mumo

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:00 AM UTC
• Version: 0.6.2

Overview

This skill is a disclosed multi-model review tool, but it can send full sensitive designs to external model services and exposes a public session-sharing capability without strong built-in safeguards.

Install only if you are comfortable sending review prompts and included specs to mumo and potentially multiple external model providers. Before using it on auth flows, tokens, payment systems, customer data, or unreleased security findings, require the agent to minimize excerpts, redact secrets, and ask before transmitting or sharing sessions publicly.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: playbooks/design-review.md:7

Finding

Unrestricted Transmission of Sensitive Technical Material to External Model Providers

Content

View full analysis

Remediation

View remediation

` - `` - `` - `` 5. Clearly disclose that prompts are transmitted to mumo and may be processed by multiple external model providers. 6. Provide a local-only fallback when approval is absent or the material cannot be safely minimized. 7. Document expected remote retention, deletion, provider routing, and data-use policies so users can make an informed decision. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: CHANGELOG.md:19

Finding

Public Session-Sharing Tool Exposed Without Least-Privilege Restrictions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (8)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 23)May include surrounding context.

OpenClaw stores outbound MCP servers in ~/.openclaw/openclaw.json under mcp.servers.<name>. Put your key in ~/.openclaw/.env first, so it never lands in the config file. Create that file and restrict it before putting anything in it, so the key is never written into a world-readable file:

bash

touch ~/.openclaw/.env && chmod 600 ~/.openclaw/.env

Then open ~/.openclaw/.env in your editor and add a line:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · CHANGELOG.md (reported line 9)May include surrounding context.

md

Also corrects the skill install location: `openclaw skills install mumo` installs into the active workspace's `skills/` directory (`--agent <id>` targets another), not `~/.openclaw/skills/mumo/`. The git-clone path is what puts it at a fixed location.

The `.env` step creates and `chmod 600`s the file before the key goes in, and tells you to edit it rather than append from the shell — a command carrying the literal key lands in shell history, and a second run stacks a duplicate entry. New step 5 verifies the connection with a real, free `mumo__list_models` call through the agent before the first deliberation — `openclaw mcp list` and `mcp show` only report saved config and never open a connection.

## 0.6.1 — 2026-09-08

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CHANGELOG.md (reported line 29)May include surrounding context.

md

- New "Reactions are in the ledger, responses are on the record" section: participants never see each other's reactions — each model weaves its own prior reactions into its next response, and the claim map is the moderator's privileged preview. Moderator snippets are the one path that puts ledger content directly in front of the panel.
- Pacing note in "When to continue": positions develop across rounds — a reaction gets woven into the next round's prose, which draws reactions of its own a round later.
- Takeaway: `takeaway: true` (create + append) generates `round_takeaway` (`bottom_line` + `items[]`), the per-round summary. New `references/takeaway.md` (replaces `references/recap.md`).

## 0.4.0 — 2026-06-19

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file states that the skill dropped the "contested" gate and now leads with broad pre-implementation review scenarios, including expansive areas like auth, security, tokens, payments, data exposure, or migrations. Because it describes trigger behavior in broad terms without explicit exclusions or negative examples, it risks unintended invocation in common review contexts.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 7)May include surrounding context.

md

## What's in the box

- **`SKILL.md`** — the canonical skill teaching OpenClaw how to use mumo: when to invoke, the deliberation loop (create → wait → read → snippet → append/stop), how to read claim maps, snippet doctrine, and when to verify session creation.
- **`playbooks/`** — four cognitive-shape playbooks loaded on demand: `contested-decision`, `design-review`, `uncertainty-expansion`, `red-team`.
- **`references/`** — five reference docs: `claim-maps`, `snippets`, `model-selection`, `synthesis`, `operating-notes`.
- **`config/mumo.example.json`** — the MCP server config payload to paste into `openclaw mcp set mumo` (reference only; OpenClaw does not auto-load this file).

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · README.md (reported line 20)May include surrounding context.

2. Register the mumo MCP server

OpenClaw stores outbound MCP servers in ~/.openclaw/openclaw.json under mcp.servers.<name>. Put your key in ~/.openclaw/.env first, so it never lands in the config file. Create that file and restrict it before putting anything in it, so the key is never written into a world-readable file:

bash

touch ~/.openclaw/.env && chmod 600 ~/.openclaw/.env

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 23)May include surrounding context.

OpenClaw stores outbound MCP servers in ~/.openclaw/openclaw.json under mcp.servers.<name>. Put your key in ~/.openclaw/.env first, so it never lands in the config file. Create that file and restrict it before putting anything in it, so the key is never written into a world-readable file:

bash

touch ~/.openclaw/.env && chmod 600 ~/.openclaw/.env

Then open ~/.openclaw/.env in your editor and add a line:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md

## User preferences

These are defaults. If the user prefers more autonomy (e.g., "don't ask before appending" or "always include a GPT and a Gemini model"), follow their preferences over this guidance.

## Basic loop

Static analysis

No suspicious patterns detected.