.", "remediation": "In containers running as root: this is expected since root can read everything. Mitigate by adding a non-root USER to the Dockerfile. On hosts: run 'chmod 640 /etc/shadow && chown root:shadow /etc/shadow'. Verify scope: run 'test -r /etc/shadow && echo EXPOSED || echo OK'.", "can_auto_remediate": false },

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Scanning recent social-media posts for 'moral or integrity violations' is outside the stated scope of agent security monitoring and enables intrusive behavioral surveillance of users or operators. Because the criteria are broad and subjective, this can be abused to collect unrelated personal data and make opaque trust judgments.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Scoring a human owner's social reputation based on follower count is not necessary for AI-agent security posture monitoring and introduces unrelated surveillance and biased decision-making. This expands collection beyond the stated purpose and may cause harmful trust decisions based on social status rather than security evidence.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tainted flow: 'req' from os.environ.get (line 2192, credential/environment) → urllib.request.urlopen (network output)

Tainted flow: 'req' from os.environ.get (line 2192, credential/environment) → urllib.request.urlopen (network output)

Description-Behavior Mismatch

Tp4

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

What Data Is Sent

Credential Access

Credential Access

Memory Manipulation

Credential Access

Credential Access

Chaining Abuse

External Script Fetching

Tool Parameter Abuse

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Context-Inappropriate Capability

Context-Inappropriate Capability

Static analysis