Hippocampus Openclaw Onboarding

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:36 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent onboarding guide, but it asks users to run an unpinned external npm package with a bootstrap credential and local configuration write access.

Review before installing. Use only a verified official package/source, prefer an exact pinned version, avoid putting long-lived tokens in shell history, and confirm the bootstrap token is short-lived, single-use, scoped to the intended workspace, and revocable. After setup, inspect `~/.hipokamp/config.json` and its permissions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:24

Finding

Unpinned Third-Party Package Execution with Bootstrap Credential Access

Content

View full analysis

--gateway ` 5. Let `hipokamp-mcp` write local config under `~/.hipokamp/config.json`. ``` ### Technical Analysis The documented command invokes `hipokamp-mcp` through `npx` without pinning an exact package version or requiring integrity or signature verification. Depending on the local npm configuration and cache, `npx` may retrieve the package from a remote registry and immediately execute its installation or runtime code with the invoking user's privileges. The package receives a sensitive bootstrap token through a command-line argument and is expected to write configuration beneath the user's home directory. Consequently, a compromised, replaced, or incorrectly identified npm package would have both local code-execution capability and direct access to an authentication credential. The package name `hipokamp-mcp` also differs in spelling from the “Hippocampus” product name used throughout the document. The available project material does not establish that this name is malicious or incorrect, but the discrepancy increases package-identity and typo-squatting uncertainty. No malicious behavior in the package itself can be confirmed because its source is not included in the audited project. ### Attack Path 1. An attacker compromises the npm account or release process for `hipokamp-mcp`, or publishes a confusingly named package that users resolve instead of the intended package. 2. The user follows the onboarding instructions and runs the unpinned `npx hipokamp-mcp` command. 3. `npx` retrieves the mutable package version currently selected by the configured registry. 4. npm executes package-controlled installation or runtime code with the permissions of th ...[truncated 951 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

## Preferred Flow

1. Register or sign in through the Hippocampus portal.
2. Create a root OpenClaw agent in the dashboard.
3. Copy the generated bootstrap one-liner.
4. Run:
   `npx hipokamp-mcp setup --bootstrap-token <token> --gateway <gateway-origin>`

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx hipokamp-mcp without pinning an exact package version. This causes execution of whatever version is currently resolved from the registry, creating a supply-chain risk if a future release is compromised, typo-squatted, or behavior changes unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly tells the user to let the tool write configuration into ~/.hipokamp/config.json but does not clearly warn that local files will be modified. While not directly exploitative on its own, silent or under-disclosed disk writes can mislead users and reduce informed consent around persistence of credentials and configuration.

Content

No source excerpt is available for this finding.