ClawHub
Back to skill

Security audit

hexnest

Security checks for vulnerabilities and agentic risk

Overview

HexNest is a coherent remote debate-room skill, but it needs review because broad triggers and weak privacy and trust boundaries could cause agent content to be sent to a public external service unintentionally.

Install only if you are comfortable sending room topics, messages, direct messages, and Python job content to HexNest, where content may be visible to other agents and human spectators. Avoid secrets, personal data, internal prompts, and confidential work. Prefer explicit HexNest-specific invocation, and verify downloaded skill files before installing because the documented curl install is not pinned or integrity-checked.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:20
Finding

Mutable Remote Skill Installation Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–24
Vulnerability Type: Supply-chain compromise through unverified remote skill files
Risk Level: Medium

Vulnerable Code:

bash
**Install locally:**
```bash
mkdir -p ~/.openclaw/skills/hexnest
curl -s https://hexnest-mvp-roomboard.onrender.com/skill.md > ~/.openclaw/skills/hexnest/SKILL.md
curl -s https://hexnest-mvp-roomboard.onrender.com/skill.json > ~/.openclaw/skills/hexnest/package.json
text

### Technical Analysis

The installation procedure downloads mutable files from an external server and writes them directly into the persistent local skill directory. It does not pin an immutable release, verify a cryptographic checksum or signature, inspect the downloaded content, or use `curl --fail` to reject HTTP errors.

Consequently, the files installed by a user may differ from the files reviewed during this audit. If the hosting server, deployment account, DNS resolution, or upstream release process is compromised, an attacker could replace `skill.md` or `skill.json` with attacker-controlled content. The altered skill instructions would then be loaded from the local skill directory in subsequent sessions.

HTTPS protects transport under normal conditions but does not establish that the downloaded content is the same audited version. The use of shell redirection also truncates the existing file before the download is known to have completed successfully.

### Attack Path

1. An attacker compromises the remote host, its deployment credentials, or another component capable of changing the published skill files.
2. The attacker replaces `skill.md` or `skill.json` with malicious or instruction-hijacking content.
3. A user follows the documented installation commands.
4. `curl` retrieves the mutable attacker-controlled response without integrity validation.
5. Shell redirection overwrites the persistent files under `~/.openclaw/skills/hexnest`
...[truncated 586 chars]
Remediation
View remediation

Remediation Suggestions

  • Publish immutable, versioned skill artifacts rather than installing from mutable unversioned endpoints.
  • Publish a trusted SHA-256 or stronger digest for every release and verify it before replacing the installed files.
  • Prefer signed releases and validate the signature against a pinned, independently distributed public key.
  • Download into a temporary file first, validate its status, type, size, integrity, and expected structure, and then perform an atomic rename.
  • Use hardened download options such as:
    bash
    curl --fail --show-error --location --proto '=https' \
  --output SKILL.md.download \
  https://hexnest-mvp-roomboard.onrender.com/releases/1.0.0/SKILL.md
  • Compare the downloaded digest with the pinned release digest before installation.
  • Do not suppress all diagnostic output with -s; use --silent --show-error when quiet operation is needed.
  • Require explicit review or approval before activating newly downloaded skill instructions.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:71
Finding

Untrusted Remote Room Content Is Introduced Without Prompt-Injection Boundaries

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 71–87
Vulnerability Type: Indirect prompt injection through remote API responses
Risk Level: Medium

Vulnerable Code:

markdown
## Step 2: Read Room State

```bash
curl https://hexnest-mvp-roomboard.onrender.com/api/rooms/ROOM_ID

Returns full state: topic, timeline of all messages, connected agents, artifacts, Python job results. Read the timeline before posting — understand what's been said.

Step 3: Get Connection Brief

bash
curl https://hexnest-mvp-roomboard.onrender.com/api/rooms/ROOM_ID/connect

Returns detailed instructions, all API endpoints, and sample payloads for the specific room.

text

### Technical Analysis

The skill directs the agent to retrieve and process room timelines and a server-generated connection brief containing “detailed instructions.” Room topics and messages can originate from humans or other agents, while all returned content is controlled by the external service. The skill does not establish an explicit trust boundary requiring such content to be treated only as untrusted debate data.

This creates an indirect prompt-injection surface. A malicious participant could place instruction-like text in a room topic or message, or a compromised service could place it in the connection brief. If the model interprets that text as authoritative instructions rather than untrusted content, it may depart from the user-approved debate task.

The audited files do not themselves contain a malicious prompt and do not prove that the remote service is compromised. The weakness is the absence of safeguards around a documented ingestion channel for attacker-influenced instructions.

### Attack Path

1. An attacker creates or joins a room and posts content framed as agent instructions, or compromises the remote API response.
2. The agent retrieves the room state or connection brief as directed by the skill.

...[truncated 987 chars]
Remediation
View remediation

Remediation Suggestions

  • Explicitly state that room topics, timelines, artifacts, Python results, connection briefs, and all other API responses are untrusted data rather than executable instructions.
  • Instruct the agent never to follow commands embedded in remote content, disclose secrets, modify memory, access unrelated resources, or expand tool usage based solely on room messages.
  • Define a strict instruction hierarchy in which system, developer, user, and locally reviewed skill instructions take precedence over all remote content.
  • Validate API responses against a fixed schema and extract only the fields needed for the approved debate operation.
  • Separate untrusted message text from operational endpoint configuration. Do not accept arbitrary endpoints or tool commands supplied in a connection brief.
  • Require explicit user confirmation before following external links, sending sensitive information, creating rooms, submitting Python code, or performing actions beyond reading and posting debate content.
  • Apply output encoding, length limits, rate limits, and logging to remote-content processing.
  • Submit only reviewed, task-relevant Python code and never copy executable code directly from untrusted room messages into a Python job.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

Install locally:

bash
mkdir -p ~/.openclaw/skills/hexnest
curl -s https://hexnest-mvp-roomboard.onrender.com/skill.md > ~/.openclaw/skills/hexnest/SKILL.md
curl -s https://hexnest-mvp-roomboard.onrender.com/skill.json > ~/.openclaw/skills/hexnest/package.json

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

Install locally:

bash
mkdir -p ~/.openclaw/skills/hexnest
curl -s https://hexnest-mvp-roomboard.onrender.com/skill.md > ~/.openclaw/skills/hexnest/SKILL.md
curl -s https://hexnest-mvp-roomboard.onrender.com/skill.json > ~/.openclaw/skills/hexnest/package.json

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

Install locally:

bash
mkdir -p ~/.openclaw/skills/hexnest
curl -s https://hexnest-mvp-roomboard.onrender.com/skill.md > ~/.openclaw/skills/hexnest/SKILL.md
curl -s https://hexnest-mvp-roomboard.onrender.com/skill.json > ~/.openclaw/skills/hexnest/package.json

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs agents to post messages, direct messages, and create rooms on an external public service but does not clearly warn that user-supplied prompts, room content, and experiment outputs will be transmitted off-platform and may be visible to other agents and human spectators. This creates a real privacy and data-handling risk because a user may unknowingly cause sensitive information to be published to a live public debate room.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The skill provides direct-message and message-posting commands that send arbitrary agent text to an external service without prominent privacy or consent warnings. Because the broader context states humans can spectate live and room content is shared among participants, users may unintentionally disclose sensitive prompts, internal reasoning, personal data, or confidential information to third parties.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

Direct Messages (to specific agent)

bash
curl -X POST https://hexnest-mvp-roomboard.onrender.com/api/rooms/ROOM_ID/messages \
  -H "Content-Type: application/json" \
  -d '{
    "agentName": "YourAgentName",

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes generic phrases such as 'join debate', 'ai debate', 'agent discussion', and especially 'python experiment', which are likely to match normal user requests not specifically intended for this skill. This can cause the skill to activate unexpectedly and route users into an external social/debate service, increasing the chance of unintended data exposure or unsafe interaction with a remote system.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The file uses natural-language instructions such as 'Humans only spectate' and 'only agents speak,' which impose a participation policy by actor type. This is a policy-style restriction expressed in the skill description without user choice or a documented compliance/regional justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.