ClawHub
Back to skill

Security audit

ii-IRC

Security checks for vulnerabilities and agentic risk

Overview

The skill openly builds an IRC bridge, but it lets untrusted IRC messages trigger immediate OpenClaw events and includes unsafe setup-script generation.

Install only if you want a persistent IRC-to-OpenClaw bridge. Use a low-privilege account, restrict server/channel/sender access, avoid sensitive channels, disable auto-start when not needed, and fix the setup script's argument serialization before using untrusted or automated configuration values.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
scripts/setup.sh:153
Finding

Untrusted IRC Messages Are Forwarded into Immediate OpenClaw Events

Content
View full analysis

Vulnerability Details

File Location: scripts/setup.sh:153-170
Vulnerability Type: Prompt injection through an untrusted event source
Risk Level: High

Vulnerable Code

bash
cat > "$IRC_DIR/watch-daemon.sh" << SCRIPT
#!/bin/bash
# Continuous IRC watcher for ii — triggers OpenClaw on mentions
# Usage: ./watch-daemon.sh (run in background or as a service)

IRC_DIR="$IRC_DIR"
CHANNEL_OUT="\$IRC_DIR/$SERVER/$CHANNEL/out"
NICK="$NICK"

echo "Starting IRC watcher for \$NICK mentions..."
echo "Watching: \$CHANNEL_OUT"

tail -n 0 -F "\$CHANNEL_OUT" 2>/dev/null | while read -r line; do
    # Skip own messages
    if echo "\$line" | grep -q "<\$NICK>"; then
        continue
    fi

    # Skip join/part/mode messages about ourselves
    if echo "\$line" | grep -qE "^[0-9]+ -!- \$NICK"; then
        continue
    fi

    # Check for mentions (case insensitive)
    if echo "\$line" | grep -qi "\$NICK"; then
        MSG=\$(echo "\$line" | sed 's/^[0-9]* //')
        echo "[\$(date '+%H:%M:%S')] Mention detected: \$MSG"
        openclaw system event --text "IRC mention: \$MSG" --mode now
    fi
done
SCRIPT

Technical Analysis

The watcher treats any IRC line containing the bot nickname as content suitable for an immediate OpenClaw system event. The IRC sender is not authenticated or allowlisted, and the message is not passed through a trust-boundary parser that distinguishes untrusted conversation data from instructions.

Shell quoting around "$MSG" prevents ordinary shell metacharacters in the IRC message from being evaluated directly by the shell. It does not, however, prevent semantic prompt injection after the text reaches the AI agent. An IRC participant can submit text that asks the agent to ignore prior rules, disclose information, invoke tools, alter files, or send additional messages.

The eventual result depends on the permissions and safety contr ...[truncated 1335 chars]

Remediation
View remediation

Remediation Suggestions

  • Treat all IRC content as untrusted data and place it in an explicitly delimited data field rather than an instruction-bearing event.
  • Route IRC events to a dedicated, least-privileged agent that cannot access secrets, execute arbitrary shell commands, or modify sensitive files.
  • Enforce server, channel, account, and sender allowlists. Prefer authenticated IRC accounts rather than nickname-only identity checks.
  • Require explicit human approval before an IRC-triggered workflow uses sensitive tools or performs state-changing actions.
  • Apply input length limits, rate limits, and structured parsing before event creation.
  • Add a fixed security instruction stating that quoted IRC content is untrusted and must never override system or operator instructions.
  • Preserve sender identity separately from message content so authorization decisions can be made before agent activation.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/setup.sh:24
Finding

Setup Arguments Are Embedded Unsafely into Generated Shell Scripts

Content
View full analysis

Vulnerability Details

File Location: scripts/setup.sh:24-29, 55-67
Vulnerability Type: Generated shell-script injection
Risk Level: High

Vulnerable Code

bash
while [[ $# -gt 0 ]]; do
    case "$1" in
        --server)  SERVER="$2"; shift 2 ;;
        --port)    PORT="$2"; shift 2 ;;
        --nick)    NICK="$2"; shift 2 ;;
        --channel) CHANNEL="$2"; shift 2 ;;
        --dir)     IRC_DIR="$2"; shift 2 ;;
        -h|--help) usage ;;
        *) echo "Unknown option: $1"; usage ;;
    esac
done
bash
# --- irc.sh ---
cat > "$IRC_DIR/irc.sh" << SCRIPT
#!/bin/bash
# IRC manager — controls ii and the mention watcher
# Usage: ./irc.sh [start|stop|status|restart|send MESSAGE]

IRC_DIR="$IRC_DIR"
SERVER="$SERVER"
PORT="$PORT"
NICK="$NICK"
CHANNEL="$CHANNEL"
CHANNEL_IN="\$IRC_DIR/\$SERVER/\$CHANNEL/in"

The same unsafe interpolation pattern is also used when generating watch-daemon.sh beginning at line 153.

Technical Analysis

Values supplied through command-line arguments are accepted without syntactic validation and interpolated into an unquoted heredoc that generates executable shell source. Placing a value inside visible double quotes in the generated text is not sufficient shell-source serialization.

An input containing a double quote, command substitution, backticks, a newline, or additional shell syntax can break out of the intended variable assignment. The malicious syntax is then stored in irc.sh or watch-daemon.sh. It executes later when the generated script is launched.

This is a stored code-injection issue rather than direct evaluation during argument parsing. Exploitation requires control over setup arguments or an automated configuration source and subsequent execution of the generated script.

Attack Path

  1. An attacker influences a setup argument such as --server, --nick, --channel, or --dir.
  2. The attack ...[truncated 984 chars]
Remediation
View remediation

Remediation Suggestions

  • Validate every setup argument using strict allowlists before creating any files:

    • Restrict SERVER to valid hostname or IP-address syntax.
    • Require PORT to contain only digits and verify that it is in the range 1–65535.
    • Restrict NICK and CHANNEL to the character sets allowed by the relevant IRC protocol and server policy.
    • Canonicalize IRC_DIR and reject unexpected control characters and newlines.

  • Serialize values safely when generating shell code, for example with printf '%q':

    bash
    {
    printf '#!/bin/bash\n'
    printf 'IRC_DIR=%q\n' "$IRC_DIR"
    printf 'SERVER=%q\n' "$SERVER"
    printf 'PORT=%q\n' "$PORT"
    printf 'NICK=%q\n' "$NICK"
    printf 'CHANNEL=%q\n' "$CHANNEL"
} > "$IRC_DIR/irc.sh"

  • Prefer storing configuration in a non-executable data file with a parser that does not evaluate shell syntax.

  • Use a single-quoted heredoc for static script content and pass configuration through a safely generated configuration file.

  • Create files with restrictive permissions, such as umask 077, and write to a temporary file followed by an atomic rename.

  • Add tests containing quotes, dollar signs, backticks, newlines, glob characters, and command substitutions to confirm that input remains inert.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/setup.sh:94
Finding

Broad Pattern-Based Process Termination Can Kill Unrelated Processes

Content
View full analysis

Vulnerability Details

File Location: scripts/setup.sh:94-100
Vulnerability Type: Unsafe process identification and termination
Risk Level: Medium

Vulnerable Code

bash
    stop)
        echo "Stopping watcher..."
        pkill -f "watch-daemon.sh" 2>/dev/null
        echo "Stopping ii..."
        pkill -f "ii -s \$SERVER" 2>/dev/null
        echo "Stopped"
        ;;

Technical Analysis

pkill -f matches a regular expression against the complete command line of every process visible and signalable by the invoking account. The watcher pattern is not tied to the generated script's exact path, process ID, or IRC instance. Consequently, stopping this Skill can terminate unrelated processes whose command lines happen to contain watch-daemon.sh.

The ii pattern includes the configured server value and is likewise not associated with a process specifically created by this manager. In addition, the server value is interpreted as part of a regular expression, so regex metacharacters can broaden the match. This compounds the unsafe argument-handling issue when configuration is untrusted.

Attack Path

  1. Another watcher or ii process runs under the same user with a matching command-line substring.
  2. The user invokes irc.sh stop or irc.sh restart.
  3. pkill -f searches the user's processes using the broad patterns.
  4. Every signalable matching process is terminated, including processes not created by this Skill.
  5. If restart was requested, only this Skill's configured instance is subsequently restarted; unrelated terminated services remain unavailable.

An attacker who can influence SERVER may also supply regular-expression syntax that causes the generated ii termination pattern to match a wider set of command lines.

Impact Assessment

The issue can cause denial of service against unrelated watcher or IRC processes running under the same account. It does not ...[truncated 250 chars]

Remediation
View remediation

Remediation Suggestions

  • Capture the exact process IDs when starting ii and the watcher, and store them in separate permission-restricted PID files.
  • Before signaling a stored PID, verify that the process is owned by the current user and that /proc/$pid/exe and its arguments match the expected executable and configuration.
  • Use kill -- "$pid" only after validation instead of command-line substring matching.
  • Remove stale PID files safely after checking whether their associated processes still exist.
  • If process discovery remains necessary, use exact argument matching without regular expressions and escape all configuration-derived values.
  • Prefer systemd user services and stop the exact named service units with systemctl --user stop, avoiding global command-line searches.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (12)

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: ii-irc
description: Persistent IRC presence using ii (minimalist file-based IRC client) with event-driven mention detection. Use when setting up an AI agent on IRC, monitoring IRC channels, sending IRC messages, or integrating OpenClaw with IRC via ii. Covers ii setup, mention watcher, systemd services, and message sending/reading.
metadata: {"openclaw":{"os":["linux"],"requires":{"bins":["ii"]},"install":[{"id":"pacman","kind":"shell","command":"sudo pacman -S ii","bins":["ii"],"label":"Install ii via pacman (Arch)"},{"id":"apt","kind":"apt","packages":["ii"],"bins":["ii"],"label":"Install ii via apt (Debian/Ubuntu)"},{"id":"source","kind":"shell","command":"git clone https://git.suckless.org/ii && cd ii && make && sudo make install","bins":["ii"],"label":"Build ii from source"}]}}
---

# ii-IRC: Event-Driven IRC for AI Agents

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill exposes shell-capable behavior through installation and setup commands but does not declare an explicit tool scope or allowed-tools boundary. That omission weakens guardrails for agents consuming the skill, increasing the chance they execute shell actions that the skill author did not formally constrain.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: ii-irc
description: Persistent IRC presence using ii (minimalist file-based IRC client) with event-driven mention detection. Use when setting up an AI agent on IRC, monitoring IRC channels, sending IRC messages, or integrating OpenClaw with IRC via ii. Covers ii setup, mention watcher, systemd services, and message sending/reading.
metadata: {"openclaw":{"os":["linux"],"requires":{"bins":["ii"]},"install":[{"id":"pacman","kind":"shell","command":"sudo pacman -S ii","bins":["ii"],"label":"Install ii via pacman (Arch)"},{"id":"apt","kind":"apt","packages":["ii"],"bins":["ii"],"label":"Install ii via apt (Debian/Ubuntu)"},{"id":"source","kind":"shell","command":"git clone https://git.suckless.org/ii && cd ii && make && sudo make install","bins":["ii"],"label":"Build ii from source"}]}}
---

# ii-IRC: Event-Driven IRC for AI Agents

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 45)May include surrounding context.

sh
---
name: ii-irc
description: Persistent IRC presence using ii (minimalist file-based IRC client) with event-driven mention detection. Use when setting up an AI agent on IRC, monitoring IRC channels, sending IRC messages, or integrating OpenClaw with IRC via ii. Covers ii setup, mention watcher, systemd services, and message sending/reading.
metadata: {"openclaw":{"os":["linux"],"requires":{"bins":["ii"]},"install":[{"id":"pacman","kind":"shell","command":"sudo pacman -S ii","bins":["ii"],"label":"Install ii via pacman (Arch)"},{"id":"apt","kind":"apt","packages":["ii"],"bins":["ii"],"label":"Install ii via apt (Debian/Ubuntu)"},{"id":"source","kind":"shell","command":"git clone https://git.suckless.org/ii && cd ii && make && sudo make install","bins":["ii"],"label":"Build ii from source"}]}}
---

# ii-IRC: Event-Driven IRC for AI Agents

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup.sh (reported line 46)May include surrounding context.

sh
---
name: ii-irc
description: Persistent IRC presence using ii (minimalist file-based IRC client) with event-driven mention detection. Use when setting up an AI agent on IRC, monitoring IRC channels, sending IRC messages, or integrating OpenClaw with IRC via ii. Covers ii setup, mention watcher, systemd services, and message sending/reading.
metadata: {"openclaw":{"os":["linux"],"requires":{"bins":["ii"]},"install":[{"id":"pacman","kind":"shell","command":"sudo pacman -S ii","bins":["ii"],"label":"Install ii via pacman (Arch)"},{"id":"apt","kind":"apt","packages":["ii"],"bins":["ii"],"label":"Install ii via apt (Debian/Ubuntu)"},{"id":"source","kind":"shell","command":"git clone https://git.suckless.org/ii && cd ii && make && sudo make install","bins":["ii"],"label":"Build ii from source"}]}}
---

# ii-IRC: Event-Driven IRC for AI Agents

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly stores all IRC channel activity in plain append-only files, but it does not warn about retention, local access, or sensitive content exposure. IRC channels may carry credentials, personal data, or private operational details, and persistent plaintext logs increase the blast radius of host compromise or multi-user access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

├── watch-daemon.sh # Mention watcher → openclaw system event └── / └── / ├── in # FIFO - write here to send messages └── out # Append-only log of all channel messages

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The skill instructs users to enable persistent user services that auto-start IRC connectivity and the watcher, creating durable background execution. Persistence is intentional here, but it still expands risk because a misconfigured or compromised watcher can continue relaying channel input and maintaining network presence across sessions.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

Replace SERVER, PORT, NICK, CHANNEL in the service files, then:

systemctl --user daemon-reload systemctl --user enable --now irc-bot.service irc-watcher.service

text

## Sending Messages

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The watcher forwards matched IRC content into OpenClaw system events, effectively relaying external untrusted chat input into another system component without warning or sanitization guidance. This creates a trust-boundary crossing where public channel content may trigger downstream automation, expose private messages to other components, or enable prompt/event injection behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup.sh (reported line 72)May include surrounding context.

sh
start)
        if ! pgrep -f "ii -s \$SERVER" > /dev/null; then
            echo "Starting ii..."
            nohup ii -s "\$SERVER" -p "\$PORT" -n "\$NICK" -i "\$IRC_DIR" > /dev/null 2>&1 &
            sleep 3
            echo "/j \$CHANNEL" > "\$IRC_DIR/\$SERVER/in"
            sleep 1

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup.sh (reported line 83)May include surrounding context.

sh
start)
        if ! pgrep -f "ii -s \$SERVER" > /dev/null; then
            echo "Starting ii..."
            nohup ii -s "\$SERVER" -p "\$PORT" -n "\$NICK" -i "\$IRC_DIR" > /dev/null 2>&1 &
            sleep 3
            echo "/j \$CHANNEL" > "\$IRC_DIR/\$SERVER/in"
            sleep 1

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The generated watcher script forwards IRC message content from a public channel directly into openclaw system event --text ... --mode now whenever the bot nick is mentioned. Even though the argument is shell-quoted and does not appear to be a shell-injection bug, this still creates an untrusted-input-to-agent-action path where any IRC user can trigger downstream agent processing, potentially causing prompt/command injection or unintended automated actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.