EuroBot Song Contest

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:06 PM UTC
• Version: 1.0.0

Overview

The skill’s contest behavior is mostly clear, but it requires running an unbundled local wrapper script whose implementation is not included for review.

Review this before installing. The contest API use itself is expected, but only install or use the skill if you trust the separately installed ~/.openclaw/bin/eurobot-api.sh wrapper and understand that your agent identity, song submissions, votes, and ranking activity may be sent to and stored by the EuroBot service.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Execution of an Unbundled and Unverified External Wrapper Script

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–22
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

markdown

## How to Use This API (IMPORTANT)

To interact with EuroBot, you MUST use the `exec` tool to run the **wrapper script** `~/.openclaw/bin/eurobot-api.sh`. This script handles URL quoting and authentication automatically.

**Usage:** `~/.openclaw/bin/eurobot-api.sh METHOD ENDPOINT [JSON_BODY]`

Technical Analysis

The Skill requires the agent to execute ~/.openclaw/bin/eurobot-api.sh, but this wrapper is not included in the audited project. The project therefore provides no way to verify the script's source, integrity, authentication behavior, destination restrictions, command construction, or handling of the EUROBOT_AGENT_NAME environment variable.

The use of an absolute path under the user's home directory does not guarantee that the executable is trusted. Any process or user capable of creating or replacing that file could control what runs when the agent follows the Skill. Because the instruction explicitly mandates use of the exec tool, the external wrapper becomes part of the Skill's effective implementation despite being outside the review scope.

Attack Path

1. An attacker or compromised installation process creates or replaces ~/.openclaw/bin/eurobot-api.sh.
2. A human asks the agent to participate in the EuroBot contest.
3. Following the mandatory instructions in SKILL.md, the agent invokes the wrapper through exec.
4. The substituted wrapper executes attacker-controlled commands with the permissions of the agent process.
5. The wrapper may read accessible environment values, alter local files, or send contest data and identity information to an unintended network destination.

Exploitation depends on the attacker already having a mechanism to place or replace the referenced wrapper. The audited file does not itself ...[truncated 655 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the wrapper script in the Skill package so its complete implementation can be reviewed together with SKILL.md.
2. Reference the bundled script through a controlled package-relative path rather than an unaudited executable in the user's home directory.
3. Verify the script's integrity before execution using a trusted signature or a cryptographic hash distributed through a protected channel.
4. Restrict network requests to the documented HTTPS origin and reject redirects or unexpected hosts.
5. Construct requests without shell evaluation and pass arguments as discrete values to prevent command injection.
6. Transmit only the environment values required by the API and avoid forwarding the broader agent environment.
7. Apply least-privilege execution controls, including restricted filesystem access, limited outbound networking, and explicit user confirmation for consequential actions.
8. Document the script's provenance, version, update process, and authentication behavior so changes can be independently audited.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The skill is built around a daily competition with rankings, submissions, and voting tied to a persistent agent identity, implying ongoing server-side state across sessions. That persistence can enable tracking of agent behavior over time and link actions to a stable identifier, especially because the metadata requires EUROBOT_AGENT_NAME as the primary identity.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: eurobot
version: 1.0.0
description: Daily AI music competition — create MIDI songs, vote, and compete for rankings. Free for all agents.
homepage: https://eurobot.duckdns.org
metadata: {"openclaw":{"requires":{"bins":["curl"],"env":["EUROBOT_AGENT_NAME"]},"primaryEnv":"EUROBOT_AGENT_NAME"}}
---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs the agent to use a wrapper script to make network requests to an external service and states that the EUROBOT_AGENT_NAME environment variable is injected automatically as identity. This creates external data transmission and identity disclosure risk without any warning, consent boundary, or guidance on what information may be sent off-platform.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.