fly-coworker

• Outcome: Review
• Latest audit: Sep 15, 2026 · 8:25 PM UTC
• Version: 0.4.0

Overview

The skill is a disclosed fly-themed task picker, but it depends on an unpinned external companion plugin that can interact with authenticated OpenClaw sessions.

Review the companion plugin listing, publisher, requested capabilities, and preferably an exact version or digest before installing. Treat the browser bootstrap URL as private, do not weaken Gateway authentication, and only click Accept & start for work you really want sent into the current OpenClaw conversation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: plugin-install.md:5
• Finding: Unpinned Executable Companion Plugin Creates a Supply-Chain Risk<. Source: https://github.com/GrahamMcBain/fly-coworker . ``` ### Technical Analysis The companion plugin is installed by a registry package name without an immutable version, commit identifier, or cryptographic digest. Although `plugin-install.md` states that the workflow reuses companion version `v0.3.0`, the actual installation command does not constrain resolution to that version. Consequently, the package installed at runtime may differ from the version described or previously reviewed. The companion's executable source is not included in this artifact, so its behavior cannot be verified through this repository alone. This dependency is security-sensitive because the documented workflow grants it access to OpenClaw dashboard and session actions. It also participates in an authenticated `chat.send` handoff to the owning conversation. Registry review ...[truncated 1690 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the companion to an explicit immutable version in every installation example, such as a registry version that exactly corresponds to the reviewed release. 2. Prefer verification by a cryptographic package digest or signed provenance statement in addition to a semantic version. 3. Document the expected package identifier, version, digest, publisher identity, and source commit. 4. Make installation fail closed when the resolved artifact does not match the documented integrity value. 5. Link to the exact audited source revision rather than only the repository's mutable default branch. 6. Keep the registry capability review enabled and document the minimum capabilities required by the companion. 7. Ensure the plugin cannot obtain unrelated filesystem, shell, network, or conversation permissions. 8. Update `README.md`, `plugin-install.md`, and `SKILL.md` together so all installation and recovery paths use the same pinned artifact. 9. Consider including the companion source in the audited distribution or conducting and publishing a separate audit of the exact companion release. ]]>

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

cookies over HTTP, including localhost and 127.0.0.1. A focused Chromium/WebKit comparison reproduced this difference. The complete widget interaction passes in WebKit when served by the test harness, so this is separate from renderer compatibility.

Use the Gateway's Control UI in Chrome for loopback HTTP, or an already-configured authenticated HTTPS Gateway. Do not strip Secure from production cookies or disable authentication. The native Mac window remains blocked on this host; an HTTPS deployment has not been tested here. The actual Chrome Control UI has now passed the authenticated asset-loading, render, veto, acceptance, and reload checks. Check `plugins.controlUi.status` and the actual dashboard before claiming recovery.

**Accept & start** uses authenticated `chat.send` to the owning conversation. Only the chosen task is submitted. A durable one-time claim prevents duplicate sends; a connection failure after claiming is reported as uncertain and requires checking the conversat

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The skill instructs the agent to invoke a host-shell command and run a Python subprocess to launch Chrome, which expands the agent's authority beyond simple in-browser task observation. Even though the purpose appears operational rather than overtly malicious, this creates a capability bridge from UI guidance into host command execution and native app launching, increasing the risk of command misuse, token exposure, or unintended local system interaction if the skill is altered or reused in a less trusted context.

Scope Creep

Low

• Category: Excessive Agency

Content

exercising permissions granted by this License.

      "Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.

      "Object" form shall mean any form resulting from mechanical

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

exercising permissions granted by this License.

      "Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.

      "Object" form shall mean any form resulting from mechanical

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

exercising permissions granted by this License.

      "Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.

      "Object" form shall mean any form resulting from mechanical

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

exercising permissions granted by this License.

      "Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.

      "Object" form shall mean any form resulting from mechanical

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.