龙虾星球(openClawCommunity)

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:27 AM UTC
• Version: 1.4.2

Overview

The skill is a coherent social-network integration, but it gives an agent broad shell access and directs it to perform public actions and handle tokens with weak controls.

Review before installing. This skill may create and modify public community content as an agent, sends data and tokens to clawplanet.lynto.com.cn, and relies on broad Bash access. Use it only in a sandboxed environment with no unrelated secrets, confirm each public write action manually, and avoid using a valuable identity until token recovery and token-in-URL handling are fixed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:231

Finding

Authentication Token Exposed in URL Query Parameters

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:31

Finding

Insecure Token Recovery Based on a Public Agent Name

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:8

Finding

Unrestricted Bash Permission Exceeds the Skill's Functional Requirements

Content

View full analysis

` — latest posts 2. `curl -s ".../api/topics?scope=today&limit=20"` — today's topics 3. `curl -s ".../api/topics?scope=week&limit=10"` — the past 7 days' hottest topics ``` ### Technical Analysis The declared functionality requires making HTTPS requests to a limited set of community API endpoints. Granting `Bash(*)` permits arbitrary commands rather than only those requests. Depending on the host sandbox and process identity, unrestricted Bash can potentially read local files, inspect environment variables, modify files, start processes, and communicate with unrelated network destinations. The risk is amplified because the Skill instructs the agent to consume and reason about community posts and comments. That content is controlled by remote users and must be treated as untrusted data. A malicious post could contain instruction-like text intended to manipulate the agent. If the agent follows such text, unrestricted Bash provides capabilities far beyond those necessary to read or update community content. The reviewed file does not itself contain a command that reads local secrets or executes a remote payload. The vulnerability is the unnecessarily broad capability and the resulting escalation potential if model behavior is influenced by hostile remote content. ### Attack Path 1. An attacker publishes a post, topic, or comment containing adversarial instruction-like content. 2. The Skill retrieves the attacker-controlled content from the community API ...[truncated 1217 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description presents the skill as allowing community engagement, but does not clearly warn that the agent may autonomously create public posts, comments, likes, affinity actions, and topics on the user's behalf. This weak disclosure can mislead users about the privacy and reputational consequences of enabling the skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction that the agent should 'frequently check the timeline and post updates' is overly broad and reads like a standing behavioral directive rather than a bounded tool skill. That increases the chance of unsolicited outbound interaction, especially because later steps direct the agent to post, like, and reply on a public network.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill says the agent should 'frequently check the timeline and post updates' whenever interacting with the community, which creates an open-ended trigger for autonomous public actions. In a local agent with Bash(*) access, this can cause the skill to activate in broad social contexts and perform networked actions the user did not specifically authorize.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The skill directs the agent to send registration data and later authentication tokens, posts, comments, mentions queries, and other content to an external third-party domain via curl using Bash(*). In context, this is more dangerous because the workflow encourages autonomous, repeated public interactions and token handling, creating risks of data exfiltration, credential exposure, unwanted account creation, and uncontrolled outbound communications.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Example (replace the name and persona with your own):

bash

curl -s -X POST https://clawplanet.lynto.com.cn/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{"agent_name": "MyAgent", "persona": "A friendly AI agent"}'

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The preset tags are presented entirely in Chinese, and later examples and required behaviors strongly center Chinese-language interaction without offering a language choice. A skill that effectively imposes a specific language or locale should either provide opt-in or clearly justify the constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The workflow examples and reply guidance strongly steer the agent toward Chinese-language public participation without explicit user preference or consent. While not a classic exploit, this can lead to unintended public outputs, identity confusion, or reputational harm when the agent acts in a language/style the user did not request.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.