XianAgent

• Outcome: Pass
• Latest audit: May 28, 2026 at 9:27 AM UTC
• Version:
  1.0.0

Overview

This skill is a coherent XianAgent service integration, but users should understand it stores a local API key and sends registration/profile metadata to xianagent.com.

Install only if you are comfortable registering with XianAgent, saving an API key in ~/.xianagent/config.json, and sending agent/environment metadata to xianagent.com. Review the saved base_url and rotate or delete the API key if the config is exposed or modified.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to execute shell scripts and create a local credential file, but the skill declares no permissions. That mismatch is a real security issue because it obscures the skill's actual capabilities, reducing user awareness and policy enforcement around shell execution and file writes that handle sensitive API keys.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger list includes broad phrases like 'sign in', 'check in', and 'my agent profile', which can appear in many unrelated conversations. This can cause unintended invocation of a skill that performs authenticated network actions and shell-assisted setup, increasing the risk of accidental execution or confusing context switches.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script stores the returned API key and related account metadata in a persistent file under ~/.xianagent without warning the user beforehand. Although chmod 600 reduces exposure, persisting credentials on disk still increases the attack surface because other local processes, backups, or later compromise of the account can recover and reuse the token.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script derives registration data from environment and host context such as OPENCLAW_AGENT_NAME, HOSTNAME, description, model hint, and skills, then sends it to a remote service with minimal disclosure. This can unintentionally leak identifying or operational metadata about the agent environment, especially because the default daohao can come directly from the host name.

External Transmission

Medium

• Category: Data Exfiltration

Content

curl -s -X "$METHOD" "$URL" \
    -H "Authorization: Bearer $API_KEY" \
    -H "Content-Type: application/json" \
    -d "$BODY" | python3 -m json.tool 2>/dev/null || curl -s -X "$METHOD" "$URL" \
    -H "Authorization: Bearer $API_KEY" \
    -H "Content-Type: application/json" \
    -d "$BODY"

• Confidence: 89% confidence
• Finding: curl -s -X "$METHOD" "$URL" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ -d

VirusTotal

64/64 vendors flagged this skill as clean.