ClawHub
Back to skill

Security audit

VAGUS MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill is a phone-control bridge with disclosed useful capabilities, but its documents also encourage broad, persistent phone telemetry collection and install mutable remote code without enough safeguards.

Review before installing. Only use this with a phone you control, enable the minimum VAGUS app permissions needed, avoid the always-running daemon pattern unless you deliberately want continuous monitoring, and do not allow SMS, clipboard writes, URL opening, or calendar creation without direct user intent. Prefer installing from a pinned reviewed release or commit with audited dependencies rather than cloning the latest repository state.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
DAEMON_GUIDE.md:11
Finding

Continuous Collection of Sensitive Phone Telemetry Exceeds Least Privilege

Content
View full analysis
.jsonl` ``` ```markdown | `vagus://inference/attention` | `availability: "available"\|"unavailable"`, `confidence` | Triggers: drop to unavailable with confidence ≥ threshold | | `vagus://sensors/activity` | `activity: "still"\|"walking"\|"running"\|"in_vehicle"` | Triggers: activity label change | | `vagus://sensors/environment` | `context: "indoor"\|"outdoor"\|"vehicle"` | Triggers: context change | | `vagus://sensors/location` | `latitude`, `longitude`, `accuracy_m` | No trigger by default; add your own geofence logic | | `vagus://sensors/motion` | `accel_mag_mean`, `accel_mag_var`, `gyro_mag_var` | Used for anomaly detection (spike in variance) | | `vagus://device/battery` | `level` (0–100), `charging` (bool) | Triggers: level change ≥ `BATTERY_CHANGE_PCT` | | `vagus://device/connectivity` | `type: "wifi"\|"cellular"\|"none"`, `connected` | Triggers: any change in type or connected state | ``` ### Technical Analysis The guide ...[truncated 2800 chars]
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Warning
Location
README.md:18
Finding

Unpinned Remote Repository and Dependency Installation Can Execute Mutable Upstream Code

Content
View full analysis
"Install the VAGUS skill from https://github.com/vagus-mcp/openclaw-skill" ``` ```bash cd ~/.openclaw/skills/vagus/scripts npm install node vagus-connect.js pair node vagus-connect.js status ``` ### Technical Analysis The installation instructions clone the mutable default branch of a remote GitHub repository and then run `npm install`. No reviewed commit, signed release, checksum, integrity manifest, or immutable version is specified. This creates two related supply-chain risks: 1. The effective Skill payload can change after review because a later installation retrieves the repository's current default branch. 2. `npm install` may download dependencies and execute package lifecycle scripts with the privileges of the installing user. The supplied audit artifact contains only Markdown files. The referenced `scripts/package.json`, dependency lockfile, installer, and JavaScript implementation are absent. It is therefore impossible to verify dependency integrity, lifecycle scripts, transitive packages, command execution, session-token handling, or network behavior. Installing into `~/.openclaw/skills/vagus` also makes the downloaded content available to future OpenClaw sessions. This installation location is expected for a persistent Skill, but it increases the impact of retrieving compromised upstream content. ### Attack Path 1. An attacker compromises the upstream reposito ...[truncated 1483 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill description advertises access to sensitive phone telemetry and the ability to affect the device, but it does not front-load a clear warning about privacy implications or externally visible actions. Users or upstream agents may activate it without understanding that it can read location, notifications, and clipboard contents or trigger speech, notifications, SMS, and clipboard writes.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

Delete the session file and re-pair:

bash
rm ~/.openclaw/vagus-session.json

Then ask the user for a new pairing code.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 286)May include surrounding context.

md
2. `cat ~/.openclaw/vagus-session.json` - does session file exist?
3. Ask user: "Is the VAGUS app running? Do you see the persistent notification?"
4. Ask user: "Is your phone connected to the internet?"
5. If nothing works: `rm ~/.openclaw/vagus-session.json` and re-pair with a new code.

Full diagnostics: `{baseDir}/references/troubleshooting.md`

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The guide explicitly recommends an always-running baseline daemon that continuously subscribes to attention, activity, environment, location, motion, battery, and connectivity streams, and then escalates to higher-resolution raw sensor capture. Even though this is operational documentation rather than executable code, it normalizes persistent collection of highly sensitive behavioral and location data without any prominent warning about privacy implications, minimization, consent, retention, or access controls, which creates a substantial surveillance and misuse risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The README instructs users to clone the skill into a persistent user skills directory so it survives updates, which establishes durable agent capability on the host. In this specific skill, persistence is more dangerous than usual because the installed component enables continued access to phone sensors, notifications, clipboard, and device actions after initial setup, increasing the blast radius if the skill is later abused or compromised.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

Or do it manually:

bash
mkdir -p ~/.openclaw/skills
git clone https://github.com/vagus-mcp/openclaw-skill.git ~/.openclaw/skills/vagus
# or copy the vagus-openclaw folder to ~/.openclaw/skills/vagus
cd ~/.openclaw/skills/vagus/scripts

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README explicitly advertises access to highly sensitive phone data and powerful device-affecting actions, including location, notifications, clipboard, SMS, URL opening, and calendar creation, but it does not present a clear privacy and safety warning commensurate with those capabilities. In the context of an agent skill, this is dangerous because users may install or authorize it without understanding that an autonomous agent could surveil them or trigger real-world actions through their phone.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest description advertises generic phone awareness and user reachability, but omits higher-impact capabilities later exposed in the skill such as SMS sending, URL opening, and calendar event creation. This under-describes the skill’s authority, which can mislead routing systems or users into approving a skill without understanding that it can perform externally visible actions on their behalf.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation description is broad enough to match many requests involving awareness, context, or contacting the user, which can cause the skill to be selected in situations where its sensitive permissions are unnecessary. Because this skill can access location, notifications, clipboard, and device-state data, overbroad activation materially increases privacy and action-surface risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

text
Parameters: `title` (string max 200 chars, required), `body` (string max 1000 chars, required)

**`clipboard/set`** - Write to clipboard
```bash
node {baseDir}/scripts/vagus-connect.js call clipboard/set '{"content":"https://example.com"}'

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill exposes an SMS sending primitive, which is a materially higher-risk action than passive phone awareness because it can contact third parties, incur charges, and create social-engineering opportunities. The current stated purpose does not clearly justify this capability or constrain when it should be used, increasing the chance of overbroad or unintended use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

Calendar event creation changes persistent user data and may be used to spam, manipulate schedules, or insert deceptive reminders. Because the manifest positions the skill mainly as phone sensing and communication, this write capability is under-justified and may surprise users or the invoking agent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

Opening URLs on the user's phone is an active device-side effect not clearly disclosed by the manifest description. While lower impact than SMS, it can still be abused for phishing redirection, tracking, or launching unwanted browser activity if the skill is invoked too broadly.

Content

No source excerpt is available for this finding.