Security audit

Agent Guardian

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real monitoring/status tool, but it installs persistent host-level components and patches message-handling code in ways that can expose the host to unsafe command execution and overbroad control.

Review this carefully before installing. Only use it on a test or dedicated host, do not run the installer as root unless you fully accept the persistent service and cron changes, and avoid applying the QQ bot patch until the shell-based execSync calls, /tmp state files, root systemd unit, installer validation, and uninstall path are fixed.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T06 · System Persistence

Error

Location: scripts/install.sh:70
Finding: Persistent system service and scheduled task run with excessive privileges<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install.sh:70-99` **Vulnerability Type**: System-level persistence and excessive privileges **Risk Level**: High ### Vulnerable Code ```bash CRON_MARKER="# agent-guardian" crontab -l 2>/dev/null | grep -v "$CRON_MARKER" > /tmp/crontab-guardian.tmp || true echo "*/$REPORT_INTERVAL * * * * $SCRIPT_DIR/smart-status-report.sh >> /tmp/status-report.log 2>&1 $CRON_MARKER" >> /tmp/crontab-guardian.tmp crontab /tmp/crontab-guardian.tmp rm -f /tmp/crontab-guardian.tmp if command -v systemctl &>/dev/null && command -v inotifywait &>/dev/null; then cat > /etc/systemd/system/agent-guardian-query.service << EOF [Unit] Description=Agent Guardian Status Query Daemon After=network.target [Service] Type=simple ExecStart=$SCRIPT_DIR/status-query-daemon.sh Restart=always RestartSec=5 User=root [Install] WantedBy=multi-user.target EOF systemctl daemon-reload systemctl enable agent-guardian-query.service 2>/dev/null systemctl restart agent-guardian-query.service fi ``` ### Technical Analysis The installer creates two cross-session persistence mechanisms: 1. A recurring crontab entry that invokes `smart-status-report.sh`. 2. A boot-enabled systemd service configured with `Restart=always`. Scheduling and background monitoring are consistent with the Skill's declared status-reporting functionality. However, running the query daemon explicitly as `root` and installing it as a system-wide service exceed the minimum privileges needed to read Skill-owned state and invoke the OpenClaw command-line client. The service executes its script directly from the Skill installation directory. If that directory or script can later be modified by a less-privileged account, the systemd service turns such write access into persistent root code execution. The installer also provides no corresponding uninstall or rollback procedure. ### Attack Path 1. The installer is executed with sufficient privileges to write und ...[truncated 840 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Run the daemon under a dedicated unprivileged account rather than `User=root`. - Prefer a user-level systemd service and timer under `~/.config/systemd/user`. - Apply systemd hardening such as: - `NoNewPrivileges=true` - `PrivateTmp=true` - `ProtectSystem=strict` - `ProtectHome=true` - `RestrictAddressFamilies=` - Explicit `ReadWritePaths` for the minimum required state directory - Install scripts into a root-owned, non-writable directory if a privileged service is unavoidable. - Require explicit, separate confirmation before creating either persistence mechanism. - Provide an uninstall script that disables and removes the service, reloads systemd, removes the cron entry, and deletes runtime state. - Prefer an OpenClaw-native scheduler or event-driven callback when that can provide the functionality without system-wide persistence. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: references/patches/qqbot.md:18
Finding: Remote command injection through QQ Bot message hooks<![CDATA[ ## Vulnerability Details **File Location**: `references/patches/qqbot.md:18-25, 64-76` and generated equivalents in `scripts/apply-qqbot-patch.sh:30, 66-69` **Vulnerability Type**: OS command injection **Risk Level**: Critical ### Vulnerable Code ```typescript import { execSync } from "child_process"; function filterLanguageMixing(text: string): string { try { const result = execSync( `echo ${JSON.stringify(text)} | python3 /path/to/agent-guardian/scripts/lang-filter.py`, { encoding: "utf-8", timeout: 3000 } ); return result || text; } catch { return text; } } ``` ```typescript const detectedLang = execSync( `python3 /path/to/agent-guardian/scripts/detect-language.py ${JSON.stringify(event.content)}`, { encoding: "utf-8", timeout: 2000 } ).trim(); execSync( `python3 /path/to/agent-guardian/scripts/msg-queue.py add ${JSON.stringify(event.content.slice(0, 50))}`, { timeout: 2000 } ); ``` ### Technical Analysis The recommended hooks pass remotely supplied message content to Node.js `execSync()` using a single command string. String-based `execSync()` invokes a shell. `JSON.stringify()` produces JSON syntax, not shell-safe escaping. For example, command substitution such as `$(command)` remains active inside shell double quotes. A message containing such syntax can therefore cause the shell to execute the embedded command before Python receives the message argument. The same flaw exists in inbound language detection, queue tracking, and outbound language filtering. The three-second timeout does not prevent exploitation because the injected command can execute immediately or launch a background process. ### Attack Path 1. An administrator applies the documented QQ Bot patch or runs `apply-qqbot-patch.sh`. 2. The patched gateway receives a message from a remote bot user. 3. The attacker includes a shell substitution payload in the message, such as a `$(...)` expression. 4. The gateway applies `JSON.stringify()` ...[truncated 731 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Replace every string-based `execSync()` call with `execFileSync()` or `spawnSync()` using an argument array and `shell: false`. - Pass filter input through standard input instead of an `echo` pipeline. For example: ```typescript import { execFileSync } from "child_process"; const result = execFileSync( "python3", ["/path/to/agent-guardian/scripts/lang-filter.py"], { input: text, encoding: "utf-8", timeout: 3000, shell: false } ); const detectedLang = execFileSync( "python3", [ "/path/to/agent-guardian/scripts/detect-language.py", event.content ], { encoding: "utf-8", timeout: 2000, shell: false } ); ``` - Apply the same conversion to all queue and state-management calls. - Do not attempt to repair this with ad hoc quoting or `JSON.stringify()`; no message content should be incorporated into a shell command. - Add regression tests using shell metacharacters, command substitutions, quotes, newlines, backticks, and Unicode input. - Run the gateway under an unprivileged account with restricted filesystem access to limit impact if another injection flaw is discovered. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/install.sh:16
Finding: Installer input can inject cron entries and corrupt configuration<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install.sh:16-28, 41-51, 70-76` **Vulnerability Type**: Cron injection and unsafe configuration generation **Risk Level**: High ### Vulnerable Code ```bash read -p "📡 Channel type (qqbot/telegram/wechat/feishu/discord): " CHANNEL CHANNEL=${CHANNEL:-qqbot} read -p "👤 User ID/target: " TARGET if [ -z "$TARGET" ]; then exit 1 fi read -p "⏰ Status report interval in minutes, default 5: " REPORT_INTERVAL REPORT_INTERVAL=${REPORT_INTERVAL:-5} read -p "🐕 Watchdog interval in minutes, default 3: " WATCHDOG_INTERVAL WATCHDOG_INTERVAL=${WATCHDOG_INTERVAL:-3} ``` ```bash cat > /tmp/agent-guardian-config.json << EOF { "channel": "$CHANNEL", "target": "$TARGET", "report_interval": $REPORT_INTERVAL, "watchdog_interval": $WATCHDOG_INTERVAL, "installed_at": "$(date -Iseconds)", "skill_dir": "$SKILL_DIR" } EOF ``` ```bash CRON_MARKER="# agent-guardian" crontab -l 2>/dev/null | grep -v "$CRON_MARKER" > /tmp/crontab-guardian.tmp || true echo "*/$REPORT_INTERVAL * * * * $SCRIPT_DIR/smart-status-report.sh >> /tmp/status-report.log 2>&1 $CRON_MARKER" >> /tmp/crontab-guardian.tmp crontab /tmp/crontab-guardian.tmp ``` ### Technical Analysis The installer accepts channel, target, and interval values without format validation. It interpolates them directly into both JSON and a crontab file. A report interval containing newline characters can terminate the intended cron line and add an additional scheduled command. The resulting file is then activated by `crontab`. If installation is performed as root, the injected cron command also runs as root. Similarly, quotes, backslashes, or newlines in `CHANNEL` or `TARGET` can produce malformed or attacker-modified JSON because the script does not use a JSON encoder. `WATCHDOG_INTERVAL` and `REPORT_INTERVAL` are inserted as unquoted JSON values, allowing structural modification of the generated object. ### Attack Path 1. The installer is invoked interact ...[truncated 834 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Require intervals to be decimal integers within a strict operational range: ```bash case "$REPORT_INTERVAL" in ''|*[!0-9]*) echo "Invalid report interval"; exit 1 ;; esac if [ "$REPORT_INTERVAL" -lt 1 ] || [ "$REPORT_INTERVAL" -gt 59 ]; then echo "Report interval must be between 1 and 59" exit 1 fi ``` - Apply equivalent validation to `WATCHDOG_INTERVAL`. - Validate `CHANNEL` against an explicit allowlist. - Reject control characters in targets and apply channel-specific target validation. - Generate JSON with a real serializer, such as Python's `json.dump()` or `jq --arg`, rather than a shell heredoc. - Generate the cron expression only from validated numeric data. - Prefer a systemd timer with validated configuration or an OpenClaw-native scheduler instead of assembling raw crontab text. - Treat installer input as untrusted even when installation is normally interactive, because deployment wrappers and automation may supply it. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/update-work-state.sh:8
Finding: Task descriptions are interpolated into executable Python source<![CDATA[ ## Vulnerability Details **File Location**: `scripts/update-work-state.sh:8-45` **Vulnerability Type**: Python code injection **Risk Level**: High ### Vulnerable Code ```bash STATUS="${1:-idle}" TASK="${2:-none}" IS_ERROR="${3:-}" python3 -c " import json, os state_file = '$STATE_FILE' if os.path.exists(state_file): with open(state_file, 'r') as f: d = json.load(f) else: d = { 'current_task': None, 'status': 'idle', 'started_at': 0, 'last_update': 0, 'update_count': 0, 'last_status_values': [], 'error_count': 0, 'last_report_at': 0 } d['status'] = '$STATUS' d['current_task'] = '$TASK' if '$TASK' != 'none' else d.get('current_task') d['last_update'] = $NOW d['update_count'] = d.get('update_count', 0) + 1 vals = d.get('last_status_values', []) vals.append('$STATUS') d['last_status_values'] = vals[-10:] if '$IS_ERROR': d['error_count'] = d.get('error_count', 0) + 1 elif '$STATUS' in ('done', 'idle'): d['error_count'] = 0 with open(state_file, 'w') as f: json.dump(d, f, indent=2) " ``` ### Technical Analysis Shell arguments are substituted directly into the source text passed to `python3 -c`. The surrounding single quotes are part of the generated Python source; they do not securely encode the values. A task or status value containing a quote can terminate the intended Python string and append additional Python statements. Those statements can import modules, execute operating-system commands, read files, or modify the Agent's state. The Skill documentation instructs the Agent to provide a task description when calling this script. If that description includes user-controlled content, the vulnerability crosses from message processing into local code execution. ### Attack Path 1. A user supplies content that is incorporated into a task description. 2. The Agent or another integration invokes `update-work-state.sh working "<task description>"`. 3. The shell expands `$TASK` inside t ...[truncated 604 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Never interpolate shell variables into source code passed to `python3 -c`. - Pass values as normal command-line arguments and read them through `sys.argv`. - Validate `STATUS` against the exact allowlist `idle`, `working`, `done`, and `error`. - Prefer moving the state-update implementation into a standalone Python script. For example: ```bash case "$STATUS" in idle|working|done|error) ;; *) echo "Invalid status" >&2; exit 1 ;; esac python3 "$SCRIPT_DIR/update-work-state.py" \ "$STATUS" "$TASK" "$IS_ERROR" "$NOW" ``` The Python script should then use: ```python status, task, is_error, now = sys.argv[1:5] ``` - Write the JSON atomically to a temporary file in a protected state directory and replace the destination only after serialization succeeds. - Add tests with quotes, backslashes, newlines, semicolons, and Python expressions in task descriptions. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/status-query-daemon.sh:11
Finding: Privileged daemon trusts predictable files in shared temporary storage<![CDATA[ ## Vulnerability Details **File Location**: `scripts/status-query-daemon.sh:11-14, 48-68`; related temporary-file use at `scripts/install.sh:73-77` **Vulnerability Type**: Unsafe temporary files and untrusted local IPC **Risk Level**: High ### Vulnerable Code ```bash TRIGGER_FILE="/tmp/status-query-trigger" LOG_FILE="/tmp/status-query-daemon.log" CONFIG_FILE="/tmp/agent-guardian-config.json" echo $$ > /tmp/status-query-daemon.pid ``` ```bash log "Daemon started (PID $$)" touch "$TRIGGER_FILE" while true; do inotifywait -q -e modify "$TRIGGER_FILE" 2>/dev/null if [ -f "$TRIGGER_FILE" ]; then TARGET=$(python3 -c " import json with open('$TRIGGER_FILE') as f: d = json.load(f) print(d.get('from', '')) " 2>/dev/null) if [ -n "$TARGET" ]; then log "Trigger from $TARGET" send_status "$TARGET" fi fi done ``` The installer also uses a predictable shared temporary path: ```bash crontab -l 2>/dev/null | grep -v "$CRON_MARKER" > /tmp/crontab-guardian.tmp || true echo "*/$REPORT_INTERVAL * * * * $SCRIPT_DIR/smart-status-report.sh >> /tmp/status-report.log 2>&1 $CRON_MARKER" >> /tmp/crontab-guardian.tmp crontab /tmp/crontab-guardian.tmp rm -f /tmp/crontab-guardian.tmp ``` ### Technical Analysis The systemd unit runs `status-query-daemon.sh` as root, but the daemon exchanges commands through a predictable file in world-shared `/tmp`. It does not verify the file's owner, mode, type, or origin, and it accepts the `from` field as an outbound message target without confirming that the value matches an authorized identity. A local attacker can pre-create the trigger path before the service starts, retain write access to it, and then supply arbitrary trigger JSON. Symbolic-link and replacement races are also possible because path validation and atomic file creation are absent. The installer independently redirects privileged output into the predictable `/tmp/crontab-guardian.tmp` path. If an attacke ...[truncated 1369 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Do not use shared `/tmp` paths for privileged state or inter-process commands. - Create a dedicated runtime directory such as `/run/agent-guardian` with ownership assigned to the dedicated service account and mode `0700`. - Create files atomically and reject symbolic links. - Verify trigger-file ownership, regular-file status, and restrictive permissions before reading it. - Authenticate trigger requests or use a protected Unix-domain socket with filesystem permissions. - Ignore the trigger-provided target and send only to a configured, validated target, or verify that the target is authorized for the configured channel. - Apply restrictive `umask`, such as `umask 077`, before creating state and log files. - Use `mktemp` for the installer: ```bash tmp_crontab=$(mktemp) trap 'rm -f "$tmp_crontab"' EXIT ``` - Ensure the temporary file is owned by the current account, opened without following symbolic links, and not accessible to other users. - Run the daemon as an unprivileged dedicated account so that local IPC weaknesses cannot expose root privileges. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (43)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The described installation model includes crontab changes, systemd service creation, package installation, writes under /etc/systemd/system, and persistent background execution, yet those system-level effects are not transparently surfaced in the declared behavior. Hidden persistence and privileged modification materially increase risk because they can survive restarts and alter host behavior outside normal skill boundaries.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The described installation model includes crontab changes, systemd service creation, package installation, writes under /etc/systemd/system, and persistent background execution, yet those system-level effects are not transparently surfaced in the declared behavior. Hidden persistence and privileged modification materially increase risk because they can survive restarts and alter host behavior outside normal skill boundaries.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The described installation model includes crontab changes, systemd service creation, package installation, writes under /etc/systemd/system, and persistent background execution, yet those system-level effects are not transparently surfaced in the declared behavior. Hidden persistence and privileged modification materially increase risk because they can survive restarts and alter host behavior outside normal skill boundaries.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The described installation model includes crontab changes, systemd service creation, package installation, writes under /etc/systemd/system, and persistent background execution, yet those system-level effects are not transparently surfaced in the declared behavior. Hidden persistence and privileged modification materially increase risk because they can survive restarts and alter host behavior outside normal skill boundaries.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The described installation model includes crontab changes, systemd service creation, package installation, writes under /etc/systemd/system, and persistent background execution, yet those system-level effects are not transparently surfaced in the declared behavior. Hidden persistence and privileged modification materially increase risk because they can survive restarts and alter host behavior outside normal skill boundaries.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The described installation model includes crontab changes, systemd service creation, package installation, writes under /etc/systemd/system, and persistent background execution, yet those system-level effects are not transparently surfaced in the declared behavior. Hidden persistence and privileged modification materially increase risk because they can survive restarts and alter host behavior outside normal skill boundaries.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The patch injects shell-based subprocess execution into message handling for routine text filtering. It builds shell commands with message-derived content and invokes external interpreters/scripts, unnecessarily expanding the attack surface to command injection, interpreter abuse, and denial-of-service risks in a channel integration that should not require shelling out.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The patch allows inbound chat content matching /new or /reset to trigger execution of a local shell script. That creates a conversation-driven command path from untrusted user input to host-side state-changing code, enabling abuse, repeated resets, and possible privilege or availability impacts depending on what the script does.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The patch injects execSync-based shell and Python execution directly into the QQ bot plugin, causing inbound and outbound message handling to spawn subprocesses on user-controlled content paths. This materially expands the bot's attack surface, creates command-execution and reliability risks, and modifies a third-party plugin in ways not justified by a simple guardian/status feature set.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The injected checkAndResetWorkState function lets message content trigger execution of a local reset script, effectively granting chat-driven operational control over bot state. Even if intended as convenience, binding administrative reset behavior to user input is dangerous because it can be abused to disrupt service or alter state unexpectedly.

Tool Parameter Abuse

High

Category: Tool Misuse
Content: # 添加新条目 echo "*/$REPORT_INTERVAL * * * * $SCRIPT_DIR/smart-status-report.sh >> /tmp/status-report.log 2>&1 $CRON_MARKER" >> /tmp/crontab-guardian.tmp crontab /tmp/crontab-guardian.tmp rm -f /tmp/crontab-guardian.tmp echo "✅ 系统 crontab 配置完成（每${REPORT_INTERVAL}分钟汇报）" # ===== 6. 配置 systemd 守护进程（即时状态查询） =====
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill documentation clearly instructs execution of shell scripts, cron jobs, plugin patching, and filesystem interaction, but it declares no tool scope or permissions. This creates an authorization gap where a reviewer or runtime may underestimate the skill's capabilities, increasing the chance of unintended file modification or command execution when the skill is enabled.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The skill is triggered by broad complaint-like phrases such as users saying they waited too long or do not know what the agent is doing. Loose activation criteria can cause the skill to run during ordinary conversation, unexpectedly invoking shell-backed monitoring or state-changing workflows without clear user intent.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The skill enforces Chinese-language consistency and outbound filtering without documented user choice, opt-in, or exception handling. Automatic rewriting of user-visible messages can distort meaning, suppress legitimate mixed-language content, and create integrity risks in technical or multilingual contexts.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: The manifest advertises a 'language consistency filter' without any indication of user preference, consent, or opt-in. In an agent skill, forced language normalization can override user intent, alter meaning, or suppress multilingual communication, creating integrity and usability risks that may affect accessibility or cause the assistant to mis-handle user requests.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The document instructs integrators to persist user activity timestamps and inferred message language into predictable /tmp files, but provides no notice, retention limits, access controls, or isolation guidance. On multi-user systems, /tmp is typically shared and prone to unintended disclosure, tampering, or symlink abuse if files are not created safely, making this a real privacy and integrity risk.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The document specifies a language filter that replaces English mixing in Chinese context and warns on fully English replies to Chinese users. This is a natural-language locale constraint, but the file does not indicate user opt-in, configurable language preference, or a documented region-specific justification.

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The document instructs operators to patch external gateway source files and write state into host filesystem locations such as /tmp. In context this is not direct exploit code by itself, but it broadens the skill's scope from UX monitoring into invasive host modification, increasing persistence, coupling, and the chance of insecure deployment patterns.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The patch introduces hidden side effects—subprocess launches, script execution, and filesystem writes—during normal message processing without user or operator-facing warnings in the guide. This lack of transparency increases deployment risk because maintainers may apply the patch without understanding the new trust boundaries and host-level behaviors it adds.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The document introduces a 'language consistency filter' and outbound language checks that alter or constrain replies based on detected user language. This is a natural-language policy concern because it imposes a language/locale behavior without any indication of user preference, opt-in, or justified region-specific requirement.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The document records language metadata, queue data, and activity/status artifacts derived from user messages into predictable local files but omits privacy and retention guidance. Even if the stored content is partial or indirect, it can leak behavioral and message-derived data to other local processes or persist longer than intended.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The manifest presents a general cross-channel guardian skill, but this script directly modifies and recompiles a specific QQ bot plugin under /root. That mismatch is security-relevant because it hides invasive platform-specific source patching behind a much broader and less alarming description, reducing operator awareness of the actual trust impact.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The script silently edits gateway.ts and outbound.ts, inserts new runtime behavior, and instructs recompilation, all without interactive confirmation or a clear warning about the security and operational consequences. This is dangerous because operators may unknowingly deploy invasive code changes that affect message handling, subprocess execution, and local state management.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The injected behavior processes message content, launches subprocesses, writes tracking files, and alters outbound text, yet the script does not clearly disclose these actions to the installer. Hidden message processing and command execution are especially risky in a messaging bot because they affect untrusted inputs at runtime and may expose user data or destabilize service.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The injected code writes user activity timestamps, language metadata, and status-trigger artifacts into /tmp without disclosure or clear lifecycle controls. This creates unintended persistence of user-derived data, can leak operational state to other local processes, and introduces tampering opportunities if other components trust those files.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/apply-qqbot-patch.sh:30