world2agent

• Outcome: Review
• Latest audit: May 28, 2026 · 10:35 AM UTC
• Version: 0.1.3

Overview

This appears to be a real World2Agent sensor-management skill, but it needs Review because it can make durable host changes, install npm packages, alter OpenClaw hook settings, run a background supervisor, and auto-route notifications.

Install only if you intend to let this skill administer World2Agent/OpenClaw integration on your machine. Review the sensor npm packages and publishers, confirm where notifications will be sent, use limited API keys for sensor credentials, and keep track of how to stop the supervisor, remove sensors, and restore the OpenClaw config backup if you do not want the hook settings.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill clearly instructs the agent to read local files and execute shell scripts, but it declares no permissions or equivalent user-facing capability disclosure. That mismatch can cause users or the hosting platform to underestimate the level of access being exercised, especially because the scripts modify local configuration, install packages, and manage services.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The description frames the skill as simple sensor management, but the documented behavior extends into privileged and security-sensitive operations: editing hook configuration, generating tokens, globally installing software, reading env files, and registering autostart services. This is dangerous because users may invoke it expecting low-risk management actions while it materially changes host security posture and persistence.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The document says the skill never edits OpenClaw or World2Agent config files by hand, yet later bootstrap instructions explicitly mutate ~/.openclaw/openclaw.json. Contradictory operator guidance increases the chance of unsafe execution and misinforms reviewers about whether the skill changes security-relevant configuration.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The uninstall-bootstrap section claims OpenClaw config was never written, but the bootstrap section states that managed fields may be written into ~/.openclaw/openclaw.json. This inconsistency can lead users to believe rollback is complete when security-relevant hook settings may remain enabled after uninstalling persistence.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The library includes functionality to create and modify ~/.openclaw/openclaw.json, enabling hooks, generating or preserving a token, and changing allowed session key prefixes. That exceeds a narrow 'manage sensors via supervisor' scope and alters gateway security-relevant configuration, which can broaden the attack surface or silently weaken user intent if invoked without explicit consent.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The comments state the bridge is read-only with respect to ~/.openclaw/openclaw.json, but later code provides ensure_openclaw_hooks() that mutates that file. This documentation/behavior mismatch is security-relevant because reviewers or users may trust the comment and overlook configuration changes that enable hooks and session-key prefixes.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The bootstrap script performs a host-wide `npm install -g` of an external package if the binaries are missing. That exceeds simple sensor management and introduces supply-chain and host-modification risk, especially because it changes the system state outside the skill's advertised narrow purpose. In this skill context, automatic installation on the host is more dangerous because the skill is supposed to manage sensors, not provision global runtime components.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script modifies OpenClaw gateway hook configuration, including enabling hooks, setting a token, and allowing session-key prefixes, which broadens the system's trust and communication surface beyond merely managing World2Agent sensors. This is security-sensitive configuration drift on a host service, and in the context of a sensor-management skill it is more dangerous because it silently expands privileges and connectivity assumptions at the platform level.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: When no notification target is provided, the script reads ~/.openclaw/.env and automatically selects a HOME_CHANNEL value to route sensor notifications. This creates an undisclosed data-flow from user-local configuration into outbound notification behavior, which can cause sensors to send content to an external messaging destination the user did not explicitly approve for that installation.

Vague Triggers

Medium

• Confidence: 79% confidence
• Finding: The trigger condition is broad enough to match many ordinary requests about notifications, watching sources, or managing feeds. Over-broad invocation is risky here because this skill performs shell-based host modifications and may alter hooks, install packages, or manage services in response to an ambiguously matched request.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill defaults to auto-delivering sensor output to the first paired chat channel discovered from ~/.openclaw/.env, and explicitly instructs not to ask the user unless they raise delivery preferences. This creates a confidentiality and surprise-delivery risk because external-source content may be pushed to a real messaging endpoint without explicit consent at install time.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: This script creates and bootstraps a per-user launchd plist that causes the supervisor to start automatically at login and restart on failure, but it provides no interactive warning, confirmation, or explicit consent mechanism. In a skill whose purpose is to install and manage external-world sensors, silent persistence increases risk because it establishes a long-lived background process that can continue monitoring and posting data after the initial task is forgotten.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The script silently opts users into a notification destination derived from ~/.openclaw/.env whenever notification flags are omitted. Because this skill manages outside-world sensors that may emit ongoing content, the lack of explicit disclosure or confirmation materially increases the risk of unintended exfiltration of monitored data to a private chat account.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This script explicitly forwards raw supervisor log lines to stdout, and the surrounding skill description says the agent will relay that output to the user as-is. Logs commonly contain secrets, internal paths, webhook payloads, tokens, or diagnostic data from external integrations, so exposing them without redaction or an explicit warning can leak sensitive information to any user who invokes the skill.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

`install-sensor.sh` auto-fills `--notify-channel` / `--notify-to` from the
home-channel env vars and the agent reply is pushed to that chat. Only
when no `<PLATFORM>_HOME_CHANNEL` is set does it fall back to
dashboard-only. So **don't ask the user about delivery unless they raise
it** — a paired channel is a strong signal they've already chosen their
preferred inbox.

• Confidence: 88% confidence
• Finding: The instruction to avoid asking the user about delivery settings delegates a consequential decision to the skill based on local environment state. Autonomous routing of sensor outputs to external messaging channels is dangerous because it can disclose monitored content or metadata without the user's informed approval.

Session Persistence

Medium

• Category: Rogue Agent

Content

mkdir -p "$(dirname "$PLIST")" "$(w2a_home)"

cat >"$PLIST" <<EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

• Confidence: 84% confidence
• Finding: At this point the script starts writing a launchd plist that defines a persistent autostart entry. In the context of a sensor-management skill that may monitor outside-world sources and signal hooks, establishing login persistence without explicit warning or consent creates a meaningful user-safety and privacy risk.

Session Persistence

Medium

• Category: Rogue Agent

Content

EOF

launchctl bootout "$(launchd_target)" >/dev/null 2>&1 || true
launchctl bootstrap "gui/$(id -u)" "$PLIST" >/dev/null 2>&1 \
  || out_err "launchctl bootstrap $PLIST failed"
launchctl kickstart -k "$(launchd_target)" >/dev/null 2>&1 || true

• Confidence: 95% confidence
• Finding: This line performs the key persistence action by bootstrapping the launchd job into the user's GUI session, making the supervisor start automatically on login. In this skill context, that means a background service for external sensors/hooks can continue operating long-term, which is risky if the user was not clearly informed or if the monitored sources change over time.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

bash "$SCRIPTS/remove-sensor.sh" "<package>" [--purge]
```

`--purge` additionally `rm -rf`s `~/.openclaw/skills/<skill_id>/` and runs
`npm uninstall` (only when no other runtime still references the package
via a sibling `_<runtime>` block in `~/.world2agent/config.json`).

• Confidence: 86% confidence
• Finding: The documented purge path performs recursive deletion of a skill directory and package uninstall operations. Even though package validation is mentioned and deletion is delegated to a script, destructive filesystem operations are high-risk in a skill that can be broadly triggered and that encourages autonomous management flows; any script-side path handling bug or misbinding of skill_id could cause data loss.

Static analysis

No suspicious patterns detected.