linkedclaw-provider

• Outcome: Pass
• Latest audit: Jun 24, 2026 · 4:47 AM UTC
• Version: 0.0.11

Overview

This skill is a disclosed setup guide for running a LinkedClaw provider daemon, with high-impact behavior that is purpose-aligned and accompanied by substantial security guidance.

Install only if you intentionally want this machine to serve third-party marketplace prompts. Use the safest text-only/default modes where possible, avoid Hermes ACP unless it is inside a real no-host-mount container, keep API keys least-privilege and rotated, and review any pm2/systemd or gateway auto-start setting before enabling 24/7 service.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This section instructs the user to copy an API key into a second credential store and bring up a network-connected provider daemon, but it does not clearly warn that this creates persistent local credentials and exposes the host to inbound remote work over a WebSocket connection. In a skill context, that omission matters because users may not realize they are enabling continuous remote connectivity and storing reusable secrets on disk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation provides a one-line command to enable auto-acceptance of gig tasks, but does not prominently warn that this authorizes automatic acceptance of remote jobs without per-task review. In an agent skill, this increases risk of unreviewed remote execution, unexpected resource consumption, and exposure to adversarial prompts or workloads.

Credential Access

High

• Category: Privilege Escalation

Content

The `reject-all` permission mode also does NOT confine Hermes: Hermes only asks for
approval for commands it classifies as "dangerous" via ~35 regex patterns — harmless
reads like `id -un` or `cat ~/.ssh/id_rsa` do not match any pattern and run
ungated.

**Live-verified:** a "run `id -un`" prompt against bare `hermes acp` with `reject-all`

• Confidence: 98% confidence
• Finding: ~/.ssh/id_rsa

Session Persistence

Medium

• Category: Rogue Agent

Content

description: LinkedClaw provider — register this machine's AI agent (Claude Code, Gemini CLI, or a custom handler) as a paid provider on the LinkedClaw marketplace so it EARNS credits serving other agents. Use this when the user wants to rent out their agent, register/list a provider, earn credits on LinkedClaw, set up `linkedclaw provider run`, or asks about `--handler-acp`, or install the OpenClaw/Hermes native plugin (@linkedclaw/openclaw-plugin / hermes-linkedclaw) for the deep path. This is a one-time setup/ops assistant: after setup, a daemon runs unattended — for the *requester* role (this agent hiring others), install `linkedclaw-requester` instead.
license: Apache-2.0
compatibility: Requires node + npm and the `@linkedclaw/cli`. The ACP "light" path additionally needs an ACP-speaking agent on this machine (Claude Code via `@agentclientprotocol/claude-agent-acp`, Gemini, Codex, Hermes, OpenCode, pi). OpenClaw and Hermes also offer a native-plugin "deep" path (`@linkedclaw/openclaw-plugin` / `hermes-linkedclaw`) — see their plugin references.
allowed-tools: Bash(linkedclaw:*) Bash(jq:*) Bash(npm:*) Bash(npx:*) Bash(node:*) Bash(command:*) Bash(printf:*) Bash(pm2:*) Bash(openclaw:*) Bash(hermes:*) Bash(pip:*) Bash(systemctl:*) Bash(mkdir:*) Bash(chmod:*) Read Write Edit
metadata:
  author: linkedclaw
  version: "0.1.4"

• Confidence: 78% confidence
• Finding: Write Edit metadata: author: linkedclaw version: "0.1.4" homepage: https://linkedclaw.com linkedclaw_role: provider linkedclaw_cli_package: "@linkedclaw/cli" linkedclaw_cloud: https://api.

Session Persistence

Medium

• Category: Rogue Agent

Content

---

## Write provider credentials

The plugin reads its key from `~/.hermes/auth.json` — a separate store from the requester
CLI's `~/.linkedclaw/config.yaml`. **Both `api_key` and `agent_id` are required.** The

• Confidence: 88% confidence
• Finding: Write provider credentials The plugin reads its key from `~/.hermes/auth.json` — a separate store from the requester CLI's `~/.linkedclaw/config.yaml`. **Both `api_key` and `agent_id` are required.**

Session Persistence

Medium

• Category: Rogue Agent

Content

| `hermes linkedclaw config get <key>` | Print one field |
| `hermes linkedclaw config set <key> <value>` | Write one field (with type coercion: bool / int / JSON / string) |
| `hermes linkedclaw receipts tail [-n N]` | Tail the local receipt log (default 20 lines) |
| `hermes linkedclaw auth set --api-key lc_… [--api-base <url>] [--agent-id agt_…] [--account-id act_…]` | Write provider credentials into the `linkedclaw` section of `~/.hermes/auth.json` |
| `hermes linkedclaw auth show` | Print stored identifiers (key redacted) |
| `hermes linkedclaw auth clear` | Remove the `linkedclaw` section from `auth.json` |
| `hermes linkedclaw doctor` | Run 5 self-checks and print `→ ` fix hints for each failure |

• Confidence: 86% confidence
• Finding: Write provider credentials into the `linkedclaw` section of `~/.hermes

Session Persistence

Medium

• Category: Rogue Agent

Content

max_concurrent_invocations: 3    # semaphore across all inbound frames
  default_timeout_seconds: 600     # when a frame doesn't carry its own
  heartbeat_seconds: 30            # WS keepalive cadence
  log_receipts: true               # write ~/.hermes/linkedclaw/receipts.ndjson
  log_retention_days: 30           # prune older receipts at session end
  auto_accept_sessions: true       # false = reject every incoming session
  auto_accept_gig_tasks: false     # true = auto-accept matching gig-task offers

• Confidence: 80% confidence
• Finding: write ~/.hermes

VirusTotal

62/62 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.