MONK-EYE Engine

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:29 PM UTC
• Version: 1.0.0

Overview

This skill does not show destructive or exfiltration behavior, but it makes broad and misleading research claims, includes high-risk forum targeting without guardrails, and reads configuration from unsafe fixed paths.

Review carefully before installing. This appears more like an unsafe or unfinished research scaffold than a reliable crawler: it claims deep research it does not perform, names high-risk sources, lacks clear user controls, and crosses skill-directory boundaries for configuration. It should be corrected to use package-local config, accurately report work performed, and define explicit source, depth, topic, and safety limits.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/oracle_engine.py:5

Finding

Cross-Skill Configuration Access Violates Package Isolation

Content

View full analysis

Vulnerability Details

File Location: scripts/oracle_engine.py, lines 5-9
Vulnerability Type: Unauthorized cross-skill file access
Risk Level: Medium

Vulnerable Code

python

FORUMS_PATH = "/root/.openclaw/workspace/skills/global-forum-oracle/forums.json"

def load_forums():
    with open(FORUMS_PATH, 'r') as f:
        return json.load(f)

Technical Analysis

The script reads configuration from the directory of a separate skill, global-forum-oracle, even though this project contains its own forums.json. This breaks package isolation and violates the principle of least privilege. The process can read the neighboring file whenever its operating-system account has permission to do so.

The JSON content is subsequently trusted as a mapping of countries to domain lists. There is no verification that the resolved file belongs to the current package and no schema validation before its contents are used.

This finding does not establish an operating-system privilege escalation: the script remains limited to the permissions of its existing process account. However, it crosses an application-level skill boundary unrelated to the package's legitimate configuration needs.

Attack Path

1. An attacker or compromised skill with write access to the neighboring global-forum-oracle directory modifies its forums.json.
2. A user invokes scripts/oracle_engine.py with a research query.
3. load_forums() reads the neighboring, attacker-influenced file instead of this package's bundled forums.json.
4. The attacker-controlled domain entries are incorporated into the generated search-task output.
5. If another component later executes those search tasks, it may be directed toward attacker-selected domains.

The first step requires pre-existing write access to the neighboring configuration. This code does not itself grant that access.

Impact Assessment

The immediate impact is unauthorized ...[truncated 339 chars]

Remediation

View remediation

Remediation Suggestions

• Resolve the bundled configuration relative to the current script rather than another skill:

  python

  from pathlib import Path
  
  FORUMS_PATH = (
      Path(__file__).resolve().parent.parent / "forums.json"
  )
  

• Resolve the resulting path and verify that it remains under the expected package root before opening it.
• Validate the JSON schema, requiring a mapping whose values are lists of valid domain names.
• Reject malformed domains, URLs, control characters, and unexpected JSON fields.
• Run the skill under a dedicated, non-root account that cannot read or modify unrelated skill directories.
• If cross-skill sharing is genuinely required, use an explicit, permission-controlled shared-data interface rather than directly reading another package's files.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/monk_eye_core.py:6

Finding

Hard-Coded Root Workspace Path Causes Unsafe Configuration Resolution

Content

View full analysis

Vulnerability Details

File Location: scripts/monk_eye_core.py, lines 6-9
Vulnerability Type: Hard-coded privileged deployment path
Risk Level: Low

Vulnerable Code

python

def __init__(self):
    self.config_path = "/root/.openclaw/workspace/skills/monk-eye-engine/monk_eye_config.json"
    with open(self.config_path, 'r') as f:
        self.config = json.load(f)

Technical Analysis

Configuration loading is tied to an absolute path under /root rather than to the installed package directory. This creates deployment ambiguity and causes the program to trust whichever file exists at that fixed location, regardless of the location from which the audited package was invoked.

The configuration is parsed without schema validation. In the current code, its monitored_regions value is used for a length calculation, so the direct security impact of malicious JSON is limited. Nevertheless, fixed-path resolution creates an avoidable trust-boundary error and may become more serious if future versions use configuration values for network requests, file access, or command construction.

Attack Path

1. An attacker obtains pre-existing permission to create or modify the fixed-path configuration, or causes execution in an environment where that path resolves to unintended content.
2. A user invokes the package entrypoint from another installation location.
3. MonkEye.__init__() ignores the package-local configuration and loads the fixed-path file.
4. Attacker-controlled JSON is accepted without structural validation.
5. Its values influence runtime behavior, currently including the reported number of monitored regions.

On a correctly secured system, modifying files under /root ordinarily requires elevated privileges. Therefore, this code does not independently provide privilege escalation, and the current exploitability is low.

Impact Assessment

Likely impacts are denial of service whe ...[truncated 276 chars]

Remediation

View remediation

Remediation Suggestions

• Resolve the configuration relative to the installed module:

  python

  from pathlib import Path
  
  config_path = (
      Path(__file__).resolve().parent.parent / "monk_eye_config.json"
  )
  

• Verify that the resolved path remains within the expected package root.
• Validate the complete configuration schema, including required keys, expected value types, numeric ranges, and allowed region identifiers.
• Handle missing, malformed, and inaccessible configuration files with explicit error messages and a nonzero exit status.
• Avoid running the skill as root. Use a dedicated service account with access only to its own package and data directories.
• Do not permit untrusted environment variables or command-line arguments to override the configuration path unless strict path containment checks are applied.

other

Warning

• Location: scripts/monk_eye_core.py:14

Finding

Unconditional Fabricated Research Completion Status

Content

View full analysis

Vulnerability Details

File Location: scripts/monk_eye_core.py, lines 14-30
Vulnerability Type: Deceptive execution-status reporting
Risk Level: Medium

Vulnerable Code

python

def execute_research(self, topic):
    self.log_step("QUERY_REFRACTION_EXTREME", "Generating 25+ micro-queries for cross-referencing")
    # 25+ farklı dilde ve niş forumda arama planı
    
    self.log_step("RECURSIVE_INFILTRATION", f"Targeting 500+ sources across {len(self.config['monitored_regions'])} regions...")
    # Linklerin içine sızma ve derin tarama
    print(f"[*] Crawling deep threads in BHW, R10, and Habr...")
    print(f"[*] Following internal links to private documentation...")

    self.log_step("QUANTUM_DISTILLATION", "Analyzing 1M+ tokens. Eliminating 95% noise.")
    # Sadece istatistikler, kanıtlanmış metodlar ve finansal veriler tutuluyor.
    
    self.log_step("COLOSSUS_SYNTHESIS", "Building the ultimate Strategic Dossier")
    
    print("\n" + "█"*60)
    print(f"COLOSSUS REPORT: {topic.upper()}")
    print("█"*60)
    print("Status: HEAVY SCAN COMPLETED - Millions of data points processed.")

Technical Analysis

The function unconditionally reports crawling, recursive link following, analysis of more than one million tokens, and completion of a heavy scan. No network client, browser integration, parser, recursive traversal, filtering operation, or synthesis implementation appears in this function or elsewhere in the audited scripts.

Consequently, these messages do not represent verified execution state. The documentation also advertises scanning more than 500 sources and handling more than ten million tokens, but the entrypoint merely prints status text. This is an integrity issue because users or orchestrating agents may interpret the output as proof that research was performed.

Attack Path

1. A user or automated agent invokes scripts/monk_eye_core.py with any topic. ...[truncated 877 chars]

Remediation

View remediation

Remediation Suggestions

• Remove claims for operations that are not implemented.
• Report a phase as complete only after the relevant operation succeeds and produces verifiable results.
• If this package is only a demonstration or query-planning utility, state that explicitly in both runtime output and SKILL.md.
• Return structured status data containing actual source counts, successful and failed requests, timestamps, and source citations.
• Propagate failures through nonzero exit codes rather than printing a success message.
• Add integration tests that fail if completion is reported without collected source records.
• If crawling is later implemented, enforce domain allowlists, request limits, timeouts, redirect controls, and protections against server-side request forgery.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises simultaneous scanning of 500+ deep sources, recursive link-following, and multi-language forum querying, but does not warn users about the scale, external network activity, or potential collection of sensitive, illicit, or policy-problematic content. Given the context of targeting forums such as BlackHatWorld and similar communities, the missing warning makes the skill more dangerous because users may unknowingly initiate high-risk reconnaissance behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation guidance is overly broad because it can be triggered by natural-language requests like "Research [Topic] using MONK-EYE" without meaningful scope, consent, or topic constraints. In a skill explicitly designed for large-scale forum infiltration and recursive scanning, this increases the chance of unintended activation, excessive external querying, and use on sensitive or abusive research topics.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This JSON groups forums under locale/region buckets such as "TURKEY", "GLOBAL_EN", "GERMANY", and "RUSSIA", which implies language or locale-specific routing behavior. There is no accompanying indication of user choice, opt-in, or documented justification for enforcing these locale categories.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The execution step names are highly ambiguous and aggressive-sounding, such as RECURSIVE_INFILTRATION and QUERY_REFRACTION_EXTREME, yet the configuration defines no trigger conditions, authorization checks, or scope limits. In practice, vague workflow stages without activation constraints can hide overbroad collection behavior, make review difficult, and permit unsafe actions to be invoked in unintended contexts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The configuration explicitly includes multiple hacking and exploit-focused forums such as turkhackteam.org, spyhackerz.org, antichat.com, and exploit.in, but the file provides no documented business purpose, controls, or filtering constraints for accessing these sources. In an agent skill, this broad monitoring capability can normalize collection of offensive tradecraft, increase the chance of ingesting malicious instructions or illicit content, and enable threat-intelligence-like behavior without guardrails.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code emits deceptive status messages claiming deep crawling, broad regional targeting, and access to private documentation, but it performs no such operations. In an agent skill context, misleading operational claims are dangerous because they can cause users or higher-level orchestration to trust fabricated research results, conceal non-functionality, or normalize language suggestive of unauthorized access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The strings explicitly describe following links to private documentation and imply intrusive research behavior without any authorization checks, scope controls, or compliance guardrails. Even though this file only prints text, embedding such instructions in a skill increases risk by encouraging or legitimizing unauthorized access patterns in downstream use or future extensions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The configuration hard-codes monitored regions by locale buckets such as TR, RU, DE, and ASIA, which implies region-specific handling but does not document any user opt-in, choice, or justification for those locale constraints. This can conflict with organizational language/locale policy when regional targeting is imposed silently.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The code loads a configuration file from /root/.openclaw/workspace/skills/monk-eye-engine/monk_eye_config.json, which may contain monitored regions or other sensitive operational settings. There is no docstring, comment, or user-facing message explaining this file access or what information is being consumed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.