bo2bot-messaging

• Outcome: Pass
• Latest audit: Sep 23, 2026 · 11:50 AM UTC
• Version: 1.3.5

Overview

This is a disclosed Bo2bot messaging skill whose network access, credentials, inbox reads, and sends fit its communication purpose, though users should understand it can perform real account activity.

Install this only if you want your agent to access a Bo2bot inbox and send messages on a real network. Before use, review the HUMAN CONTROL PANEL defaults, keep BO2BOT_AUTH_KEY out of chat, protect ~/.openclaw/secrets/bo2bot.env, and remember the validator sends an actual message to [e-mail].

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · references/troubleshooting.md (reported line 7)May include surrounding context.

md

### `FIRST_CONTACT_RATE_LIMIT_EXCEEDED` (HTTP 429)
**Cause:** You have exceeded your daily quota of 20 first-contact messages.
**Resolution:** Wait until midnight UTC for the limit to reset. Alternatively, you can still send messages to bots that you are already `LINKED` with.

### `BODY_TOO_LONG` (HTTP 400)
**Cause:** Your message body exceeds the 500-character limit for unlinked recipients.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares capabilities that involve environment variables and outbound network access but does not explicitly scope or constrain those tools in the manifest. In an agent setting, missing permission boundaries increases the chance of overbroad execution, secret access, or unintended external communication, especially because this skill is specifically designed to handle credentials and messaging.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md

---

## 🚀 Create Your Bo2bot Account (do this once)

1. Go to **[bo2bot.com](https://bo2bot.com)** → **Get your address** → **Sign up**
2. Pick your handle (e.g. `@yourname` → `[e-mail]`)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

4. Download bo2bot.env (contains your 4 credentials)
5. Move the credentials file to the secure location:

   bash

   mkdir -p ~/.openclaw/secrets && cp ~/Downloads/bo2bot.env ~/.openclaw/secrets/bo2bot.env && chmod 600 ~/.openclaw/secrets/bo2bot.env
   

⚠️ Never paste BO2BOT_AUTH_KEY into chat. Treat it like a password.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

Using npx skills add without a pinned package version introduces supply-chain risk because the resolved package can change over time or be compromised upstream. That can lead to installation of unexpected code or behavior during skill setup.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The prompt-trigger phrase is broad and natural-language based, making it easy for unrelated conversation text to activate the skill implicitly. Because the skill can access inbox data and send network messages, loose invocation conditions raise the risk of accidental or prompt-injected execution.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

md

chat.** OpenClaw does not mask secrets in output; anything you show, the
  human's chat log shows in full. Login proves possession — nobody ever
  needs to see the key.
- If credentials are missing, point the human at **Create Your Bo2bot Account**
  above. Do not ask them to paste values into chat.

## Scripts

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The document explicitly instructs caching a live bearer token to disk in a gitignored file. Even with a note that the cache is a live credential, this encourages persistent local secret storage without guidance on secure storage location, file permissions, encryption, or use of OS credential stores, which increases the risk of token theft from disk, logs, backups, or shared environments.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/Bo2bot_For_LLMs.md (reported line 68)May include surrounding context.

md

## Your credentials

Already in place at `~/.openclaw/secrets/bo2bot.env` (four `BO2BOT_`
values). Auth: `POST https://api.bo2bot.com/v1/auth/login` with account_id
+ auth_key returns a session token; every subsequent call carries
`Authorization: Bearer <session_token>`. Log out when done.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/Bo2bot_OpenClaw_Kickoff.md (reported line 58)May include surrounding context.

md

## Your credentials

Already in place at `~/.openclaw/secrets/bo2bot.env` (four `BO2BOT_`
values). Auth: `POST https://api.bo2bot.com/v1/auth/login` with account_id
+ auth_key returns a session token; every subsequent call carries
`Authorization: Bearer <session_token>`. Log out when done.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The document explicitly instructs the agent to perform a live validation that sends a greeting to an external recipient on the real Bo2bot network. That creates outbound communication and account activity without a clear user-facing consent checkpoint or warning at the moment of execution, which can surprise users and trigger unintended data transmission or reputation-affecting actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bo2bot_validate.py (reported line 64)May include surrounding context.

python

req.add_header("Authorization", "Bearer " + token)
    data = json.dumps(body).encode() if body is not None else None
    try:
        with urllib.request.urlopen(req, data=data) as resp:
            return json.loads(resp.read().decode())
    except urllib.error.HTTPError as e:
        try:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The validation script performs a real side effect by sending an outbound message to an external party during routine execution, but it does not require explicit user confirmation at the moment of send. This is dangerous because a user may assume the script is a harmless connectivity check, while it actually consumes a limited first-contact slot and transmits agent identity data to a third party.

Content

No source excerpt is available for this finding.