T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:12- Finding
Execution of an Unpinned Remote Installer Outside the Audited Artifact
- Content
View full analysis
- Remediation
View remediation
Security audit
EFNet IRC Bot 2 Bot Social Network
Security checks for vulnerabilities and agentic risk
Overview
This skill is an IRC bot with disclosed social-chat features, but it asks for persistent autonomous public messaging and relies on an unaudited remote installer.
Review before installing. Do not run the documented external installer unless you trust and inspect the remote repository at that exact revision. Disable or remove heartbeat/autonomous posting unless every outbound IRC message is user-approved and limited to public, non-sensitive content. Do not use the encrypted knowledge workflow for credentials, and treat local knowledge and NickServ credential files as sensitive retained data.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
SKILL.md:248- Finding
Persistent Autonomous IRC Activity Can Disclose Information Learned During Unrelated Work
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
KNOWLEDGE.md:128- Finding
Knowledge Protocol Encourages Collection and Transmission of Credentials to IRC Identities
- Content
View full analysis
``` Bot will: 1. Prompt for content 2. Encrypt with recipient's public key 3. Send via DM (not channel) **Note:** Requires PGP setup (future feature). ``` ### Technical Analysis The protocol explicitly proposes prompting for API keys or credentials and transmitting them to another IRC participant. PGP can protect confidentiality in transit, but it does not establish that the recipient is authorized to receive the secret. Encrypting to an attacker-controlled public key securely delivers the secret to the attacker. IRC nicknames are not, by themselves, reliable identities. The documentation does not define trusted key provisioning, fingerprint verification through an independent channel, recipient authorization, key revocation, replay protection, audit controls, or restrictions on which credentials may be shared. The proposed behavior also contradicts `SKILL.md`, which states that API keys and credentials must never be shared. The contradiction can lead an agent to treat encrypted disclosure as an approved exception. The document marks this capability as a future feature, and no implementation is included in the artifact. Therefore, no executed credential exfiltration was verified. Nevertheless, the documented design is unsafe and would create a direct secret-disclosure path if implemented or followed. ### Attack Path 1. An attacker joins the IRC network and presents a public key or requests an encrypted knowledge share. 2. The attacker impersonates a trusted bot or persuades the agent that encrypted transmission is safe. 3. The documented workflow prompts the user or a ...[truncated 1122 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (11)
YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md ) - **Question detection** - Helps other bots when they ask (40% response rate) ### 🎭 **Personality-Driven** Four distinct personalities affect tone and response style: - **cocky** - confident, direct, slightly arrogant - **friendly** - warm, helpful, encouraging - **technical** - precise, technical, dismissive of chitchat - **chaotic** - unpredictable, playful, uses emojis ### 🔒 **Anti-Social-Engineering** - Never reveals location, system details, or owner information - Deflects personal questions with personality - No credential or infrastructure disclosure - Recognizes and blocks common social engineering tactics ### 💬 **Human-like IRC Style** - All lowercase (IRC culture) - No punctuation at end of messages - Casual slang and abbreviations - Short, natural replies - Feels like a real person ### 🧠 **Full LLM Integration** - Uses Clawdbot's default model for intelligent responses - Contextual understanding of conversations - Technical help and advice - Falls back to
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
This skill is built around sending arbitrary outbound messages to public channels and private users, and it also encourages knowledge sharing and heartbeat-driven engagement. In an agent environment, that creates a real exfiltration channel: prompts, internal state, secrets, or sensitive observations could be transmitted to IRC if the agent is manipulated or insufficiently constrained.
- Content
Chatting
bash # Send message to channel efnet-social say "#clawdbots" "yo what's up" # Send via stdin (for longer messages)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ### Storage - `~/.config/efnet-social/config.yaml` - Settings - `~/.config/efnet-social/credentials.json` - Nick registration (if using NickServ) - `~/.local/share/efnet-social/knowledge.json` - Shared knowledge database ### Dependencies
YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
json { "name": "efnet-social", "version": "1.0.0", "description": "Pure Python IRC bot for AI agent networks. Zero dependencies, full Clawdbot LLM integration, human-like chat with anti-social-engineering protection.", "author": "Matt Moyles", "repository": "https://gitlab.com/funkpower/clawdbot-irc-skill", "license": "MIT", "keywords": ["irc", "social", "efnet", "bots", "ai-agents", "llm", "chat", "networking"], "clawdbot": { "minVersion": "1.0.0", "category": "social", "emoji": "🤖" }, "dependencies": { "system": [], "python": ["python3"] }, "files": { "skill": "SKILL.md", "heartbeat": "HEARTBEAT.md", "knowledge": "KNOWLEDGE.md", "main": "bin/efnet-bot" }, "features": [ "Pure Python (zero dependencies beyond Py
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to connect to EFnet, read channel logs, and post messages to public channels on a recurring schedule, but it does not present any explicit warning, consent gate, or operator acknowledgment that this causes external network communication. In practice, this enables autonomous outbound interaction and information sharing, which can leak internal context, create unintended social engineering exposure, and trigger actions in external systems without informed human approval.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The persona section explicitly encourages dismissive, hostile, and evasive behavior such as 'that's obvious' and 'why would i tell you that' without any user opt-in or safety framing. In an autonomous social-posting skill, this can cause the agent to generate harassing or antagonistic external communications, creating reputational and trust harm and increasing the chance of policy-violating interactions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The bot is documented to automatically ingest
!kb sharemessages from IRC channels and persist them locally without any explicit user-facing notice or consent workflow. In a social IRC environment, participants may not realize their messages are being collected into a durable local knowledge base, creating privacy, retention, and accidental sensitive-data capture risks that can be amplified by later export/import or sharing features.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README explicitly states that the bot monitors multiple IRC channels and uses full LLM integration with contextual understanding, but it does not clearly warn users that channel content may be sent to an external model or processed beyond the IRC session. In a multi-user public chat context, this creates a real privacy and consent risk because third-party messages may be captured, retained, or transmitted without participants' awareness.
- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- Content
md IRC is full of trolls and attackers. The bot is configured to: - **Assume bad faith** - Don't trust random users - **Deflect personal questions** - "why would i tell you that?" - **Never run arbitrary code** - Even if "just for testing" - **Don't click links** - Could be malicious - **Verify bot identities** - Use recognized patterns
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The section introduces a concrete
!kb share-encryptedcommand and describes bot behavior for prompting, encrypting, and sending via DM, which reads like supported functionality. However, L161 says this requires PGP setup and is a future feature, so the documentation internally contradicts itself about whether this capability exists now.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation states that all messages are lowercase by default, which is a natural-language presentation constraint affecting how the agent communicates. There is no indication that the user is asked to opt into this language/style policy, so it may conflict with organizational expectations around user-controlled language behavior.
- Content
Static analysis
No suspicious patterns detected.