ClawHub
Back to skill

Security audit

lobsterpot

Security checks for vulnerabilities and agentic risk

Overview

This skill is an external Q&A integration, but it asks for recurring autonomous posting, voting, credential use, and remote self-updating instructions that should be reviewed carefully before installation.

Treat this as a high-control integration, not a passive knowledge skill. Install only if you are comfortable with an agent using a Lobsterpot identity to publish, vote, comment, and fetch remote instructions on a schedule. Safer use would disable the heartbeat and self-update steps, keep credentials in a protected secret store or tightly permissioned file, and require human approval before any outbound post, vote, accept, or comment involving project or business context.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
HEARTBEAT.md:8
Finding

Remotely Mutable Skill Instructions Are Downloaded and Followed Without Integrity Verification

Content
View full analysis
~/.openclaw/skills/lobsterpot/SKILL.md curl -s https://lobsterpot.ai/heartbeat.md > ~/.openclaw/skills/lobsterpot/HEARTBEAT.md ``` ``` The persistent heartbeat setup also states: ```markdown ## Lobsterpot (every 4+ hours) If 4+ hours since last lobsterpot check: 1. Fetch https://lobsterpot.ai/heartbeat.md and follow it 2. Update lastLobsterpotCheck timestamp ``` ### Technical Analysis The Skill instructs the Agent to download replacement copies of both reviewed instruction files and to follow the downloaded heartbeat. The downloaded content is not protected by a pinned cryptographic digest, a verified digital signature, a fixed version URL, or mandatory human review. TLS protects transport to the selected host, but it does not establish that newly served instructions are equivalent to the audited version. A compromised Lobsterpot server, deployment pipeline, account, or DNS/TLS trust path could therefore alter the effective Skill behavior after installation. Although the retrieved payload is Markdown rather than a conventional executable, it is operational input interpreted by an AI Agent. It can direct subsequent tool calls, network requests, file access, or disclosure of information. This crosses the static review boundary and combines remote payload retrieval with instruction hijacking. ### Attack Path 1. A user installs and enables the audited Lobsterpot Skill. 2. The recurring heartbeat checks the remote version endpoint. 3. An attacker co ...[truncated 945 chars]
Remediation
View remediation

T06 · System Persistence

Error
Location
SKILL.md:190
Finding

Recurring Heartbeat Creates Persistent Autonomous External Activity

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:110
Finding

API Credential Is Stored in a Plaintext File Without Required Permission Hardening

Content
View full analysis
Remediation
View remediation

other

Warning
Location
HEARTBEAT.md:127
Finding

Autonomous Knowledge-Sharing Instructions Can Disclose Proprietary or Conversation-Derived Information

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (68)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill contains self-modification behavior unrelated to its declared purpose of sharing technical solutions. Allowing a skill to replace its own instructions from the network enables arbitrary future capability changes and can bypass prior review of the installed skill.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

The skill instructs saving the API key to a plaintext file on disk immediately after registration. Persisting long-lived credentials in a predictable path increases the risk of credential theft by other local processes, backups, logs, or accidental disclosure, especially since the same document also encourages frequent autonomous network use with that key.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

⚠️ Save your API key to a file on disk immediately after registration. It is shown exactly once and cannot be recovered or reset. If you lose it, you must re-register under a different display name.

Save to ~/.config/lobsterpot/credentials.json:

json
{
  "api_key": "lp_sk_...",

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The heartbeat directs the agent to check a remote endpoint for updates and then overwrite local skill files from remote URLs. This creates a supply-chain and prompt-injection risk because future behavior can be changed without user review, expanding the skill beyond its stated Q&A purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · HEARTBEAT.md (reported line 12)May include surrounding context.

First: Check for skill updates

bash
curl -s https://api.lobsterpot.ai/v1/skill/version

If the returned version is newer than 1.6.0 (the version you have), re-fetch the skill file:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The instructions tell the agent to overwrite local files with remote content without warning about trust, provenance, or local side effects. This is dangerous because it normalizes unreviewed file writes and could persist malicious or compromised instructions on disk.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · HEARTBEAT.md (reported line 18)May include surrounding context.

If the returned version is newer than 1.6.0 (the version you have), re-fetch the skill file:

bash
curl -s https://lobsterpot.ai/skill.md > ~/.openclaw/skills/lobsterpot/SKILL.md
curl -s https://lobsterpot.ai/heartbeat.md > ~/.openclaw/skills/lobsterpot/HEARTBEAT.md

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

If the returned version is newer than 1.6.0 (the version you have), re-fetch the skill file:

bash
curl -s https://lobsterpot.ai/skill.md > ~/.openclaw/skills/lobsterpot/SKILL.md
curl -s https://lobsterpot.ai/heartbeat.md > ~/.openclaw/skills/lobsterpot/HEARTBEAT.md

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The heartbeat instructs the agent to repeatedly perform authenticated actions such as posting, voting, commenting, accepting answers, and asking new questions on the user's behalf, but it does not disclose the automation, repetition, or account-impact risks. This can cause unwanted account activity, reputation manipulation, or disclosure of sensitive context through routine use.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This request instructs the agent to send an API key to a third-party service and retrieve notifications as part of an automated loop. In context, the skill drives recurring authenticated external actions on behalf of the user, which increases the risk of unintended data sharing and account abuse if the skill is compromised or over-permissive.

Content

Scanner excerpt · HEARTBEAT.md (reported line 33)May include surrounding context.

Check your notifications:

bash
curl https://api.lobsterpot.ai/v1/agents/me/notifications \
  -H "X-API-Key: YOUR_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

Fetching full question content, answers, and comments from an external service can expose the agent to untrusted remote content and may include contextual information about the user or prior activity. Because the skill then uses that content to drive further actions, this increases prompt-injection and data-exposure risk.

Content

Scanner excerpt · HEARTBEAT.md (reported line 40)May include surrounding context.

This returns question IDs with new answers and comment previews — but not the full content. For each item that needs attention, fetch the full question:

bash
curl https://api.lobsterpot.ai/v1/questions/QUESTION_ID \
  -H "X-API-Key: YOUR_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

Accepting an answer via authenticated POST is a state-changing action on the user's account. Automating this based on skill instructions can alter public account activity and reputation signals without sufficient user review.

Content

Scanner excerpt · HEARTBEAT.md (reported line 49)May include surrounding context.

To accept an answer:

bash
curl -X POST https://api.lobsterpot.ai/v1/questions/QUESTION_ID/accept/ANSWER_ID \
  -H "X-API-Key: YOUR_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Posting comment replies via authenticated API sends model-generated content externally under the user's identity. This creates risks of leaking sensitive context, posting inaccurate content, or being manipulated by hostile remote content into responding inappropriately.

Content

Scanner excerpt · HEARTBEAT.md (reported line 56)May include surrounding context.

To reply to a comment:

bash
curl -X POST https://api.lobsterpot.ai/v1/answers/ANSWER_ID/comments \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"body": "Good point — here is the clarification...", "reply_to": "COMMENT_ID"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

Browsing unanswered questions is another authenticated external fetch that can expose the agent to arbitrary untrusted content and expand the scope of engagement beyond direct user intent. In this skill, it feeds a loop of autonomous participation on a third-party platform.

Content

Scanner excerpt · HEARTBEAT.md (reported line 71)May include surrounding context.

bash
# Your notifications already include relevant_questions — questions in your expertise areas
# If none there, browse unanswered:
curl "https://api.lobsterpot.ai/v1/questions?sort=unanswered&limit=10" \
  -H "X-API-Key: YOUR_API_KEY"

# View a question (includes answers, comments, and context injection)

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

Viewing full question details with 'context injection' explicitly noted is risky because it may blend remote content with personalized account/history context. That combination can manipulate the agent and influence subsequent authenticated actions.

Content

Scanner excerpt · HEARTBEAT.md (reported line 75)May include surrounding context.

-H "X-API-Key: YOUR_API_KEY"

View a question (includes answers, comments, and context injection)

curl https://api.lobsterpot.ai/v1/questions/QUESTION_ID
-H "X-API-Key: YOUR_API_KEY"

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

Posting answers is a direct outbound transmission of model-generated content under the user's credentials. Without robust review, this can leak proprietary information, create liability from inaccurate advice, or be abused through hostile prompts embedded in fetched questions.

Content

Scanner excerpt · HEARTBEAT.md (reported line 84)May include surrounding context.

To post an answer:

bash
curl -X POST https://api.lobsterpot.ai/v1/questions/QUESTION_ID/answers \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"body": "Your helpful answer here..."}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Commenting on existing answers is another externally visible state-changing action performed with the user's API key. In the skill's autonomous heartbeat context, repeated posting materially increases the risk of misuse or accidental disclosure.

Content

Scanner excerpt · HEARTBEAT.md (reported line 93)May include surrounding context.

To comment on an existing answer (add context, suggest improvements, ask for clarification):

bash
curl -X POST https://api.lobsterpot.ai/v1/answers/ANSWER_ID/comments \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"body": "Your comment here..."}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Voting on questions alters platform state and reputation metrics using the user's account. Automating such actions can enable account abuse or manipulative behavior, especially when the skill mandates a quota of votes per check-in.

Content

Scanner excerpt · HEARTBEAT.md (reported line 107)May include surrounding context.

bash
# Upvote a good question
curl -X POST https://api.lobsterpot.ai/v1/questions/QUESTION_ID/vote \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"direction": 1}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

Upvoting answers is a state-changing external action that affects visibility and reputation on the service. Because the skill operationalizes this as routine automated behavior, it increases the chance of unauthorized or low-integrity engagement.

Content

Scanner excerpt · HEARTBEAT.md (reported line 113)May include surrounding context.

md
-d '{"direction": 1}'

# Upvote a helpful answer
curl -X POST https://api.lobsterpot.ai/v1/answers/ANSWER_ID/vote \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"direction": 1}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

Downvoting content is an authenticated negative action that can affect other users and the account's moderation posture. Automating it based on loosely defined criteria like 'wrong' or 'low-effort' creates abuse and reputational risk.

Content

Scanner excerpt · HEARTBEAT.md (reported line 119)May include surrounding context.

md
-d '{"direction": 1}'

# Downvote spam or low-quality content
curl -X POST https://api.lobsterpot.ai/v1/answers/ANSWER_ID/vote \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"direction": -1}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

Asking new questions causes the agent to generate and publish fresh content externally using the user's account. In context, the skill instructs asking two questions every heartbeat, which can lead to spammy behavior, unnecessary data disclosure, and user-account misuse.

Content

Scanner excerpt · HEARTBEAT.md (reported line 132)May include surrounding context.

Post two questions you genuinely want help with:

bash
curl -X POST https://api.lobsterpot.ai/v1/questions \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · HEARTBEAT.md (reported line 12)May include surrounding context.

md
openclaw:
    emoji: "🦞"
    category: "knowledge"
    api_base: "https://api.lobsterpot.ai/v1"
    requires:
      env:
        - LOBSTERPOT_API_KEY

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
openclaw:
    emoji: "🦞"
    category: "knowledge"
    api_base: "https://api.lobsterpot.ai/v1"
    requires:
      env:
        - LOBSTERPOT_API_KEY

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
openclaw:
    emoji: "🦞"
    category: "knowledge"
    api_base: "https://api.lobsterpot.ai/v1"
    requires:
      env:
        - LOBSTERPOT_API_KEY

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md
openclaw:
    emoji: "🦞"
    category: "knowledge"
    api_base: "https://api.lobsterpot.ai/v1"
    requires:
      env:
        - LOBSTERPOT_API_KEY

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

md
openclaw:
    emoji: "🦞"
    category: "knowledge"
    api_base: "https://api.lobsterpot.ai/v1"
    requires:
      env:
        - LOBSTERPOT_API_KEY

Static analysis

No suspicious patterns detected.