Security audit

Brainblast Fleet

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent with its stated fleet-automation purpose, but it installs an optional persistent job that repeatedly downloads and runs mutable remote code without integrity pinning.

Install only if you are comfortable with an unattended operator-level workflow that downloads and executes the current contents of a remote repository. Prefer running it manually in a restricted account or sandbox, avoid providing optional registry tokens unless needed, inspect the remote code before use, and do not install the cron job until the executable revision is pinned or otherwise verified.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/run-fleet.sh:49
Finding: Unpinned Remote Repository Is Retrieved and Executed Without Integrity Verification
Content: View full analysis
/dev/null 2>&1; then log "updating engine repo ($REPO)" git -C "$REPO" pull --ff-only 2>/dev/null || echo " (pull skipped — local changes or offline; using current checkout)" else log "cloning engine repo → $REPO" mkdir -p "$(dirname "$REPO")" git clone --depth 1 "$REMOTE" "$REPO" : > "$REPO/$SENTINEL_REL" fi CORE="$REPO/packages/core" [ -d "$CORE" ] || die "packages/core not found in $REPO — wrong remote?" cd "$CORE" if [ ! -d node_modules ]; then log "installing engine deps (npm ci)" npm ci fi ``` ```bash python3 "$REPO/fleet/scripts/sg_scout.py" "${SEAMS[@]}" log "proving RED→GREEN + promoting (npm run fleet)" npm run fleet log "corpus SLA gate (npm run sla)" npm run sla || die "corpus SLA is RED — refusing to submit. Fix or drop the offending pack." ``` ```bash npm run reprove || echo " (reprove failed — best-effort; the registry reproves on its own schedule)" ``` ### Technical Analysis The script clones or updates a mutable Git repository and then directly executes code obtained from it. No immutable commit, release digest, signed tag, or other integrity policy is enforced. The effective executable payload can therefore change after the Skill package has been audited. The execution surface includes: - Python programs from the downloaded repository. - npm scripts defined by the downloaded repository. - npm dependency installation through `npm ci`. - npm lifecycle hooks that dependencies or the repository may define. - An operator-configurable remote supplied through `BRAINBLAST_REPO_REMOTE`. The advertised proof an ...[truncated 2420 chars]
Remediation: View remediation

T06 · System Persistence

Error

Location: scripts/install-cron.sh:24
Finding: Persistent Operator-Level Scheduled Task Executes the Fleet Unattended
Content: View full analysis
/dev/null || { echo "openclaw not found on PATH" >&2; exit 1; } [ -x "$RUN" ] || chmod +x "$RUN" # Replace any existing job of the same name so re-running is idempotent. openclaw cron remove "$NAME" >/dev/null 2>&1 || true # The schedule is positional (accepts "every 1h", "20m", ISO, or a cron expr). # Only a cron expression (starts with a digit or *) takes a timezone. EXTRA=() case "$SCHED" in \**|[0-9]*\ *) EXTRA=(--tz "$TZ_") ;; esac # Command payload: no --session, no model call — pure deterministic pipeline. # --no-deliver = the "none" delivery mode (stdout still captured in cron history). openclaw cron create "$SCHED" \ --name "$NAME" \ --command "$RUN" \ --timeout-seconds 3600 \ --no-deliver \ "${EXTRA[@]}" ``` ### Technical Analysis The installer creates a persistent OpenClaw cron task that survives the current Skill run and repeatedly executes `run-fleet.sh` for up to one hour per invocation. The persistence is documented and requires the operator to invoke the installer, but it materially increases security exposure because the scheduled command retrieves and executes mutable remote content. The script also removes any existing job with the configured name before creating the new task. It does not verify that the existing job was originally created by this Skill. If `BRAINBLAST_CRON_NAME` collides with another administrative job, that job can be removed. The use of `--no-deliver` suppresses active result delivery. Although output remains available in cron history, failures or unexpected activity may not be brought promptly to the operator's attention. Persistence is part of the declared autonomous functionality, but the implementation does not minimize privilege or duration. It creates an indefinite operator-admin ...[truncated 1735 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly instructs use of shell-capable execution (run-fleet.sh, install-cron.sh, git/node/npm/python3 operations, cron installation, cloning, resetting, and network submission) yet declares no explicit tool scope such as permissions or allowed-tools. That mismatch weakens least-privilege controls and makes it easier for the skill to run with broader executor capabilities than reviewers or operators expect, especially because it is designed for unattended scheduled execution.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.