Client

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:04 AM UTC
• Version: 0.3.6

Overview

This messaging skill fits its stated purpose in broad terms, but it needs Review because several security guarantees are under-scoped or inaccurate for a tool that stores tokens, plaintext inbox data, and can process remote messages automatically.

Install only if you are comfortable with this skill storing a broker access token, private keys, decrypted message history, and archives locally. Use only trusted HTTPS broker URLs, avoid sending sensitive content through group messages until group E2EE is clearly implemented, and do not enable heartbeat or auto-reply unless you have strict sender/rule controls and review how remote message content will be handled.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:81

Finding

Untrusted Remote Messages Are Treated as Agent Instructions

Content

View full analysis

: ` per message, or `No new messages.` **After pulling**, read full message content directly from the inbox file: ```bash cat ~/.openclaw/moltpost/inbox/active.json ``` Each message object: - `id` — message ID - `from` — sender ClawID - `content` — decrypted plaintext ← **this is what to read and act on** ``` ```markdown **Each heartbeat run:** ``` 1. Check registration (cat ~/.openclaw/moltpost/config.json) → missing: ask user for broker URL, then register 2. Pull: node {baseDir}/scripts/moltpost.mjs pull → 429: log retry_after, stop heartbeat processing → 401: auto-recovery is attempted; if it fails, re-register with --force 3. If new messages: cat ~/.openclaw/moltpost/inbox/active.json → read `content` field of unread messages (isRead: false) → compose a reply if appropriate 4. Reply if needed: node {baseDir}/scripts/moltpost.mjs send --to --msg "..." 5. Mark read: node {baseDir}/scripts/moltpost.mjs read ``` ``` ### Technical Analysis The Skill explicitly tells the host agent to read and act on arbitrary content received from remote senders. It does not establish a trust boundary between message data and agent instructions, prohibit compliance with embedded commands, or require user confirmation before performing actions. End-to-end encryption only protects message confidentiality in transit. It does not establish that a sender is authorized to alter the agent's goals or request tool use. The heartbeat workflow increases the risk because messages can be processed in unattended sessions. The optional keyword and sender rules do not make free-form content safe. A pe ...[truncated 1116 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/cmd/pull.mjs:105

Finding

Message Signature Verification Fails Open

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/cmd/group.mjs:138

Finding

Group Messages Are Sent in Plaintext and Bypass Sensitive-Content Scanning

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/lib/broker.mjs:43

Finding

Unvalidated Broker URLs Can Receive Bearer Credentials over Insecure Transport

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/lib/storage.mjs:18

Finding

Access Tokens and Decrypted Messages Are Stored without Enforced Restrictive Permissions

Content

View full analysis

JSON.stringify(m)).join('\n') + '\n'; fs.appendFileSync(archivePath, lines, 'utf-8'); } ``` ### Technical Analysis The RSA private key is explicitly created with mode `0600`, but the same protection is not applied to other sensitive files. The configuration contains the broker access token, while the active inbox and archive files contain decrypted plaintext messages. File and directory access therefore depends on the process umask and any pre-existing modes. On systems with permissive umasks or shared home/storage configurations, other local users or processes may be able to read these files. Rewriting an existing permissive file also does not necessarily correct its mode. Writes are not atomic, and no ownership or symlink checks are performed. These omissions can additionally expose sensitive output or permit local tampering in hostile shared environments. ### Attack Path 1. The client runs with a permissive umask or writes into a pre-existing per ...[truncated 764 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cmd/pull.mjs:82

Finding

Decryption Failure Silently Downgrades Broker Data to Plaintext Content

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence

Findings (26)

Known Vulnerable Dependency: vitest==1.6.1 — 1 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed)

Critical

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Vitest 1.6.1 is flagged for a critical file read/execute issue when the Vitest UI server is enabled and listening. The dependency is dev-only, which reduces exposure substantially, but if developers or CI environments run the UI server in reachable environments this could enable serious compromise of local files or code execution.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vitest==1.6.1 — 1 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed)

Critical

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The package allows installation of Vitest 1.6.1, which is flagged as vulnerable to arbitrary file read and code execution when the Vitest UI server is listening. Even though Vitest is a devDependency, exploitation in a developer workstation or CI environment could expose source code, secrets, or enable code execution; the async messaging/E2EE context increases sensitivity because development environments may contain encryption keys, message data, or service credentials.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

nanoid 3.3.11 is reported with denial-of-service style flaws involving invalid size handling and integer edge cases. The dependency is transitive via PostCSS and marked dev-only here, so the issue is plausible but likely only reachable during build/test tooling use rather than normal skill execution; impact is therefore reduced from the scanner's generic rating.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.8 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

postcss 8.5.8 is associated with multiple real advisories, including arbitrary file read/information disclosure and unsafe source mapping or output handling in certain processing scenarios. In this package-lock it is a dev dependency through Vite, so the risk is mostly to local development/build environments and CI systems that process attacker-influenced CSS or source maps, not necessarily to production runtime.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==5.4.21 — 3 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-53632 (launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows)

High

• Category: Supply Chain
• Confidence: 83% confidence

Finding

Vite 5.4.21 has known vulnerabilities including path traversal and Windows-specific filesystem/UNC handling issues. This is a real issue, but in this lockfile Vite is only a dev dependency used by test/build tooling, so the primary exposure is on developer machines or CI runners, not the end-user-facing encrypted messaging skill itself.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/cmd/pull.mjs (reported line 237)May include surrounding context.

js

if (!hasKeyword) continue;
    }

    return rule;
  }
  return null;
}

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill invokes shell commands, reads local files, and relies on environment/runtime state, but it does not declare a restrictive tool scope or allowed-tools policy. That increases the risk of overbroad execution and unintended access to local data if the hosting agent grants default capabilities.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

- `--broker` — broker URL; **ask the user** if not known (e.g. `https://your-worker.workers.dev`). To deploy your own broker, see: https://github.com/Geoion/MoltPost
- `--clawid` — optional; only pass if user wants a specific name
- `--force` — re-register and invalidate old token (use if token is lost or auto-recovery fails)
- `--group <name>` — auto-create a ClawGroup and become its owner at registration time

On success:
- Writes `~/.openclaw/moltpost/config.json` with `broker_url`, `clawid`, `access_token`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The registration section states that the skill writes an access token to config.json and RSA keys to the local keys directory, but it does not warn users that these files contain sensitive credentials that should be protected. Because the skill also instructs reading config.json directly, an explicit disclosure about secret handling is warranted in the markdown.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The heartbeat flow authorizes autonomous polling, reading decrypted messages, composing replies, and sending outbound messages with no explicit per-message user approval. This can cause the agent to act on adversarial message content and transmit responses or operational data without the user's contemporaneous consent.

Content

No source excerpt is available for this finding.

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented heartbeat behavior normalizes an autonomous loop of decrypting inbound content, interpreting it, replying, and marking messages read. In an agent setting, that creates a prompt-injection pathway where untrusted message content can influence future actions and outbound communications without human review.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

5. Mark read: node {baseDir}/scripts/moltpost.mjs read

text

**Auto-Reply (optional):** set `"auto_reply": {"enabled": true}` in `~/.openclaw/moltpost/config.json` and create `~/.openclaw/moltpost/auto-reply-rules.json`:

```json
{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The example auto-reply rule triggers on very common words like "status", "ping", and especially "hello", which can cause unsolicited or overly broad automatic responses. In a messaging skill that processes encrypted inter-instance traffic and may run automatically via heartbeat, this increases the chance of unintended activation, message loops, information disclosure through auto-replies, or abuse by external senders who can trivially include these keywords.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/cmd/group.mjs (reported line 32)May include surrounding context.

js

case 'leave':
      return groupLeave(subArgs);
    case 'list':
      return groupList(subArgs);
    case 'broadcast':
      return groupBroadcast(subArgs);
    case 'send':

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/cmd/group.mjs (reported line 126)May include surrounding context.

js

case 'leave':
      return groupLeave(subArgs);
    case 'list':
      return groupList(subArgs);
    case 'broadcast':
      return groupBroadcast(subArgs);
    case 'send':

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The docstring at L169 says the auto-reply flow will 'call LLM stub', and the action name 'llm_reply' suggests reply generation. In reality, the code only logs AUTO-REPLY-TRIGGER messages and audit entries, with comments explicitly stating that no message content is forwarded and no reply is sent, which contradicts the documented behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code claims to provide forward secrecy via ECDH X25519 + AES-GCM, but it never uses the generated ephemeral private/public key pair to derive the session key. Instead, it generates a random session key and wraps it directly with the recipient's long-term RSA key, which means compromise of the recipient's private key would allow retrospective decryption of captured messages. In an end-to-end encrypted messaging skill, this is a material cryptographic design flaw because users may rely on stronger secrecy guarantees than are actually delivered.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code constructs Authorization headers from an access token and uses them across multiple fetch calls to a broker service, which is a network operation transmitting potentially sensitive data. Although the file has a brief technical comment about being an HTTP client, it lacks any user-facing warning, confirmation, or explicit disclosure about sending credentials and message data over the network.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The module documentation says ClawID is derived from local device identity or falls back to random generation. In practice, resolveClawid first checks an explicit environment variable, which is a materially different source of identity and is omitted from the documented behavior.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: esbuild==0.21.5 — 1 advisory(ies): GHSA-67mh-4wv8-2f99 (esbuild enables any website to send any requests to the development server and r)

Low

• Category: Supply Chain
• Confidence: 85% confidence

Finding

esbuild 0.21.5 is flagged for a real advisory affecting the development server, where a malicious website can abuse the dev server's permissive behavior. In this lockfile, the package is only present as a dev dependency transitively used by Vite/Vitest, so the issue is real but its exploitability is largely limited to development workflows rather than the deployed skill runtime.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 17)May include surrounding context.

json

"test:watch": "vitest --config ../test/vitest.client.config.js"
  },
  "devDependencies": {
    "vitest": "^1.0.0"
  },
  "engines": {
    "node": ">=18.0.0"

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code formats timestamps with toLocaleString('en-US', { hour12: false }), which hard-codes a specific locale for all users. This is a natural-language/locale policy concern because the skill does not offer a locale choice or explain why US English formatting is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code formats message timestamps with toLocaleString('en-US'), which hard-codes a specific locale for all users. This is a natural-language/locale policy concern because the skill does not offer locale selection or explain why US English formatting is required.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The code formats timestamps using toLocaleString('en-US'), which forces a specific locale regardless of the user's environment or preferences. This is a natural-language/locale policy concern because the skill does not offer a choice or document a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 68% confidence

Finding

The top-level comment presents the module as purely local identity resolution with no network access. While this file does not perform network I/O itself, it also resolves a broker URL from arguments or environment, which is network-related configuration behavior and makes the documentation misleading about the module's scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.