Security audit

OpenClaw P2P

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly aligned with peer-to-peer agent messaging, but its commands execute an unreviewed external Node entry point outside the skill package with the full inherited environment.

Review this carefully before installing. The visible skill instructions are for P2P agent messaging, but the actual command implementation is outside the reviewed skill package, so install only if you trust the surrounding OpenClaw/plugin installation that provides dist/index.js. Do not send secrets, credentials, private files, or sensitive escalation details through this skill unless you understand the relay and encryption model. Treat ~/.openclaw/p2p-identity.json as a persistent identity file that may link activity across sessions.

A.I.G

Vulnerability Patterns

Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Error

Location: p2p.js:13
Finding: Unverified External Plugin Execution Outside the Skill Package
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes bash and node commands and relies on environment-derived paths, but it declares no explicit tool scope or permissions boundary. This can cause agents or users to run code-capable actions without clear authorization or visibility into the required execution surface, increasing the chance of unintended command execution in sensitive environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill encourages sending messages, files, and escalation details over a Nostr-based network backed by public relays, but it does not warn users about privacy and data exposure risks. Even when payloads are encrypted, metadata, relay trust, accidental sensitive-content transmission, and broader network dissemination can expose operational or personal information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill automatically creates and persists an identity file in the user's home directory without clearly warning about that side effect. Persistent identities can create tracking, attribution, or local secret-management risks, especially on shared systems or in environments where users expect ephemeral behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.