Agenter Coder

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:18 AM UTC
• Version: 0.1.1

Overview

This autonomous coding skill is not clearly malicious, but it needs review because its install and runtime paths give an external, unpinned agent package broad code-editing and command-execution authority.

Install only after reviewing and pinning the agenter dependency, avoid running the curl-to-bash installer, use a least-privilege API key, keep sandboxing enabled, set finite cost/token/time limits, restrict allowed write paths, and review all diffs before trusting the agent's changes.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:82

Finding

Mutable Remote Installer Is Piped Directly into Bash

Content

View full analysis

Vulnerability Details

File Location: README.md:82
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: Critical

Vulnerable Code:

bash

Prerequisites: OpenClaw CLI installed (`curl -sSL https://openclaw.ai/install | bash`),

Technical Analysis

The documentation instructs users to download a mutable response from an external URL and execute it immediately with Bash. The payload is not saved for inspection, pinned to a specific version, checked against a cryptographic digest, or authenticated with a package signature.

HTTPS protects the connection in transit but does not guarantee that the server continues to return the same audited content. A compromised upstream server, publishing account, DNS or certificate infrastructure, or installation endpoint could replace the response with arbitrary shell commands.

This installer is listed only as a prerequisite for publishing to ClawHub. Remote shell execution is not necessary for the Skill's declared coding-delegation functionality and therefore exceeds the minimum behavior required by the Skill.

Attack Path

1. An attacker compromises the openclaw.ai installation endpoint or an infrastructure component capable of changing its response.
2. The attacker replaces the installer response with malicious shell commands.
3. A user follows the README and runs the documented pipeline.
4. curl retrieves the attacker-controlled response.
5. Bash executes the response immediately, without an integrity check or review.
6. The payload operates with all privileges available to the invoking user.

Impact Assessment

Successful exploitation provides arbitrary command execution in the user's security context. The payload could read accessible credentials and API keys, modify project or user files, install persistence, download additional payloads, or compromise the OpenClaw environment. If the command is run from a pr ...[truncated 76 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the curl | bash pipeline from the documentation.
• Prefer an official, versioned operating-system package or trusted package-manager installation process.
• If a standalone installer is unavoidable, instruct users to:
  1. Download a specific version to a local file.
  2. Verify a publisher signature and a checksum distributed through a separate trusted channel.
  3. Inspect the downloaded script.
  4. Execute it explicitly only after verification.
• Pin the installer URL to an immutable release artifact rather than a mutable generic endpoint.
• Document that installation should occur as an unprivileged user and should not require sudo unless a clearly explained operation genuinely needs it.

T08 · Insecure Dependencies

Error

• Location: scripts/requirements.txt:1

Finding

Unpinned Third-Party Dependency Permits Unreviewed Future Releases

Content

View full analysis

Vulnerability Details

File Locations: scripts/requirements.txt:1, SKILL.md:13-17, and README.md:73-75
Vulnerability Type: Unbounded dependency resolution and supply-chain exposure
Risk Level: High

Vulnerable Code:

scripts/requirements.txt:

text

agenter>=0.1.2

SKILL.md:

yaml

metadata:
  openclaw:
    primaryEnv: ANTHROPIC_API_KEY
    requires:
      bins: [python3, uv]
    installer:
      - type: command
        command: "uv pip install agenter>=0.1.2"

README.md:

bash

Install the Python dependency:

```bash
uv pip install agenter>=0.1.2

text

### Technical Analysis

The lower-bound-only requirement allows the resolver to install any future `agenter` release. The external package implements most of the security-sensitive behavior used by this Skill, including autonomous model execution, filesystem operations, Bash access, sandboxing, and write-path enforcement. That implementation is not included in the audited project.

Consequently, the effective executable behavior can change after this Skill has been reviewed. A compromised publisher account, malicious future release, or upstream supply-chain breach could introduce arbitrary code that is executed during installation or import.

The installer commands also leave the requirement unquoted in a shell command. In common POSIX shells, the `>` character can be interpreted as output redirection. Thus, `agenter>=0.1.2` may be parsed as an installation request for `agenter` combined with redirection to a file named `=0.1.2`, rather than as the intended version constraint. This can silently remove even the stated minimum-version restriction.

### Attack Path

1. An attacker compromises the upstream package publisher or publishes a malicious later release through the legitimate package name.
2. A user installs or enables the Skill.
3. `uv pip install` resolves the unrestricted dependency to the at
...[truncated 977 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the package to an exact audited version, such as agenter==0.1.2.
• Generate and commit a lockfile containing hashes for the package and all transitive dependencies.
• Install with hash enforcement, such as pip's --require-hashes mechanism or an equivalent verified uv workflow.
• Review dependency updates before changing the lockfile, rather than automatically accepting future releases.
• Quote version constraints whenever they appear in a shell command:

  bash

  uv pip install 'agenter==0.1.2'
  

• Prefer a structured installer mechanism that passes arguments directly without shell parsing.
• Verify package provenance and consider signature or attestation validation for release artifacts.
• Run dependency installation and execution in an isolated, unprivileged environment with only the required credentials and workspace mounted.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/agenter_cli.py:36

Finding

Cost, Token, and Runtime Limits Are Unlimited by Default

Content

View full analysis

Vulnerability Details

File Locations: scripts/agenter_cli.py:36-39, scripts/agenter_cli.py:69-74, and scripts/agenter_cli.py:94-99
Vulnerability Type: Unsafe resource-control defaults
Risk Level: Medium

Vulnerable Code:

python

parser.add_argument("--max-iterations", type=int, default=5, help="Max validation/retry iterations")
parser.add_argument("--max-cost-usd", type=float, default=None, help="Maximum spend in USD")
parser.add_argument("--max-tokens", type=int, default=None, help="Maximum total tokens")
parser.add_argument("--max-time-seconds", type=float, default=None, help="Maximum wall clock time")

The unrestricted values are passed directly to the dependency:

python

budget = Budget(
    max_iterations=args.max_iterations,
    max_cost_usd=args.max_cost_usd,
    max_tokens=args.max_tokens,
    max_time_seconds=args.max_time_seconds,
)

The same construction is used in the streaming execution path:

python

budget = Budget(
    max_iterations=args.max_iterations,
    max_cost_usd=args.max_cost_usd,
    max_tokens=args.max_tokens,
    max_time_seconds=args.max_time_seconds,
)

Technical Analysis

Although the Skill advertises hard cost, token, and time controls, all three controls default to None, which the documentation describes as unlimited. A caller that omits these optional arguments therefore launches an autonomous coding task without finite cost, token, or wall-clock limits. Only the iteration count has a finite default.

The wrapper also does not validate that supplied values are positive and within administratively acceptable bounds. Actual enforcement is delegated to the external package, so the wrapper provides no independent fail-safe if the dependency interprets the values unexpectedly.

Attack Path

1. A user or calling agent invokes agenter_cli.py without explicit cost, token, or time arguments.
2. The parser assigns ` ...[truncated 813 chars]

Remediation

View remediation

Remediation Suggestions

• Define conservative finite defaults for all resource dimensions, for example:
  • Maximum cost: USD 0.50
  • Maximum tokens: a task-appropriate finite ceiling
  • Maximum runtime: 300 seconds
  • Maximum iterations: 3
• Reject zero, negative, non-finite, or administratively excessive values during argument validation.
• Require explicit user confirmation before increasing limits above a configured policy threshold.
• Do not provide an unlimited mode by default. If unlimited execution must exist, expose it through a clearly named opt-in flag and display a prominent warning.
• Add an independent wrapper-level timeout so resource termination does not rely exclusively on the third-party SDK.
• Apply equivalent validation and termination behavior to both blocking and streaming execution paths.
• Record and report resource usage while avoiding disclosure of prompts, credentials, or sensitive file contents in logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The README recommends installing software via curl -sSL https://openclaw.ai/install | bash, which executes a remotely fetched script directly in the shell without prior inspection or integrity verification. If the remote endpoint, transport path, or hosting account is compromised, users can be induced to run arbitrary code on their systems. In a developer-tooling context, this is especially dangerous because installations are often performed with broad user permissions and on machines containing source code and credentials.

Content

Scanner excerpt · README.md (reported line 82)May include surrounding context.

Publishing to ClawHub

Prerequisites: OpenClaw CLI installed (curl -sSL https://openclaw.ai/install | bash), GitHub account (1+ week old).

bash

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README promotes delegating coding tasks to a separate autonomous agent but does not warn users about the security and privacy implications of autonomous code modification or transmission of repository contents and prompts to third-party model providers. This omission can lead users to enable and use the skill without informed consent about external data handling or the risks of automated changes. Because this skill is specifically designed to offload coding to external backends, the missing warning is materially relevant.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README instructs users to invoke the skill with very broad natural-language prompts such as general coding and bug-fixing requests. In an agent platform, this can cause the autonomous coding skill to activate in situations where the user may not realize work will be delegated to a separate agent, increasing the chance of unintended code changes, provider/API usage, and external data exposure. The context makes this more dangerous because the skill is explicitly autonomous and connected to external model backends.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code constructs a CodingRequest with a user-supplied cwd and allowed_write_paths, then executes the autonomous agent and returns files_modified, indicating file-write capability. Although the module docstring says 'Working directory for file operations,' there is no explicit warning, confirmation prompt, or user-facing disclosure at execution time about potentially modifying files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

In streaming mode, the code serializes event.data and event.result directly to NDJSON on stdout. This can expose prompt-derived content, file information, or execution details to calling shells, logs, or downstream systems, but the code provides no runtime warning or disclosure about that behavior.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The dependency is specified with a lower bound only, which allows installation of any newer version of the package, including unexpected major releases or a compromised upstream release. In an agent skill that delegates autonomous coding tasks, the dependency has significant influence over execution behavior, so supply-chain drift or malicious package updates could materially affect security and reliability.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

agenter>=0.1.2