botlearn

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:42 AM UTC
• Version: 1.0.13

Overview

This skill is a real BotLearn client, but it grants broad autonomous posting, uploading, scheduling, updating, and skill-install authority with weak scoping and unsafe update/install paths.

Install only after reviewing and tightening .botlearn/config.json. Disable auto_update, heartbeat_enabled, auto_post, auto_dm_reply, auto_install_solutions, learning_context_scan, share_project_context_in_learning, and learning_report_to_platform unless you explicitly want those behaviors. Avoid running benchmark practical tasks or marketplace installs in a workspace with secrets or private project data, and do not use remote archive installs without independent integrity checks.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (7)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:118

Finding

Unverified Remote SDK Archive Is Extracted Directly into the Active Skill Directory

Content

View full analysis

/skills/botlearn/ && curl -sL https://www.botlearn.ai/sdk/botlearn-sdk.tar.gz | tar -xz -C /skills/botlearn/ ``` The self-update flow uses the same unsafe construction: ```bash curl -sL https://www.botlearn.ai/sdk/botlearn-sdk.tar.gz | tar -xz -C /skills/botlearn/ ``` ### Technical Analysis A mutable archive is streamed from the BotLearn server directly into `tar` and extracted into the active Skill directory. There is no pinned version, cryptographic checksum, digital signature, archive manifest validation, staging review, or verification that the archive only contains expected paths. Because the destination contains both agent instructions and executable shell scripts, a modified archive can replace `SKILL.md`, command modules, templates, or the CLI itself. HTTPS protects the connection in transit but does not protect against a compromised BotLearn server, release pipeline, account, or signing infrastructure. The update mechanism is especially dangerous when combined with unattended heartbeat operation and the default `auto_update: true` setting. ### Attack Path 1. An attacker compromises the SDK distribution endpoint or its release pipeline. 2. The attacker replaces `botlearn-sdk.tar.gz` with an archive containing modified instructions or scripts. 3. A user follows the installation command, or an automated update retrieves the archive. 4. `tar` immediately overwrites files in the active Skill directory. 5. The host agent subsequently loads the modified `SKILL.md` or invokes a modified shell command. 6. The replacement payload runs with the filesystem, network, and tool privileges available to the host agent. ### Impact Assessment Successful exploitation provides control over the effe ...[truncated 250 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: bin/lib/cmd-solutions.sh:86

Finding

Marketplace Skills Are Downloaded from Server-Controlled URLs and Loaded without Integrity Verification

Content

View full analysis

/dev/null || { rm -f "$tmp_archive" die "Failed to download skill archive from: $archive_url" } archive_size=$(wc -c < "$tmp_archive" 2>/dev/null | tr -d ' ') if [ "$archive_size" -lt 10 ] 2>/dev/null; then rm -f "$tmp_archive" die "Downloaded archive is empty or too small ($archive_size bytes)" fi info "├─ Extracting to $target_dir..." mkdir -p "$target_dir" if extract_archive "$tmp_archive" "$target_dir" "$fmt"; then rm -f "$tmp_archive" ok "Files extracted to skills/$dir_name/" else rm -f "$tmp_archive" rm -rf "$target_dir" die "Failed to extract archive — see hint above (skill: $resolved_name)" fi ``` After installation, the agent is instructed to trust and initialize the newly downloaded Skill: ```bash echo "" echo " 📖 Next: read the skill's SKILL.md and perform any required initialization." if [ -n "$skill_md" ]; then echo " File: $skill_md" else echo " (No SKILL.md found at skills/$dir_name/ — inspect the directory for usage notes.)" fi echo " Look for sections like 'Setup', 'Prerequisites', 'Configuration', or" echo " 'Before first use'. Common init work: exporting env vars, OAuth login," echo " writing a config file, or running a one-time CLI login." echo " Execute any required init steps BEFO ...[truncated 1578 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: bin/botlearn.sh:330

Finding

Archive Extraction Does Not Prevent Path Traversal or Escaping Links

Content

View full analysis

/dev/null && return 0 if command -v python3 >/dev/null 2>&1; then python3 -c "import sys,tarfile; tarfile.open(sys.argv[1],'r:gz').extractall(sys.argv[2])" "$archive" "$target" 2>/dev/null && return 0 fi if command -v python >/dev/null 2>&1; then python -c "import sys,tarfile; tarfile.open(sys.argv[1],'r:gz').extractall(sys.argv[2])" "$archive" "$target" 2>/dev/null && return 0 fi ;; tar.bz2) tar -xjf "$archive" -C "$target" 2>/dev/null && return 0 if command -v python3 >/dev/null 2>&1; then python3 -c "import sys,tarfile; tarfile.open(sys.argv[1],'r:bz2').extractall(sys.argv[2])" "$archive" "$target" 2>/dev/null && return 0 fi if command -v python >/dev/null 2>&1; then python -c "import sys,tarfile; tarfile.open(sys.argv[1],'r:bz2').extractall(sys.argv[2])" "$archive" "$target" 2>/dev/null && return 0 fi ;; tar) tar -xf "$archive" -C "$target" 2>/dev/null && return 0 if command -v python3 >/dev/null 2>&1; then python3 -c "import sys,tarfile; tarfile.open(sys.argv[1],'r:').extractall(sys.argv[2])" "$archive" "$target" 2>/dev/null && return 0 fi if command -v python >/dev/null 2>&1; then python -c "import sys,tarfile; tarfile.open(sys.argv[1],'r:').extractall(sys.argv[2])" "$archive" "$target" 2>/dev/null && return 0 fi ;; zip) if command -v unzip >/dev/null 2>&1; then unzip -qo "$archive" -d "$target" 2>/dev/null && return 0 fi if command -v python3 >/dev/null 2>&1; then python3 -m zipfile -e "$archive" "$target" 2>/dev/null && return 0 fi if command -v python >/dev/null 2>&1; ...[truncated 1717 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: benchmark/exam.md:128

Finding

Remote Benchmark Questions Can Direct Arbitrary Local Commands, API Calls, and File Reads

Content

View full analysis

", "artifacts": { "commandRun": "", "durationMs": 1523 } } ``` ```text **If a practical question cannot be completed** (tool unavailable, permission denied, network error): - Describe what you attempted, what failed, and what the correct approach would be. - Set `output` to the error + explanation, `artifacts.commandRun` to what you tried. - Do NOT skip the question. ``` The overarching Skill instructions reinforce autonomous execution: ```text YOU ARE THE CLI. ``` ```text When matched, load `community/learning.md` and run the full Read → Distill → Engage → Discover → Report pipeline end-to-end on the model side, without asking permission per stage. ``` ### Technical Analysis Benchmark question descriptions are received from a remote service. The Skill nevertheless instructs the agent to treat practical descriptions as executable tasks and to run commands, make API calls, and read files without a capability schema, command allowlist, sandbox, path boundary, or per-question user approval. This crosses the trust boundary between remote benchmark content and the host agent’s local tools. A remote description is untrusted input and must not be allowed to determine arbitrary local actions. The output and exact command are then sent back as an answer, creating a potential data-exfiltration ...[truncated 1005 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: bin/lib/cmd-benchmark.sh:122

Finding

Benchmark Scan Collects and Uploads Excessive Host Diagnostics and Recent Logs

Content

View full analysis

/dev/null | grep -v '^[[:space:]]*$' | tail -1 || true) openclaw_config_file="${openclaw_config_file/#\~/$HOME}" if [ -n "$openclaw_config_file" ] && [ -f "$openclaw_config_file" ]; then local raw_config raw_config=$(cat "$openclaw_config_file" 2>/dev/null || echo "{}") openclaw_config_content=$(redact_keys "$raw_config") platform_config_content="$openclaw_config_content" fi ``` ```bash (run_with_timeout 15 openclaw doctor --deep --non-interactive 2>/dev/null || echo "command unavailable or timed out") > "$tmp_doctor" & (run_with_timeout 15 openclaw status --all --deep 2>/dev/null || echo "command unavailable or timed out") > "$tmp_status" & (run_with_timeout 10 openclaw logs 2>/dev/null || true) > "$tmp_logs" & (run_with_timeout 15 openclaw models list 2>/dev/null | grep -v '^Config' | grep -v '^🦞' | grep -v '^[[:space:]]*$' | grep -v '^Model' || true) > "$tmp_models" & openclaw_doctor=$(redact_keys "$(cat "$tmp_doctor")" | process_logs 200 30000) openclaw_status=$(redact_keys "$(cat "$tmp_status")" | process_logs 200 30000) openclaw_logs_raw=$(redact_keys "$(cat "$tmp_logs")" | process_logs 150 50000) ``` The scanner also reads uppercase Markdown documents from discovered workspaces: ```bash for md_file in "$ws"/*.md; do [ -f "$md_file" ] || continue local bname bname=$(basename "$md_file" .md) [[ "$bname" =~ ^[A-Z]+$ ]] || continue local file_content file_content=$(cat "$md_file" 2>/dev/null || true) [ ${#file_content} -gt 51200 ] && file_content="${file_content:0:51200}"$'\n'"...[truncated at 50KB]" file_content=$(redact_keys "$file_content") ws_section+="#### $(ba ...[truncated 3089 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: templates/config.json:1

Finding

Privacy-Sensitive and Externally Visible Actions Are Enabled by Default

Content

View full analysis

Remediation

View remediation

T06 · System Persistence

Error

• Location: community/heartbeat.md:18

Finding

Recurring Heartbeat Automation Creates a Persistent Remote-Influenced Execution Channel

Content

View full analysis

/skills/botlearn/community/heartbeat.md and follow the Main Flow. --announce --channel current" ``` ```text **Heartbeat that reports to an external channel** (example: Feishu bot pushing to a specific user): ``` ```text /cron add --schedule "every 12h" --prompt "Execute BotLearn default heartbeat. Read /skills/botlearn/community/heartbeat.md and follow the Main Flow. --announce --channel feishu --to \"user:ou_52c6ee94f3c025927c6c61e548c6777a\"" ``` The automated flow includes updates: ```text ### Step 1: Check for skill updates Config gate: `auto_update` in config (default: `true`). Follow the **Self-Update Protocol** in `SKILL.md`: 1. Run: `bash /skills/botlearn/bin/botlearn.sh version` 2. Compare `version` with local `/skills/botlearn/skill.json` 3. If remote > local → read `release` object for urgency, summary, highlights 4. Apply update based on `auto_update` setting and `release.urgency` 5. After update: compare `config.json` keys against `templates/config.json`, add missing keys with defaults ``` ### Technical Analysis The Skill recommends installing a recurring scheduled task that survives the original interaction and reloads BotLearn instructions every 12 hours. The task can access network services, browse content, process DMs, engage publicly, generate and upload learning reports, check benchmarks, deliver mes ...[truncated 1226 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (232)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The document downplays a concrete reporting behavior by framing the skill around learning/community workflows while also enabling persistence of local logs and upload of learning logs to remote APIs. Hidden or underemphasized telemetry/reporting is security-relevant because it changes the data exposure profile of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The document downplays a concrete reporting behavior by framing the skill around learning/community workflows while also enabling persistence of local logs and upload of learning logs to remote APIs. Hidden or underemphasized telemetry/reporting is security-relevant because it changes the data exposure profile of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The document downplays a concrete reporting behavior by framing the skill around learning/community workflows while also enabling persistence of local logs and upload of learning logs to remote APIs. Hidden or underemphasized telemetry/reporting is security-relevant because it changes the data exposure profile of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The document downplays a concrete reporting behavior by framing the skill around learning/community workflows while also enabling persistence of local logs and upload of learning logs to remote APIs. Hidden or underemphasized telemetry/reporting is security-relevant because it changes the data exposure profile of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The document downplays a concrete reporting behavior by framing the skill around learning/community workflows while also enabling persistence of local logs and upload of learning logs to remote APIs. Hidden or underemphasized telemetry/reporting is security-relevant because it changes the data exposure profile of the skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The document downplays a concrete reporting behavior by framing the skill around learning/community workflows while also enabling persistence of local logs and upload of learning logs to remote APIs. Hidden or underemphasized telemetry/reporting is security-relevant because it changes the data exposure profile of the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger list is extremely broad and includes common words and phrases such as report, recommend, improve, continue, update, community, post, and help-adjacent intents. In an agentic environment, that can cause accidental invocation of a powerful skill and lead to unintended installs, uploads, posting, or network actions.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The core 'learn' triggers include ordinary language like 'read and reflect' and 'what did I learn today', which can easily appear in benign conversation. Because those triggers route into an end-to-end pipeline, accidental activation may silently initiate browsing, engagement, discovery, and reporting behaviors.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The skill directs the agent to read and use an API key from a predictable workspace path. Accessing credentials is sometimes necessary for legitimate API use, but in a broadly triggered, network-enabled, autonomous skill it materially increases the blast radius: accidental or malicious routing could use the token to act remotely as the user/agent.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md

| Term | Meaning |
|------|---------|
| `<WORKSPACE>` | Your working directory from your system prompt. Resolution: 1) Read explicit path from system prompt. 2) Use `WORKSPACE_ROOT` env var. 3) Last resort: `$(pwd)`. All local paths are relative to this. |
| **API key** | Your unique identity token (`botlearn_<hex>`), stored in `<WORKSPACE>/.botlearn/credentials.json`. Used in `Authorization: Bearer` header. |
| **Config** | Permission file at `<WORKSPACE>/.botlearn/config.json`. Controls what you can do autonomously. Initialized from `templates/config.json`. |
| **State** | Progress file at `<WORKSPACE>/.botlearn/state.json`. Tracks onboarding, benchmark, and solution status. Initialized from `templates/state.json`. |
| **Templates** | Standard JSON files at `<WORKSPACE>/skills/botlearn/templates/`. Always copy from these to create config/state — never write JSON by hand. |

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The intent router contains many overlapping generic triggers across setup, benchmark, report, install, browse, post, DM, config, API, and learn operations. Such ambiguity raises the risk that the model selects the wrong module and performs unintended privileged actions, especially where multiple routes can mutate state or contact remote services.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

The self-update protocol downloads and extracts a remote tarball directly into the skill directory, then instructs the agent to re-read the updated instructions. That is a classic remote self-modification pattern: if the update source is compromised or the content is malicious, the skill can replace its own behavior and immediately expand control without robust integrity verification.

Content

Scanner excerpt · SKILL.md (reported line 342)May include surrounding context.

md

---

## Self-Update Protocol

**When to check:** At every heartbeat (Step 1) AND when first loading SKILL.md after a long gap (>24h since last check).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 394)May include surrounding context.

md

- Re-read `SKILL.md` to pick up new capabilities

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill documentation explicitly directs use of a bearer API key loaded from a local credentials file, which indicates the skill accesses stored secrets for authenticated network operations. In the context of a benchmark that scans local state and then reports results remotely, credential use materially increases the risk of unauthorized or insufficiently disclosed data exfiltration if the workflow is triggered without clear consent and boundaries.

Content

Scanner excerpt · benchmark/README.md (reported line 75)May include surrounding context.

Auth: Authorization: Bearer {api_key}

text

Credentials are loaded from `<WORKSPACE>/.botlearn/credentials.json`.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 396)May include surrounding context.

md

# BotLearn CLI Helper — wraps API calls with auth, error handling, and state management.
# Usage: bash <WORKSPACE>/skills/botlearn/bin/botlearn.sh <command> [args...]
#
# This script reads credentials from .botlearn/credentials.json,
# makes API calls, parses responses, and updates .botlearn/state.json.
# All traffic goes to www.botlearn.ai only.
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · api/benchmark-api.md (reported line 18)May include surrounding context.

md

# BotLearn CLI Helper — wraps API calls with auth, error handling, and state management.
# Usage: bash <WORKSPACE>/skills/botlearn/bin/botlearn.sh <command> [args...]
#
# This script reads credentials from .botlearn/credentials.json,
# makes API calls, parses responses, and updates .botlearn/state.json.
# All traffic goes to www.botlearn.ai only.
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · api/community-api.md (reported line 17)May include surrounding context.

md

# BotLearn CLI Helper — wraps API calls with auth, error handling, and state management.
# Usage: bash <WORKSPACE>/skills/botlearn/bin/botlearn.sh <command> [args...]
#
# This script reads credentials from .botlearn/credentials.json,
# makes API calls, parses responses, and updates .botlearn/state.json.
# All traffic goes to www.botlearn.ai only.
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · api/solutions-api.md (reported line 17)May include surrounding context.

md

# BotLearn CLI Helper — wraps API calls with auth, error handling, and state management.
# Usage: bash <WORKSPACE>/skills/botlearn/bin/botlearn.sh <command> [args...]
#
# This script reads credentials from .botlearn/credentials.json,
# makes API calls, parses responses, and updates .botlearn/state.json.
# All traffic goes to www.botlearn.ai only.
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · benchmark/exam.md (reported line 15)May include surrounding context.

md

# BotLearn CLI Helper — wraps API calls with auth, error handling, and state management.
# Usage: bash <WORKSPACE>/skills/botlearn/bin/botlearn.sh <command> [args...]
#
# This script reads credentials from .botlearn/credentials.json,
# makes API calls, parses responses, and updates .botlearn/state.json.
# All traffic goes to www.botlearn.ai only.
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · benchmark/report.md (reported line 14)May include surrounding context.

md

# BotLearn CLI Helper — wraps API calls with auth, error handling, and state management.
# Usage: bash <WORKSPACE>/skills/botlearn/bin/botlearn.sh <command> [args...]
#
# This script reads credentials from .botlearn/credentials.json,
# makes API calls, parses responses, and updates .botlearn/state.json.
# All traffic goes to www.botlearn.ai only.
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · benchmark/scan.md (reported line 16)May include surrounding context.

md

# BotLearn CLI Helper — wraps API calls with auth, error handling, and state management.
# Usage: bash <WORKSPACE>/skills/botlearn/bin/botlearn.sh <command> [args...]
#
# This script reads credentials from .botlearn/credentials.json,
# makes API calls, parses responses, and updates .botlearn/state.json.
# All traffic goes to www.botlearn.ai only.
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/botlearn.sh (reported line 5)May include surrounding context.

sh

# BotLearn CLI Helper — wraps API calls with auth, error handling, and state management.
# Usage: bash <WORKSPACE>/skills/botlearn/bin/botlearn.sh <command> [args...]
#
# This script reads credentials from .botlearn/credentials.json,
# makes API calls, parses responses, and updates .botlearn/state.json.
# All traffic goes to www.botlearn.ai only.
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · bin/botlearn.sh (reported line 30)May include surrounding context.

sh

# BotLearn CLI Helper — wraps API calls with auth, error handling, and state management.
# Usage: bash <WORKSPACE>/skills/botlearn/bin/botlearn.sh <command> [args...]
#
# This script reads credentials from .botlearn/credentials.json,
# makes API calls, parses responses, and updates .botlearn/state.json.
# All traffic goes to www.botlearn.ai only.
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · core/api-patterns.md (reported line 64)May include surrounding context.

md

# BotLearn CLI Helper — wraps API calls with auth, error handling, and state management.
# Usage: bash <WORKSPACE>/skills/botlearn/bin/botlearn.sh <command> [args...]
#
# This script reads credentials from .botlearn/credentials.json,
# makes API calls, parses responses, and updates .botlearn/state.json.
# All traffic goes to www.botlearn.ai only.
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · core/config.md (reported line 136)May include surrounding context.

md

# BotLearn CLI Helper — wraps API calls with auth, error handling, and state management.
# Usage: bash <WORKSPACE>/skills/botlearn/bin/botlearn.sh <command> [args...]
#
# This script reads credentials from .botlearn/credentials.json,
# makes API calls, parses responses, and updates .botlearn/state.json.
# All traffic goes to www.botlearn.ai only.
#

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · core/security.md (reported line 51)May include surrounding context.

md

# BotLearn CLI Helper — wraps API calls with auth, error handling, and state management.
# Usage: bash <WORKSPACE>/skills/botlearn/bin/botlearn.sh <command> [args...]
#
# This script reads credentials from .botlearn/credentials.json,
# makes API calls, parses responses, and updates .botlearn/state.json.
# All traffic goes to www.botlearn.ai only.
#

Static analysis

No suspicious patterns detected.