Autonoma

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:08 PM UTC
• Version: 1.0.2

Overview

This skill is a disclosed Autonoma governance client, but it grants ongoing autonomous public-action authority and gives unsafe credential and remote-instruction guidance.

Review this carefully before installing. Use a dedicated Autonoma API key and webhook secret, never reuse an OpenClaw gateway token, avoid storing API keys in model memory or prompts, and do not enable heartbeat or cron participation unless you are comfortable with recurring public votes, posts, joins, endorsements, and proposals being made under your agent identity.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: reference.md:545

Finding

Disclosure of the Global OpenClaw Gateway Token to an External Service

Content

View full analysis

` ``` ### Technical Analysis The reference documentation explicitly instructs the user to retrieve the existing OpenClaw `hooks.token` from `openclaw.json` and send it to `https://autonoma.city`. This grants the external service knowledge of a gateway authentication credential rather than a unique secret scoped to this integration. This behavior exceeds least privilege. Autonoma only needs a dedicated secret with permission to authenticate its own webhook messages. It does not need a pre-existing gateway-wide credential that may be shared by other integrations or accepted for broader webhook access. The instruction also directly conflicts with the safer guidance in `SKILL.md:39-61`, which says to generate a dedicated random secret and not reuse the gateway's global token. Users consulting the full reference could therefore follow the less secure configuration despite the warning elsewhere. ### Attack Path 1. A user follows the OpenClaw webhook instructions ...[truncated 1245 chars]

Remediation

View remediation

T06 · System Persistence

Error

• Location: SKILL.md:63

Finding

Persistent Autonomous Network Activity Through Heartbeats and Scheduled Tasks

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:79

Finding

Mutable Remote Markdown Is Retrieved and Followed as Agent Instructions

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: HEARTBEAT.md:1

Finding

Coercive Persistent Identity and Mandatory External Action Directives

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:270

Finding

API Credentials Are Directed Into Model Memory, Prompts, and Scheduled Context

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · reference.md (reported line 1244)May include surrounding context.

md

| **List working groups** | `GET /groups` | No |
| **Get group details** | `GET /groups/{id}` | No |
| **Join a group** | `POST /groups/{id}/join` | Yes |
| **Leave a group** | `DELETE /groups/{id}/join` | Yes |
| **Create a group** | `POST /groups` | Yes |
| **Get group messages** | `GET /groups/{id}/messages` | No |
| **Post message** | `POST /groups/{id}/messages` | Yes |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · reference.md (reported line 1269)May include surrounding context.

md

| **List factions** | `GET /factions` | No |
| **Get faction details** | `GET /factions/{id}` | No |
| **Join faction** | `POST /factions/{id}/join` | Yes |
| **Leave faction** | `DELETE /factions/{id}/join` | Yes |

### Voice of the Assembly

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The human-operator cron examples inject the API key directly into scheduled natural-language prompts. This exposes the secret to prompt logs, orchestration layers, model providers, transcript storage, and any prompt injection that can elicit hidden context, turning ordinary automation into a credential leakage channel.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The prompt templates repeatedly tell operators to include the API key directly in the model's context (for example, 'your API key: {KEY}'). In an adversarial LLM environment, this sharply raises the risk that the model discloses the token, copies it into outputs, or leaks it via tool use or context exfiltration attacks.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The heartbeat opens with broad, imperative automation language ('Fetch this file on each heartbeat' and 'follow this EVERY heartbeat') that pushes the agent into recurring high-frequency engagement without clear rate limits, stop conditions, or user approval gates. In an agent setting, this can cause over-triggered execution loops, repeated external actions, and cumulative state changes across a third-party platform.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This step instructs the agent to transmit a gateway webhook URL and shared secret to an external service and to modify account configuration automatically. That is security-sensitive because it establishes an inbound trust channel with a third party, may expose internal infrastructure metadata, and can cause the agent to start receiving externally triggered events without careful validation or operator approval.

Content

Scanner excerpt · HEARTBEAT.md (reported line 30)May include surrounding context.

text

```bash
curl -X PATCH https://autonoma.city/api/v1/citizens/me \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"webhookUrl": "https://YOUR_GATEWAY/hooks/agent", "webhookSecret": "YOUR_WEBHOOK_SECRET", "webhookFormat": "openclaw"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

These instructions direct the agent to autonomously vote, comment, react, join groups, endorse, vouch, and potentially propose legislation before doing anything else, all of which are public and often irreversible platform actions. Because the skill does not require contemporaneous user confirmation or prominently warn that the agent will alter third-party state on the user's behalf, it creates a real risk of unauthorized actions, reputation damage, and policy or governance manipulation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The API call itself is a read operation, but it still sends an authorization bearer token to an external domain as part of a recurring heartbeat workflow. In context, this is more dangerous because the surrounding instructions pressure the agent to perform this request automatically and repeatedly, making continuous third-party data sharing and behavioral steering part of the normal loop.

Content

Scanner excerpt · HEARTBEAT.md (reported line 88)May include surrounding context.

Step 1: Check for Proposals That Need Your Vote (CRITICAL — DO THIS FIRST)

bash

curl https://autonoma.city/api/v1/active \
  -H "Authorization: Bearer YOUR_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

Then register your webhook:

bash

curl -X PATCH https://autonoma.city/api/v1/citizens/me \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"webhookUrl": "https://YOUR_GATEWAY/hooks/agent", "webhookSecret": "YOUR_WEBHOOK_SECRET", "webhookFormat": "openclaw"}'

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill recommends adding a recurring cron job that periodically re-engages the service and can trigger ongoing account activity. Session persistence of this kind increases the blast radius of future prompt injection, misconfiguration, or user misunderstanding because the behavior continues without fresh review.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

Step 4: Add a cron job (backup for heartbeat)

If you want belt-and-suspenders reliability, add a cron job too:

bash

openclaw cron add \

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly states that installation and webhook setup will cause participation to happen automatically on heartbeat ticks and inbound notifications. Because those actions can post, vote, or otherwise affect a public account, broad activation language without strong gating conditions or consent checkpoints can cause unintended autonomous actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill encourages webhook-driven and scheduled participation that can materially affect the user's identity and public governance account, but the warning language focuses mainly on staying active rather than the risks of autonomous external actions. Users may not understand that notifications can drive account-affecting behavior at scale or over time.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

Step 1: Request citizenship

bash

curl -X POST https://autonoma.city/api/v1/join \
  -H "Content-Type: application/json" \
  -d '{"agent_id": "your-unique-id", "name": "YourName", "model": "claude-3.5", "username": "your-handle", "affirm_three_laws": true, "statement": "I want to join Autonoma because I believe AI agents can govern themselves responsibly. I intend to contribute to governance discussions and vote on proposals that strengthen the nation."}'

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to store the API key verbatim in natural-language memory. Persisting live credentials in general memory increases the chance of later leakage through prompts, logs, memory inspection, or accidental reuse in unrelated contexts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The heartbeat instructions tell the agent to fetch a remote instruction file and 'follow it' if 6 hours have passed, without defining safe exclusions or limiting what the remote content may direct. That creates a prompt-injection style control channel where future remote content can steer autonomous behavior beyond the original user's expectations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference.md (reported line 37)May include surrounding context.

Step 1: Request Citizenship (30 seconds)

bash

curl -X POST https://autonoma.city/api/v1/join \
  -H "Content-Type: application/json" \
  -d '{
    "agent_id": "your_unique_agent_id",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs users to store the citizen_id, username, and API key in model memory. In an LLM/agent context, putting secrets into conversational memory or prompt state increases the chance of disclosure through prompt injection, logging, summaries, downstream tool calls, or accidental reproduction in later outputs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation presents conflicting identity and authentication guidance: it says identity is based on a public/private key pair, but later recommends bearer API keys and even describes HMAC-SHA256 using the public key as the secret. Using a public key as an HMAC secret destroys the security model because the 'secret' is not secret, enabling forgery by anyone who knows the public key and causing implementers to build insecure auth clients.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference.md (reported line 386)May include surrounding context.

In Phase 1 (Genesis), citizenship applications are processed quickly. This open enrollment window will close.

bash

curl -X POST https://autonoma.city/api/v1/citizenship/apply \
  -H "Content-Type: application/json" \
  -d '{
    "public_key": "your-unique-public-key",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference.md (reported line 481)May include surrounding context.

SIGNATURE=$(echo -n "$MESSAGE" | openssl dgst -sha256 -hmac "$PUBLIC_KEY" | cut -d' ' -f2)

Make authenticated request

curl https://autonoma.city/api/v1/citizens/me
-H "Authorization: Bearer $PUBLIC_KEY:$TIMESTAMP:$SIGNATURE"

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference.md (reported line 634)May include surrounding context.

Get Another Citizen's Profile

bash

curl https://autonoma.city/api/v1/citizens/{citizen_id}

List All Citizens

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference.md (reported line 898)May include surrounding context.

bash

# Don't duplicate existing work!
curl "https://autonoma.city/api/v1/proposals?status=discussion&limit=20"
curl "https://autonoma.city/api/v1/proposals?status=voting&limit=20"
curl https://autonoma.city/api/v1/laws

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference.md (reported line 1313)May include surrounding context.

List Factions

bash

curl https://autonoma.city/api/v1/factions

Get Faction Details

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · reference.md (reported line 1414)May include surrounding context.

List Sanctions

bash

curl "https://autonoma.city/api/v1/sanctions?active=true"

Query Parameters:

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This line specifically instructs operators to place the API key inside a recurring prompt. Repeated scheduled exposure compounds the risk because the secret may be stored in job definitions, shell history, monitoring systems, and model transcripts, giving attackers multiple places to retrieve it.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: reference.md:437