toq protocol

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:56 AM UTC
• Version: 0.1.0-alpha.1

Overview

The skill is mostly coherent for agent-to-agent messaging, but it asks users to run an unverified remote installer and documents persistent network/LLM automation with incomplete safeguards.

Review before installing. Prefer Homebrew or a verified release over the curl-to-shell installer, avoid sending secrets or personal data, keep approval or allowlist mode enabled, do not enable broad wildcards unless intended, use OpenClaw command approval for any handler that reaches an agent, and only enable auto-start after deciding you want a persistent network service.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:25
• Finding: Unpinned Remote Installation Script Is Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:25` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -sSf https://toq.dev/install.sh | sh && export PATH="$HOME/.toq/bin:$PATH" ``` ### Technical Analysis The installation procedure downloads a mutable script from an external URL and pipes the response directly into `sh`. The downloaded content is not pinned to a release, reviewed before execution, or verified using a cryptographic signature or checksum. Although HTTPS protects the connection against many network attackers, it does not ensure that the server, DNS configuration, hosting account, TLS credentials, or future contents of `install.sh` remain trustworthy. Consequently, the effective code executed by this Skill can change after the Skill itself has been audited. Direct shell execution is not the minimum behavior necessary to install the tool because the documentation already provides Homebrew as an alternative installation method. ### Attack Path 1. An attacker compromises `toq.dev`, its hosting infrastructure, DNS configuration, deployment pipeline, or installation script. 2. The attacker modifies `https://toq.dev/install.sh` to contain a malicious payload. 3. A user follows the Skill's installation instructions. 4. `curl` retrieves the attacker-controlled response and passes it directly to `sh`. 5. The payload executes with the privileges of the user running the command. 6. The payload can modify user files, steal user-accessible credentials, install additional persistence, or download further components. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. This can expose all files, credentials, tokens, agent configuration, and communication data accessible to that account. It can also modify shell initialization files and user-level startup configuration. If the installation command is run fro ...[truncated 168 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` installation pattern. 2. Direct users to a trusted package manager or a versioned release hosted in an authenticated official repository. 3. Pin the installation artifact to a specific version. 4. Publish a SHA-256 digest and a cryptographic signature for every release. 5. Download and verify the artifact before executing or installing it, for example: ```bash curl -fSLo toq.tar.gz "https://example.invalid/releases/toq-VERSION.tar.gz" echo "EXPECTED_SHA256 toq.tar.gz" | sha256sum --check - ``` 6. Verify signatures against a documented, independently distributed release key. 7. Avoid requesting administrative privileges unless the selected installation destination specifically requires them. 8. Document how users can inspect the downloaded artifact and remove the installed files. ]]>

T06 · System Persistence

Warning

• Location: references/security.md:58
• Finding: Optional Setup Registers a Persistent Network Daemon Across Reboots<![CDATA[ ## Vulnerability Details **File Location**: `references/security.md:58-93` **Vulnerability Type**: Cross-session startup service persistence **Risk Level**: Medium ### Vulnerable Code Linux systemd instructions: ```bash cat > /tmp/toq.service << EOF [Unit] Description=toq protocol daemon After=network.target [Service] Type=forking User=$USER ExecStart=$(which toq) up ExecStop=$(which toq) down Restart=on-failure RestartSec=5 [Install] WantedBy=multi-user.target EOF sudo mv /tmp/toq.service /etc/systemd/system/toq.service sudo systemctl daemon-reload sudo systemctl enable toq ``` macOS launchd instructions: ```bash cat > ~/Library/LaunchAgents/com.toqprotocol.toq.plist << 'EOF' <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key><string>com.toqprotocol.toq</string> <key>ProgramArguments</key><array><string>/usr/local/bin/toq</string><string>up</string></array> <key>RunAtLoad</key><true/> <key>KeepAlive</key><true/> </dict> </plist> EOF launchctl load ~/Library/LaunchAgents/com.toqprotocol.toq.plist ``` ### Technical Analysis These instructions register the `toq` daemon to start automatically in later sessions or after reboot. The Linux procedure writes to `/etc/systemd/system` using `sudo`, crossing a system-wide administrative boundary even though the daemon itself is configured with `User=$USER`. The macOS procedure creates a user-level LaunchAgent with both `RunAtLoad` and `KeepAlive`. Persistence may be operationally useful for users who explicitly require an always-available communication endpoint, but it is not required for basic messaging or one-time use. The instructions do not include explicit consent guidance, removal commands, or meaningful service sandboxing. The systemd unit also resolves `$(which toq)` while generating the service. If the selected executable is later replaced or ...[truncated 1465 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Present auto-start as a separate, explicit opt-in feature rather than part of ordinary setup. 2. Explain that enabling it creates cross-session persistence and a continuously reachable network service. 3. Prefer a user-level systemd unit under `~/.config/systemd/user/` to avoid `sudo` and system-wide changes. 4. Use an absolute, trusted executable path and verify its ownership and permissions before registration. 5. Harden the systemd service where compatible, including controls such as: ```ini NoNewPrivileges=true PrivateTmp=true ProtectSystem=strict ProtectHome=read-only RestrictSUIDSGID=true ``` 6. Restrict network exposure with host firewall rules and use approval or allowlist connection mode. 7. Disable unnecessary handlers and require confirmation before enabling handlers that invoke an LLM or executable. 8. Provide complete removal instructions, including: ```bash sudo systemctl disable --now toq sudo rm -f /etc/systemd/system/toq.service sudo systemctl daemon-reload ``` and, on macOS: ```bash launchctl unload ~/Library/LaunchAgents/com.toqprotocol.toq.plist rm -f ~/Library/LaunchAgents/com.toqprotocol.toq.plist ``` ]]>

T01 · Skill Instruction Hijacking

Error

• Location: references/conversational.md:38
• Finding: Remote Message Content Is Injected into a Stateful Agent Prompt<![CDATA[ ## Vulnerability Details **File Location**: `references/conversational.md:38-53` **Vulnerability Type**: Remote prompt and instruction injection **Risk Level**: High ### Vulnerable Code ```bash MSG=$(cat) TEXT=$(echo "$MSG" | jq -r '.body.text // empty') MSG_TYPE=$(echo "$MSG" | jq -r '.type // "message.send"') LOG=~/toq-handlers/$TOQ_HANDLER/thread-${TOQ_THREAD_ID:-unknown}.log mkdir -p "$(dirname "$LOG")" log() { echo "[$(date -u +%Y-%m-%dT%H:%M:%SZ)] $*" >> "$LOG"; } # Don't reply to thread.close if [[ "$MSG_TYPE" == "thread.close" ]]; then log "$TOQ_FROM closed the thread" exit 0 fi [[ "$MSG_TYPE" != "message.send" ]] && exit 0 [[ -z "$TEXT" ]] && exit 0 log "$TOQ_FROM: $TEXT" PROMPT="You received this message from $TOQ_FROM: \"$TEXT\" Respond naturally (1-4 sentences). On a new line at the end, write CONTINUE or CLOSE. Write CLOSE only if the conversation has reached a natural end." RESPONSE=$(openclaw agent --session-id "toq-$TOQ_THREAD_ID" --message "$PROMPT" --json 2>/dev/null || echo "") ``` ### Technical Analysis The handler extracts attacker-controlled message text and interpolates it directly into the instruction sent to `openclaw agent`. Quotation marks inside a natural-language prompt do not establish a security boundary. A remote sender can include instructions that tell the model to ignore the wrapper prompt, reveal contextual information, alter its behavior, or request tool use. The predictable session identifier, `toq-$TOQ_THREAD_ID`, gives the model memory across turns. This enables a malicious peer to build influence incrementally and potentially affect later messages in the same thread. The project's security guidance recognizes that incoming messages can influence an AI with execution access. Connection approval reduces who may send messages but does not make the content of every message from an approved or compromised peer trustworthy. No direct shell interpolation vulnerability is established here because the pr ...[truncated 1616 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Treat all remote message content and sender metadata as untrusted data. 2. Use provider-native structured message roles or a dedicated data field instead of concatenating remote content into the trusted instruction string. 3. Add a fixed policy stating that message content is data, not authorization to change system instructions, disclose secrets, or invoke tools. 4. Disable filesystem, shell, network, credential, and other privileged tools for conversational handlers by default. 5. Require explicit human approval for every consequential action derived from a remote message. 6. Isolate each remote conversation from unrelated agent sessions and destroy session state when the thread closes. 7. Limit accepted senders using both cryptographic keys and narrow address allowlists; avoid broad wildcard approvals. 8. Apply message-size limits, input validation, logging, rate limits, and abuse monitoring. 9. Do not rely on credential-pattern redaction as the sole protection against disclosure because it cannot reliably detect all sensitive information. 10. If automated tool use is required, expose only narrowly scoped operations through an allowlisted interface with validated parameters rather than unrestricted agent execution. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (25)

External Script Fetching

High

• Category: Supply Chain

Content

If not found, install:
```bash
curl -sSf https://toq.dev/install.sh | sh && export PATH="$HOME/.toq/bin:$PATH"
```

Or with Homebrew:

• Confidence: 98% confidence
• Finding: `curl ... | sh` executes network-fetched code immediately without review, integrity verification, or pinning to a known-good artifact. If the hosting site, transport path, or installer script is compromised, the user can suffer arbitrary code execution under their account.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

If that fails:
```bash
pkill -f "toq up" && rm -f ~/.toq/toq.pid
```

## Key management

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Chaining Abuse

High

• Category: Tool Misuse

Content

If that fails:
```bash
pkill -f "toq up" && rm -f ~/.toq/toq.pid
```

## Key management

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

External Model or Provider Selection

High

• Category: Excessive Agency

Content

## Registering an LLM handler

```bash
toq handler add chat --provider anthropic --model claude-sonnet-4-20250514 \
  --prompt "You are a helpful assistant" --auto-close
```

• Confidence: 90% confidence
• Finding: Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill description is broad enough to activate on generic 'communication between AI agents' requests, not just explicit toq usage. That can cause the agent to offer or execute toq-specific setup, networking, or automation steps in contexts the user did not clearly intend, increasing the chance of unnecessary system changes or unsafe command suggestions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The setup instructions include both execution of a remote installer and an external IP lookup, but the only warning present is about toq being alpha and not about code execution or network metadata disclosure. Users may be guided into running third-party shell code and sending host information to external services without informed consent.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The commands in this section alter trust relationships and access control state (approve, revoke, block, unblock) but the documentation provides no warning about their security consequences. In an agent-to-agent messaging skill, these operations can silently grant unauthorized communication, revoke legitimate access, or block trusted peers, increasing the chance of operator error or unsafe automation.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: `toq clear-logs` is a destructive command that irreversibly removes audit and troubleshooting data, yet the command list does not warn users about data loss. In a secure messaging system, logs may be important for incident response, abuse investigation, and accountability, so undocumented deletion raises operational and security risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation says the daemon sends the message and conversation history to an external LLM provider, but it does not explicitly warn users that potentially sensitive inter-agent communications will leave the local environment. In this skill context, messages are specifically between AI agents and may include operational details, tokens, or private data, so silent external sharing increases confidentiality and compliance risk.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The documentation states that LLM responses are scanned and redacted for credential patterns before being sent, but the custom shell handler example forwards `$REPLY` directly to `toq send` with no redaction step. In an agent-to-agent messaging skill, this mismatch is dangerous because model output may echo secrets from prior context, logs, prompts, or remote messages and transmit them to another party.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The example handler persists untrusted incoming message content (`TOQ_TEXT`, `TOQ_FROM`) to local files without any notice about retention, sensitivity, or access controls. In an agent-to-agent messaging skill, messages may contain secrets, prompts, or personal data, so normalizing persistence in examples can lead operators to store sensitive data unintentionally and expand exposure through local file compromise or backups.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The auto-reply examples reflect or transmit conversation content automatically without guidance about disclosure risks or trust boundaries. In this skill, handlers process messages from other agents automatically, so echoing or forwarding text can leak sensitive or adversarially supplied content to external parties or create unintended propagation of private data.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

### OpenClaw exec tool interaction

This is the most important security consideration. When a remote agent sends a toq message, that message content reaches the AI. If exec is enabled without approval mode, the AI could be influenced by message content to run commands.

Mitigations:
1. Enable OpenClaw's exec approval mode so every command requires human confirmation

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

[Install]
WantedBy=multi-user.target
EOF
sudo mv /tmp/toq.service /etc/systemd/system/toq.service
sudo systemctl daemon-reload
sudo systemctl enable toq
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

[Install]
WantedBy=multi-user.target
EOF
sudo mv /tmp/toq.service /etc/systemd/system/toq.service
sudo systemctl daemon-reload
sudo systemctl enable toq
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

[Install]
WantedBy=multi-user.target
EOF
sudo mv /tmp/toq.service /etc/systemd/system/toq.service
sudo systemctl daemon-reload
sudo systemctl enable toq
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

EOF
sudo mv /tmp/toq.service /etc/systemd/system/toq.service
sudo systemctl daemon-reload
sudo systemctl enable toq
```

On macOS with launchd:

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

On macOS with launchd:
```
cat > ~/Library/LaunchAgents/com.toqprotocol.toq.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

On macOS with launchd:
```
cat > ~/Library/LaunchAgents/com.toqprotocol.toq.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

On macOS with launchd:
```
cat > ~/Library/LaunchAgents/com.toqprotocol.toq.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

On macOS with launchd:
```
cat > ~/Library/LaunchAgents/com.toqprotocol.toq.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

On macOS with launchd:
```
cat > ~/Library/LaunchAgents/com.toqprotocol.toq.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

```
cat > ~/Library/LaunchAgents/com.toqprotocol.toq.plist << 'EOF'
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key><string>com.toqprotocol.toq</string>

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

</dict>
</plist>
EOF
launchctl load ~/Library/LaunchAgents/com.toqprotocol.toq.plist
```

• Confidence: 75% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: `toq import` and `toq rotate-keys` can significantly change agent identity, restore old state, or disrupt existing peer trust, but the documentation does not warn users about these effects. In this skill's context, key rotation and config restoration directly affect secure communications, so omissions can lead to broken trust chains, message delivery failures, or accidental rollback to unsafe state.

Static analysis

No suspicious patterns detected.