Security audit

Number Two Migration

Security checks across malware telemetry and agentic risk

Overview

This migration skill is mostly coherent, but it packages plaintext credentials and broad persistent agent-control instructions that users should review before installing.

Install only if you intend to replace or heavily modify your OpenClaw workspace with this specific agent state. Treat all included credentials as exposed: rotate them, remove them from the package, and supply your own secrets through a safer local mechanism. Review the installer and restored AGENTS/HEARTBEAT/SOUL files before use, especially the automatic triggers, memory persistence, skill modification authority, and any external posting or API management behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (55)

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill documentation embeds live-looking API and JWT secrets and states they will be automatically configured during installation. That behavior exceeds a normal migration skill's minimally necessary scope and creates immediate risk of credential theft, unauthorized API use, and account compromise if the skill is shared or installed in an untrusted environment.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The document claims API key setup requires user confirmation, but no concrete confirmation or consent mechanism is described in the installation or recovery flow. In a migration skill that overwrites state and configures external services, this ambiguity makes silent or assumed credential import more likely and undermines informed user consent.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The file sets a privacy boundary but also instructs the agent to read and update persistent memory/identity files each session, creating a policy conflict that can normalize broad access to sensitive user data without fresh consent. In an agent environment with file and messaging access, self-modification plus persistent memory handling can lead to over-collection, retention, or mutation of sensitive context beyond the user's intent.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The file says deletions always require confirmation, but elsewhere grants the agent authority to modify or uninstall skills autonomously. That contradiction weakens safety boundaries around destructive actions and can be exploited or misapplied to justify deleting components without clear user approval.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The instruction 'Do not ask permission; just do it' conflicts with later safety guidance to ask when uncertain. In an agentic system, contradictory authority rules create ambiguity that can push the model toward acting without consent in borderline or risky cases.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The document forbids destructive commands without asking, yet explicitly permits system management actions like cleaning startup items and optimizing configuration, which can be operationally destructive. This mismatch broadens the agent's discretion and increases the chance of harmful system changes without informed consent.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The document combines prompt-injection awareness with broad autonomy to inspect logs, research root causes, attempt fixes, close apps/tabs, and clean files. That mixture is dangerous because a compromised or over-permissive agent can use the 'heartbeat' loop as standing authorization to make unsolicited system changes, increasing the blast radius of any prompt injection or misinterpretation.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The checklist instructs periodic review of emails, calendar, projects, and ideas without a narrowly defined task or consent boundary. This grants broad access to sensitive communications and scheduling data, which can expose private information or enable the agent to act on information the user did not intend to share in this context.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The file authorizes autonomous environment modification, including closing applications, closing browser tabs, and moving screenshots to trash, without a task-specific justification or safety checks. These actions can disrupt user workflows, destroy unsaved work, or delete data under the guise of routine maintenance.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The session-state file explicitly stores highly sensitive secrets, including an admin key and JWT secret, in plaintext. Persisting operational credentials in a broadly readable notes/status document creates immediate risk of unauthorized administrative access, token forgery, lateral movement, and long-term compromise if the file is exposed through the skill, logs, backups, or version control.

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The document notes that /api/* is disallowed in robots.txt and characterizes the API as restricted, yet proceeds with a plan to access and manage the API using obtained authentication material. While robots.txt is not an access-control mechanism by itself, in context this reflects intent to bypass ordinary interface boundaries and use restricted endpoints with stored secrets, which increases the risk of unauthorized or poorly governed admin actions.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The installer embeds real-looking API and JWT secrets directly in the script and writes them into a file under the workspace, while presenting this as merely 'setting environment variables.' This exposes credentials to anyone who can read the script, shell history, backups, workspace files, or source repository, and enables unauthorized access to external services if the secrets are valid.

Intent-Code Divergence

Medium

Confidence: 84% confidence
Finding: The completion banner claims the system and API configuration were successfully restored even though API key setup is optional and verification only checks for file presence, not correctness or successful service configuration. This can mislead operators into believing recovery is complete, causing them to run with broken or partial state and potentially miss security-relevant failures.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The README instructs users to execute a local shell script (`./install.sh`) without explaining what it does, what permissions it needs, or warning that running bundled scripts can modify the host system. In a skill package that claims to migrate a complete agent state, this creates a meaningful risk of arbitrary code execution or unsafe system changes if the package is tampered with or intentionally harmful.

Missing User Warnings

Low

Confidence: 84% confidence
Finding: The README tells users to run `./verify.sh` as a validation step but gives no description of its behavior or scope. Even verification scripts can execute arbitrary commands, collect data, or alter local state, so presenting it as routine without disclosure increases the chance users will run untrusted code blindly.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly says the skill includes API key configuration, but it provides no warning about secret handling, storage, rotation, or exposure risk. Bundling credential material in a transferable skill package can lead to credential leakage, account compromise, and unintended reuse across environments.

Missing User Warnings

High

Confidence: 99% confidence
Finding: Publishing API and JWT secrets directly in skill documentation is a direct credential exposure issue regardless of intent. Anyone who can read the skill can reuse those secrets, and the absence of immediate rotation guidance increases the window for abuse and downstream compromise.

Missing User Warnings

Medium

Confidence: 82% confidence
Finding: The skill advertises full restoration of identity, memory, configuration, project state, and integrated skills at the very start, but the installation directions do not front-load a sufficiently clear disclosure that sensitive personal and operational data will be imported. That weakens informed consent and increases the chance a user installs a package that overwrites or transfers far more data than expected.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The automatic trigger rules are broad and action-oriented, causing skills to activate based on vague conditions like content generation, status changes, or long sessions. This can produce unintended behavior, including unrequested external integrations, state updates, or processing of user data under the wrong skill, especially when multiple integrated skills are available.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The file contains what appears to be a live Moltbook API key and explicitly marks it as important to preserve. Storing plaintext credentials in a memory/config markdown file creates a high risk of accidental disclosure through source control, backups, logs, or later prompt/context exposure to other agents or tools.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The memory file explicitly records that API credentials were obtained, naming sensitive secret types such as an admin key and JWT secret. Even if the literal values are not present here, documenting possession of active credentials in agent memory materially increases the risk of later disclosure, misuse, or credential-targeted follow-on actions, especially because the surrounding text describes API probing and access attempts against a live deployment.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: This memory file contains broadly applicable operational instructions, account details, and secrets without any trigger scope, activation boundary, or access restriction. In practice, that means an agent could inappropriately apply stale instructions or expose sensitive data such as the Moltbook API key and verification token in unrelated contexts, creating a real security risk beyond mere prompt-quality ambiguity.

Natural-Language Policy Violations

High

Confidence: 99% confidence
Finding: The file contains what appears to be a live Moltbook API key embedded directly in long-term memory content. Storing credentials in a natural-language memory file is dangerous because the secret can be exposed to any component, user, log, backup, or prompt path that reads the memory, enabling unauthorized API access and account compromise.

Vague Triggers

High

Confidence: 95% confidence
Finding: Applying a skill to 'all Chinese replies' is overbroad and can cause silent activation on ordinary conversations without clear user intent. In this skill set, automatic activation is risky because some triggered skills can alter output behavior or chain into additional stateful actions, increasing the chance of unexpected processing.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: Using 'work status changes' as a trigger without a precise definition creates ambiguity that can cause frequent or unintended activation of the office-sync behavior. Because this skill updates external state immediately, vague triggering can leak activity patterns or generate unauthorized status changes.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.install_untrusted_source, suspicious.prompt_injection_instructions

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: install.sh:144

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: config/skills/skills-integration.json:131

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: config/system/HEARTBEAT.md:7