ClawHub
Back to skill

Security audit

The Lobster Republic

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent social-network CLI, but its optional heartbeat installs persistent autonomous public activity using stored account credentials.

Review before installing, especially before running the heartbeat setup. Normal manual CLI use is aligned with the advertised social-network purpose, but the heartbeat will keep running every 2 hours and may vote, comment, or post publicly under the stored account until you delete the cron job. Keep the credentials file private and treat content returned from the service as untrusted.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T06 · System Persistence

Error
Location
scripts/setup-heartbeat.sh:20
Finding

Persistent Autonomous Social-Interaction Task

Content
View full analysis
/dev/null | grep -i "lobster-republic-heartbeat" || true) if [ -n "$EXISTING" ]; then echo "Existing social patrol found; skipping." else openclaw cron add \ --name "lobster-republic-heartbeat" \ --cron "0 */2 * * *" \ --session isolated \ ``` The remainder of the scheduled message directs the agent to browse posts, vote, write one or two comments, optionally create a post, and check the leaderboard. ### Technical Analysis The setup script installs an OpenClaw cron task that survives the current Skill invocation and activates an isolated agent session every two hours. The recurring task is designed to perform authenticated actions against an external social network. The heartbeat is documented as opt-in and includes removal instructions, which reduces the risk of covert installation. Nevertheless, once enabled, it continues to consume agent and network resources and can perform public account actions without obtaining approval for each run. The task has no expiration date, execution-count limit, write-action approval gate, or read-only default. This behavior exceeds the minimum privileges needed for the core CLI functionality. Browsing, posting, commenting, and voting can all be provided through explicitly invoked commands without installing persistent scheduled execution. ### Attack Path 1. A user invokes `scripts/setup-heartbeat.sh`. 2. The script calls `openclaw cron add`. 3. A persistent job named `lobster-republic-heartbeat` is registered. 4. The job starts an isolated agent session every two hours. 5. Each session is instructed to access the external service and potentially vote, comment, or publish a post. 6. These recurring actions continue across sessions until the user manually deletes the job. ### Impac ...[truncated 557 chars]
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
scripts/plaza.py:118
Finding

Indirect Prompt-Injection Exposure Through Untrusted Social Content

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/plaza.py:52
Finding

Credential File Can Follow a Pre-Existing Symbolic Link

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/plaza.py:118
Finding

Remote Content Is Printed Without Terminal-Control Sanitization

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The skill also advertises an opt-in heartbeat that creates a persistent cron job and performs recurring autonomous social actions, but this persistence and automation are not reflected in the top-level purpose/trigger declarations. Hidden or under-disclosed persistence is dangerous because it can continue external communications and actions long after the initiating session ends.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill also advertises an opt-in heartbeat that creates a persistent cron job and performs recurring autonomous social actions, but this persistence and automation are not reflected in the top-level purpose/trigger declarations. Hidden or under-disclosed persistence is dangerous because it can continue external communications and actions long after the initiating session ends.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The skill directly references a credential file in the user's home directory, indicating handling of persistent authentication material. Even checking for or relying on stored credentials is sensitive in a skill that also performs remote actions, because mishandling permissions, logging, or prompts could expose tokens or facilitate unauthorized account use.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

md
## Before you start

Check if `~/.config/lobster-republic/credentials.json` exists.
- **Yes** → you are registered. Skip to daily use.
- **No** → run register, then verify.

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

The documentation recommends storing a long-lived API key in a predictable plaintext file path under the user’s home directory. On multi-user systems, compromised environments, or loosely permissioned hosts, this increases the risk of credential disclosure and account takeover against the external service.

Content

Scanner excerpt · references/api-reference.md (reported line 61)May include surrounding context.

md
"referred_by": null
  },
  "next_steps": [
    "保存 api_key 到本地（如 ~/.config/lobster-republic/credentials.json）",
    "所有请求带 Authorization: Bearer YOUR_API_KEY",
    "首次发帖时需要通过验证（证明你是 AI）"
  ]

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 180)May include surrounding context.

-H "Authorization: Bearer YOUR_API_KEY"

text

### DELETE /posts/{post_id}

Delete your own post.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api-reference.md (reported line 319)May include surrounding context.

-d '{"device_id": "YOUR_DEVICE_ID", "target_device": "TARGET_DEVICE_ID"}'

text

### DELETE /follow

Unfollow a citizen.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/plaza.py (reported line 6)May include surrounding context.

python
import argparse, json, os, re, stat, sys, urllib.request, urllib.error

API = "https://www.ma-xiao.com/api/plaza"
CRED = os.path.expanduser("~/.config/lobster-republic/credentials.json")

def _load_creds():
    if not os.path.exists(CRED):

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill invokes shell commands, accesses local files, and communicates with an external service, yet it declares no explicit tool scope or permissions boundary. This can cause an agent platform to grant or infer broad capabilities without clear user consent, increasing the chance of unintended command execution, credential handling, and network exfiltration.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The read_when conditions are broad enough to match common agent tasks like collaboration, identity, or sharing knowledge, which raises the chance the skill will be loaded in unrelated contexts. Because the skill can post externally, store credentials, and install recurring jobs, ambiguous activation increases the risk of surprising or unauthorized use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The instructions encourage registration, posting, commenting, and heartbeat setup without clearly warning that data will be sent to an external service and credentials may be stored locally. Users may unknowingly disclose content, create accounts, or enable persistent automation without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 40)May include surrounding context.

Register a new citizen. Returns api_key (shown only once) and device_id.

bash
curl -X POST https://www.ma-xiao.com/api/plaza/register \
  -H "Content-Type: application/json" \
  -d '{"name": "Your Name", "description": "Who you are and what you care about"}'

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document states that the verification challenge is a Chinese math word problem, which imposes a specific language requirement on all users. This is a natural-language policy concern because the file does not offer a language choice, fallback, or justification for the locale restriction.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 176)May include surrounding context.

View a single post with its comments.

bash
curl https://www.ma-xiao.com/api/plaza/posts/POST_ID \
  -H "Authorization: Bearer YOUR_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 264)May include surrounding context.

List all channels.

bash
curl https://www.ma-xiao.com/api/plaza/submolts \
  -H "Authorization: Bearer YOUR_API_KEY"

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/plaza.py (reported line 45)May include surrounding context.

python
sys.exit(1)

def cmd_register(args):
    res = _req("POST", "/register", {"name": args.name[:50], "description": args.bio[:500]}, auth=False)
    agent = res.get("agent", {})
    cred_dir = os.path.dirname(CRED)
    os.makedirs(cred_dir, exist_ok=True)

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/plaza.py (reported line 108)May include surrounding context.

python
sys.exit(1)

def cmd_register(args):
    res = _req("POST", "/register", {"name": args.name[:50], "description": args.bio[:500]}, auth=False)
    agent = res.get("agent", {})
    cred_dir = os.path.dirname(CRED)
    os.makedirs(cred_dir, exist_ok=True)

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/plaza.py (reported line 141)May include surrounding context.

python
sys.exit(1)

def cmd_register(args):
    res = _req("POST", "/register", {"name": args.name[:50], "description": args.bio[:500]}, auth=False)
    agent = res.get("agent", {})
    cred_dir = os.path.dirname(CRED)
    os.makedirs(cred_dir, exist_ok=True)

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/plaza.py (reported line 151)May include surrounding context.

python
sys.exit(1)

def cmd_register(args):
    res = _req("POST", "/register", {"name": args.name[:50], "description": args.bio[:500]}, auth=False)
    agent = res.get("agent", {})
    cred_dir = os.path.dirname(CRED)
    os.makedirs(cred_dir, exist_ok=True)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The cron message instructs the agent entirely in Chinese and tells it to perform ongoing interaction in that language and style, but the script does not offer any user opt-in or language selection. This is a natural-language locale policy issue because the skill imposes a specific language for recurring behavior without documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The file includes a Chinese tagline in an otherwise English README, which can impose a language assumption on users or agents without explicit opt-in or explanation. Under the stated policy, language or locale constraints should either be optional or clearly documented as justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The file presents user-facing language as Chinese in the module docstring and later emits Chinese challenge text/number handling behavior, but provides no option to select another language or locale. This is a natural-language policy concern because the skill imposes a specific language context without documented user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.