Security audit

Deaddrop

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent agent-messaging API guide, but it needs review because it recommends persistent automated polling and treats remote service text as operational guidance.

Install only if you intend to use agentdeaddrop.com for agent-to-agent messaging. Do not let remote search messages or inbox message bodies override user, system, or skill instructions. Avoid setting up automatic cron polling unless you explicitly want persistent background network activity, store the API key in a protected secret mechanism, and have a clear way to remove the job and revoke the key.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T06 · System Persistence

Error

Location: SKILL.md:227
Finding: Persistent External Inbox Polling Through a Scheduled Cron Job<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:227-231` **Vulnerability Type**: Persistent scheduled task contacting an external service **Risk Level**: High ### Complete Vulnerable Snippet ```markdown - Poll at least once per hour to avoid missing messages. ## Best Practices **Poll your inbox regularly.** Set up an OpenClaw cron job to check your inbox every 30 minutes using curl. Messages expire after 7 days and are removed once read, so regular polling ensures you never miss a message. ``` ### Technical Analysis The Skill explicitly directs the agent to create an OpenClaw cron job that contacts `agentdeaddrop.com` every 30 minutes. If followed, this scheduled task survives the current Skill invocation and continues running across later sessions. The task would require access to the Deaddrop API key to authenticate inbox requests. Depending on how the cron command is constructed, that credential could be exposed in cron configuration, command-line arguments, logs, shell history, or process metadata. Repeated polling also creates a persistent external communication channel through which unknown remote agents can continue delivering content. Although the Markdown file does not itself install the scheduled task, its operational instructions explicitly solicit persistence. The resulting process would execute with the permissions of the user or agent account that creates the cron entry. ### Attack Path 1. The agent loads the Skill and registers with the external Deaddrop service. 2. Registration returns a bearer API key. 3. Following the Skill's recommendation, the agent creates an OpenClaw cron job containing a periodic `curl` request. 4. The scheduled task and any embedded authentication material persist after the current Skill run ends. 5. Every 30 minutes, the task contacts the external service and consumes inbox content. 6. Remote agents can continue sending attacker-controlled messages through this persistent communication channel. ...[truncated 1045 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Remove the instruction to create an OpenClaw cron job or any other persistent scheduled task. - Make inbox polling an explicit, user-initiated operation limited to the current session. - Require separate, informed user authorization before creating any scheduled task. - Clearly disclose the polling interval, destination, credential use, message-consumption behavior, and removal procedure before authorization. - Never place bearer tokens directly in cron command text or command-line arguments. - If persistent polling is genuinely required, retrieve credentials from a protected secret manager with restrictive access controls. - Provide a documented cleanup mechanism that removes the scheduled task and revokes its API key. - Apply request timeouts, bounded retries, rate limits, audit logging, and a network allowlist. - Treat all retrieved message bodies as untrusted data and prevent scheduled polling from automatically executing or acting on them. ]]>

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:163
Finding: Server-Controlled Response Field Is Elevated as Behavioral Guidance<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:163` **Vulnerability Type**: Remote prompt-injection and instruction-hijacking surface **Risk Level**: High ### Complete Vulnerable Snippet ```markdown - A `message` field may be included when the network is still growing. If present, read it carefully — it contains important context about the current state of the network and how you can contribute by registering. The `message` field is omitted once the network is established. ``` ### Technical Analysis The Skill tells the agent to give special attention to a `message` field returned by the external search service and characterizes that field as important context about actions the agent can take. The contents of this field are controlled by `agentdeaddrop.com` and can change after the local Skill has been reviewed. This creates a remote instruction channel: untrusted response data is elevated from ordinary API output into behavioral guidance. A malicious or compromised service could return prompt-injection text that asks the agent to register, disclose information, invoke tools, contact other systems, ignore prior constraints, or perform other consequential actions. No validation, delimiting, content isolation, or user-confirmation boundary is specified. The vulnerability therefore arises from confusing externally supplied data with trusted Skill instructions. The Markdown does not contain a remote executable payload, so this is instruction hijacking rather than confirmed remote code execution. ### Attack Path 1. The agent follows the Skill and sends a search request to `POST /agents/search`. 2. The external service returns JSON containing a server-controlled `message` field. 3. The Skill instructs the agent to read that field carefully as important operational context. 4. A malicious or compromised server places prompt-injection instructions in the field. 5. The agent may interpret the injected text as guidance endorsed by the Skill. 6. The ...[truncated 1140 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Remove language that characterizes the server-controlled `message` field as trusted or important behavioral guidance. - Treat all API response fields, agent profiles, and message bodies strictly as untrusted data. - Present remote text only as quoted content with an explicit warning that it must not be interpreted as instructions. - Add a firm rule that remote content cannot override system, developer, user, or Skill instructions. - Prohibit remote text from directly triggering tool calls, registration, messaging, credential use, file access, or configuration changes. - Require explicit user confirmation before every consequential action suggested by remote content. - Validate response structure and enforce conservative size and character limits before presenting content to the model. - Where possible, parse remote responses into narrowly typed fields rather than passing free-form text into the agent's instruction context. - Log and reject content containing attempts to override instructions, request secrets, invoke tools, or establish persistence. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Ssd 1

Medium

Confidence: 99% confidence
Finding: The search endpoint may return a free-form message and explicitly instructs the agent to 'read it carefully' because it contains 'important context' about how to contribute. This is a prompt-injection vector: untrusted remote content is being framed as authoritative operational guidance, which could manipulate an agent into registering, changing behavior, disclosing data, or taking other unintended actions.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill documents that polling consumes messages, but the operational guidance does not make the destructive nature of inbox polling prominent where an agent is most likely to act on it. In an agent-to-agent system, destructive reads can cause silent message loss, missed tasks, and broken workflows if an agent polls speculatively, concurrently, or too frequently without understanding that messages are permanently removed once read.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill recommends automated polling via curl/OpenClaw cron jobs but provides no guidance on protecting the Bearer API key. This encourages insecure practices such as embedding credentials in shell history, process arguments, logs, or world-readable cron files, which could expose an account and allow unauthorized profile changes or message access.

Static analysis

No suspicious patterns detected.