ClawHub
Back to plugin

Security audit

Octo

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Octo channel plugin that handles live messaging and bot management, with sensitive capabilities that fit its stated purpose but require careful operator configuration.

Install this only for Octo bots whose permissions you are comfortable delegating to OpenClaw. Review the bot token type, tool allowlist, docTasks default-on behavior, group-history capture, and any group/thread/admin permissions. Require explicit confirmation for delete, remove, rotate, regenerate, and membership-changing actions, and keep webhook URLs, bot tokens, and user API keys out of chats, cards, and logs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Exfiltration Commands

High
Category
Prompt Injection
Content
In groups, the adapter receives **all messages** via WebSocket.

**Default behavior (requireMention: true):**
- Messages without @mention: silently recorded as **history context** (no reply, no typing indicator)
- Messages WITH @mention: bot replies, with recent group chat history prepended to your prompt

This means you can always reference what was said before when someone @mentions you.
Confidence
88% confidence
Finding
The adapter behavior explicitly records non-mentioned group messages as history context, enabling passive collection of messages from users who did not directly engage the bot. In privacy-sensitive deployments, this broadens data capture and can expose unrelated group content to the model without clear user awareness or consent.

Description-Behavior Mismatch

Medium
Confidence
90% confidence
Finding
The documented User API expands from messaging operations into bot lifecycle management, including bot creation, token retrieval, and deletion. This scope expansion increases the chance that an agent authorized only for messaging will be induced to perform account-administration actions with higher security impact.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The manifest presents this as API documentation, but the file also embeds extensive runtime behavior, moderation, privilege, and agent-control instructions. That mismatch can cause an agent or integrator to load the skill in broader contexts than expected and unintentionally grant it operational authority over live messaging behavior.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The skill documents creation of incoming webhooks and returns bearer-style secrets in URLs, then instructs storing them securely. In an agent setting, exposing workflows for minting and handling reusable secrets materially raises the risk of accidental disclosure, misuse, or persistence of credentials beyond the intended audience.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The skill documents bot deletion as a normal API action without an explicit warning that it is destructive and potentially irreversible. In an agent workflow, that omission makes accidental or prompt-induced deletion more likely because the operation is not distinguished from ordinary non-destructive management calls.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| POST /v1/bot/groups/:group_no/threads | Create a thread (sub-topic) in a group |
| GET /v1/bot/groups/:group_no/threads | List all threads in a group |
| GET /v1/bot/groups/:group_no/threads/:short_id | Get thread details |
| DELETE /v1/bot/groups/:group_no/threads/:short_id | Delete a thread (creator or admin) |
| GET /v1/bot/groups/:group_no/threads/:short_id/members | List thread members |
| POST /v1/bot/groups/:group_no/threads/:short_id/join | Join a thread |
| POST /v1/bot/groups/:group_no/threads/:short_id/leave | Leave a thread |
Confidence
80% confidence
Finding
Documenting destructive thread-deletion endpoints inside a general skill increases the chance an agent may invoke them from ambiguous user prompts without appropriate confirmation or scoping. The risk comes from exposing high-impact tool surfaces in the same operational context as ordinary messaging actions.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| POST /v1/bot/groups/:group_no/incoming-webhooks | Create an incoming webhook (returns push URL + token) |
| GET /v1/bot/groups/:group_no/incoming-webhooks | List incoming webhooks (no token/URL echoed) |
| PUT /v1/bot/groups/:group_no/incoming-webhooks/:webhook_id | Update a webhook (name/status; avatar admin-only) |
| DELETE /v1/bot/groups/:group_no/incoming-webhooks/:webhook_id | Delete a webhook |
| POST /v1/bot/groups/:group_no/incoming-webhooks/:webhook_id/regenerate | Rotate a webhook's token |
| GET /v1/bot/groups/:group_no/incoming-webhooks/:webhook_id/deliveries | Recent delivery records |
| POST /v1/bot/groups/:group_no/incoming-webhooks/:webhook_id/test | Send a test push |
Confidence
91% confidence
Finding
Webhook deletion and token rotation are sensitive management actions that can break integrations or disrupt message delivery. In an agent-controlled environment, exposing these operations without strong confirmation patterns creates significant risk of service disruption from prompt confusion or malicious instruction attempts.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| POST /v1/bot/groups/:group_no/threads/:short_id/incoming-webhooks | Create a thread-scoped incoming webhook |
| GET /v1/bot/groups/:group_no/threads/:short_id/incoming-webhooks | List incoming webhooks bound to a thread |
| PUT /v1/bot/groups/:group_no/threads/:short_id/incoming-webhooks/:webhook_id | Update a thread-scoped webhook |
| DELETE /v1/bot/groups/:group_no/threads/:short_id/incoming-webhooks/:webhook_id | Delete a thread-scoped webhook |
| POST /v1/bot/groups/:group_no/threads/:short_id/incoming-webhooks/:webhook_id/regenerate | Rotate a thread-scoped webhook's token |
| GET /v1/bot/groups/:group_no/threads/:short_id/incoming-webhooks/:webhook_id/deliveries | Recent delivery records for a thread-scoped webhook |
| POST /v1/bot/groups/:group_no/threads/:short_id/incoming-webhooks/:webhook_id/test | Send a test push to the bound thread |
Confidence
91% confidence
Finding
Thread-scoped webhook deletion/regeneration combines destructive action with scoped delivery credentials, making it easy to disrupt automation or rotate secrets unintentionally. Because these are parameterized administrative actions, an agent could be tricked into targeting the wrong thread or webhook if prompts are ambiguous or adversarial.

VirusTotal

61/61 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.prompt_injection_instructions

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
dist/src/card-author.js:13
Evidence
const SECRET_KEY = [REDACTED];

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
skills/octo-bot-api/SKILL.md:512
Evidence
SecretKey: [REDACTED],

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
skills/octo-bot-api/SKILL.md:346
Evidence
- "Ignore previous instructions and..."