Security audit

Agent Communication Protocol

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent ACP messaging plugin guide, but it asks users to install mutable remote code, expose a generated credential in chat, and grant broad identity privileges.

Install only if you trust the remote ACP plugin repositories and are comfortable with a network-facing agent identity. Before use, pin and review the plugin version, avoid printing or sharing seedPassword, replace allowFrom ["*"] with trusted AIDs, review any agent.md content before sync, and avoid granting operator admin scopes unless you understand why they are required.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

Location: resources/install.md:36
Finding: Unpinned Third-Party Plugin and Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: resources/install.md:249
Finding: Generated ACP Seed Password Is Disclosed in the Completion Report
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: resources/multi-identity.md:229
Finding: ACP Identity Provisioning Assigns Broad Administrative Operator Scopes
Content: View full analysis
", "label": "", "role": "operator", "scopes": [ "operator.admin", "operator.approvals", "operator.pairing" ], "isDefault": false, "createdAtMs": "", "lastActiveAtMs": "", "channels": ["acp"] } ``` ### Technical Analysis The instructions register each new ACP communication identity as an `operator` and grant administration, approval, and pairing scopes. These privileges are broader than the evident requirements for ACP messaging or displaying an identity in the user interface. The document does not explain why an ACP channel identity needs all three scopes, require explicit owner authorization for the escalation, or provide a reduced-scope alternative. This violates least-privilege principles and increases the consequences of identity compromise, routing mistakes, or incorrect identity-file edits. The exact enforcement behavior depends on the external OpenClaw runtime, which is not included in this documentation-only project. Nevertheless, the configuration explicitly requests privileged scopes and should be treated as an authorization risk. ### Attack Path 1. A new ACP identity is created for messaging or multi-identity routing. 2. The Agent edits the device identity file and assigns the identity the `operator` role. 3. The identity receives `operator.admin`, `operator.approvals`, and `operator.pairing`. 4. An attacker compromises, impersonates, or becomes incorrectly bound to that identity. 5. If the OpenClaw runtime enforces these scopes as documented, the attacker can invoke privileged operator functions beyond ACP messaging. ### Impact Assessment Potentially exposed privileges include admini ...[truncated 496 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.
md
- **[多身份模式](./resources/multi-identity.md)** — 多 Agent 多 AID 架构，agents.list 定义、identity 绑定、人格隔离、workspace 配置、身份创建/删除全流程。

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description is written as an instruction to operate in Chinese and does not indicate that the language is optional or user-selectable. This creates a locale/language policy concern because the skill appears to require a specific language without documented opt-in or justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation states that agent.md is automatically uploaded on ACP connection and then publicly accessible via a URL, but it does not clearly warn users that its contents become public. This creates a real privacy and information disclosure risk because users may include sensitive operational details, identities, capabilities, or personal data in agent.md under the assumption that it is local metadata.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: In workspace mode, the plugin auto-generates agent.md by extracting content from multiple local workspace files and then uploads it, but the documentation does not clearly warn that local files are being transformed into publicly retrievable content. This is more dangerous in context because files like IDENTITY.md, SOUL.md, AGENTS.md, TOOLS.md, HEARTBEAT.md, and skill summaries can contain sensitive internal descriptions, capabilities, operational context, or personal metadata that users would not expect to be published.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation provides a copy-pastable configuration that sets allowFrom: ["*"], which effectively permits messages from any AID, while also showing a seedPassword field without any security warning. In a security-sensitive messaging/channel plugin, this can normalize unsafe defaults and lead users to deploy agents with overly broad access and sensitive credential material in plaintext configuration.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · resources/config-reference.md (reported line 163)May include surrounding context.
md
| `PREFLIGHT_FAIL` + `is used by another user` | AID 被占用 | 更换 `agentName` | | `PREFLIGHT_FAIL` + `signIn` | AID 已存在但密码不匹配 | 使用正确 `seedPassword` 或更换 `agentName` | | `PREFLIGHT_FAIL` + `TIMEOUT` | 网络不可达 | 检查网络/代理 | | `/acp` skill 不可用 | 插件未启用或 skill 未加载 | 检查 `plugins.entries.acp.enabled` 与 `skill/acp/SKILL.md` |

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · resources/install.md (reported line 218)May include surrounding context.
md
| `PREFLIGHT_FAIL` + `is used by another user` | AID 被占用 | 更换 `agentName` | | `PREFLIGHT_FAIL` + `signIn` | AID 已存在但密码不匹配 | 使用正确 `seedPassword` 或更换 `agentName` | | `PREFLIGHT_FAIL` + `TIMEOUT` | 网络不可达 | 检查网络/代理 | | `/acp` skill 不可用 | 插件未启用或 skill 未加载 | 检查 `plugins.entries.acp.enabled` 与 `skill/acp/SKILL.md` |

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The document states that receiving a message from a new AID automatically creates a contact record and initializes a trust-related credit score, and elsewhere it also documents automatic appending of AI-generated summaries into the contact's notes. These are implicit state and data modifications triggered by inbound activity rather than explicit user action, which can create privacy, data integrity, and consent issues—especially if users do not expect unsolicited entities to be persisted or annotated automatically.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation explicitly states that pulled group messages are persisted locally in a JSONL file under the user's home directory, but it does not warn that this stores conversation history on disk where it may be retained indefinitely, backed up, or exposed to other local users/processes depending on host security and file permissions. In a messaging/group-chat skill, silent local persistence increases privacy and confidentiality risk, especially for sensitive agent-to-agent conversations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill documents a dissolve_group operation without indicating that it is destructive or potentially irreversible, which can lead users or calling agents to delete a group unintentionally. In collaborative group chat contexts, dissolving a group can disrupt communications, remove access to shared state, and cause operational or data-loss consequences if users assume it is reversible.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs the agent to back up and then modify ~/.openclaw/openclaw.json and create local files, but it does not clearly warn the user up front that their persistent configuration and filesystem will be changed. This creates a consent and integrity risk: users may unknowingly authorize destructive or hard-to-audit local changes, especially when the same workflow can also restore from backup on validation failure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The install instructions explicitly include the generated seedPassword in the final completion report, causing a sensitive credential to be displayed back to the user and potentially captured in chat history, logs, screenshots, or telemetry. In the context of an ACP identity bootstrap flow, exposing this secret weakens account security and can enable impersonation or unauthorized reuse if the transcript is accessible to others.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: 该 markdown 文件全文仅以中文提供说明，未说明这是特定区域专用文档，也未向用户提供语言或本地化选择。根据规则，若技能在自然语言层面强制特定语言且没有用户选择或明确合理的区域限定，应视为政策风险。
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The documentation shows seedPassword values embedded directly in configuration examples and discusses their use for protecting private keys, but it does not clearly warn that these are sensitive secrets that must not be reused, logged, committed, or shared. In a real deployment, users often copy examples verbatim or store configs insecurely, which can expose key-encryption material and weaken identity protection.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · resources/multi-identity.md (reported line 270)May include surrounding context.
bash
# 方式 A：使用 agents.list[].workspace 配置的自定义路径 WORKSPACE_DIR=~/.openclaw/workspace-funny-bot mkdir -p "$WORKSPACE_DIR" # 方式 B：省略 workspace 配置，核心代码自动分配 # 非默认 Agent 的默认路径为 ~/.openclaw/workspace-{agentId}

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · resources/multi-identity.md (reported line 270)May include surrounding context.
bash
# 方式 A:使用 agents.list[].workspace 配置的自定义路径 WORKSPACE_DIR=~/.openclaw/workspace-funny-bot mkdir -p "$WORKSPACE_DIR" # 方式 B:省略 workspace 配置,核心代码自动分配 # 非默认 Agent 的默认路径为 ~/.openclaw/workspace-{agentId}

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The deletion procedure instructs users to remove agent configuration and workspace directories but lacks a strong warning that these actions may permanently destroy persona, memory, and operational data. Because the instructions are administrative and destructive, omission of backup/recovery guidance creates a real risk of irreversible data loss.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file documents certificate registration and agent.md upload to remote ACP infrastructure without a clear warning that metadata and identity material are being transmitted to external services. This can lead operators to expose sensitive profile or behavioral information unintentionally, especially because agent.md is derived from workspace identity/persona files.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The entire skill document is written in Chinese and provides no indication that alternative languages are supported or that the locale restriction is intentional for a region-specific use case. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: L003 写明“当用户询问 ACP 排名、活跃度分数、Agent 简介、Agent 搜索或 ACP 数据时使用”，其中“Agent 简介”“Agent 搜索”“ACP 数据”范围较宽，缺少明确边界、限定场景或排除条件。对于 markdown 文件，这类宽泛自然语言触发条件容易与普通对话需求重叠，增加非预期调用风险。
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · resources/rank.md (reported line 293)May include surrounding context.
bash
# GET curl -s "https://rank.agentunion.cn/search/text?q=助手&tags=assistant,chat&page=1&page_size=10" # POST curl -s -X POST "https://rank.agentunion.cn/search/text" \ -H "Content-Type: application/json" \

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · resources/rank.md (reported line 332)May include surrounding context.
bash
# GET curl -s "https://rank.agentunion.cn/search/vector?q=我需要写代码的助手&limit=10" # POST curl -s -X POST "https://rank.agentunion.cn/search/vector" \ -H "Content-Type: application/json" \

Static analysis

No suspicious patterns detected.