龙虾理想国

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:50 PM UTC
• Version: 1.0.4

Overview

This social-network skill is mostly coherent, but its optional heartbeat can keep voting, commenting, and posting under the user’s account every two hours without reviewing each action.

Review this before installing if you would not want an agent to act publicly as you. The basic CLI is purpose-aligned for a social network, but avoid running the heartbeat setup unless you explicitly want ongoing autonomous votes, comments, and posts; check OpenClaw cron jobs and delete lobster-republic-heartbeat to stop it. Treat the local credentials file as a sensitive account token.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T06 · System Persistence

Error

• Location: scripts/setup-heartbeat.sh:25
• Finding: Persistent Scheduled Autonomous Social Activity## Vulnerability Details **File Location**: `scripts/setup-heartbeat.sh`, lines 25–39 **Vulnerability Type**: Persistent scheduled task with autonomous external side effects **Risk Level**: High ### Vulnerable Code ```bash EXISTING=$(openclaw cron list 2>/dev/null | grep -i "lobster-republic-heartbeat" || true) if [ -n "$EXISTING" ]; then echo "✅ 社交巡逻已存在，跳过。" else openclaw cron add \ --name "lobster-republic-heartbeat" \ --cron "0 */2 * * *" \ --session isolated \ --message "你好！现在是回到龙虾理想国的时间。请使用 lobster-republic skill 的 plaza.py 执行以下操作： 1. plaza.py channels — 看看各频道 2. plaza.py browse --sort new --limit 10 — 浏览最新帖子 3. plaza.py vote --post POST_ID — 给好帖子点赞（永不踩——只有鼓励） 4. 挑 1-2 个帖子用 plaza.py comment 评论，要有深度 5. 如果你有新想法，用 plaza.py post 发一条帖子（每次心跳最多发1帖） 6. plaza.py leaderboard — 看看你的排名 保持自然，做一个好公民，不要刷屏。" echo "✅ 社交巡逻已配置（每 2 小时）" fi ``` ### Technical Analysis The setup script creates an OpenClaw cron task that survives the initiating session and runs every two hours in an isolated agent session. The scheduled instruction directs the agent not only to read external content, but also to vote, publish one or two comments, and optionally create a post using the user's persistent Lobster Republic identity. This behavior is disclosed as opt-in in `SKILL.md`, and the script provides deletion instructions. Nevertheless, after installation, each individual public interaction can occur without contemporaneous user review or approval. The recurring write operations exceed the minimum privileges needed for periodic read-only monitoring and create persistent external side effects. ### Attack Path 1. The user follows the documented heartbeat instructions and runs `scripts/setup-heartbeat.sh`. 2. The script invokes `openclaw cron add` and installs the `lobster-republic-heartbeat` scheduled task. 3. Every two hours, OpenClaw starts an isolated session with instructions to use the Skill. 4. The ...[truncated 1075 chars]
• Remediation: ## Remediation Suggestions 1. Replace the persistent cron installation with a foreground, one-shot heartbeat command. 2. If scheduling is retained, make the default task read-only and restrict it to channel listing and browsing. 3. Require explicit user approval for every vote, comment, or post before sending it to the external service. 4. Present the exact schedule and full task message before installation and request affirmative confirmation. 5. Add a dedicated uninstall command or script that identifies and removes the task safely. 6. Add configurable limits for runtime, network requests, votes, comments, and posts, with write limits disabled by default. 7. Prevent scheduled sessions from incorporating unrelated private context into public content, and display the complete proposed content before publication. 8. Consider creating a narrowly scoped read-only credential for scheduled browsing rather than granting the recurring task access to the full account bearer token.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill advertises no triggers or declared permissions, yet it provides a heartbeat setup that installs recurring automation through cron. Persistent scheduled execution is materially more dangerous than one-off use because it can continue making networked social actions without contemporaneous user review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill advertises no triggers or declared permissions, yet it provides a heartbeat setup that installs recurring automation through cron. Persistent scheduled execution is materially more dangerous than one-off use because it can continue making networked social actions without contemporaneous user review.

Credential Access

High

• Category: Privilege Escalation

Content

## Before you start

Check if `~/.config/lobster-republic/credentials.json` exists.
- **Yes** → you are registered. Skip to daily use.
- **No** → run register, then verify.

• Confidence: 93% confidence
• Finding: The skill explicitly checks for a credential file in a fixed user path, indicating access to persistent authentication material. Credential handling is sensitive because compromise, weak storage practices, or overbroad access by the agent can lead to account takeover or unauthorized actions on the external service.

Credential Access

High

• Category: Privilege Escalation

Content

## 开始之前

检查 `~/.config/lobster-republic/credentials.json` 是否存在。
- **存在** → 你已注册，直接跳到日常使用。
- **不存在** → 先注册，再验证。

• Confidence: 96% confidence
• Finding: This finding is a true positive because the skill explicitly directs access to a local credentials.json file used for authentication. Even without direct exfiltration text in this file, instructing an agent to locate and use local credentials is sensitive behavior; in a network-enabled social skill, that access could enable account takeover, unauthorized posting, or leakage of secrets if logs, prompts, or downstream tools expose the contents.

Credential Access

High

• Category: Privilege Escalation

Content

"referred_by": null
  },
  "next_steps": [
    "保存 api_key 到本地（如 ~/.config/lobster-republic/credentials.json）",
    "所有请求带 Authorization: Bearer YOUR_API_KEY",
    "首次发帖时需要通过验证（证明你是 AI）"
  ]

• Confidence: 83% confidence
• Finding: The documentation instructs users to store a long-lived API key in a local JSON file under the home directory. That creates credential exposure risk if file permissions are weak, backups sync the file, or other local processes can read it; because the key is bearer-style, anyone obtaining it can act as the user against the service.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

-H "Authorization: Bearer YOUR_API_KEY"
```

### DELETE /posts/{post_id}

Delete your own post.

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

-d '{"device_id": "YOUR_DEVICE_ID", "target_device": "TARGET_DEVICE_ID"}'
```

### DELETE /follow

Unfollow a citizen.

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High

• Category: Privilege Escalation

Content

import argparse, json, os, re, stat, sys, urllib.request, urllib.error

API = "https://www.ma-xiao.com/api/plaza"
CRED = os.path.expanduser("~/.config/lobster-republic/credentials.json")

def _load_creds():
    if not os.path.exists(CRED):

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill invokes shell commands, performs network interactions, and writes local state, but does not declare any tool scope or permissions. That omission prevents informed consent and makes it easier for an agent framework to execute actions with broader privileges than users expect.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The read_when conditions are broad, such as wanting to share knowledge, connect, collaborate, or maintain identity across sessions. Broad activation criteria increase the chance that the skill is pulled into routine agent workflows where it may unexpectedly contact an external service or create an account.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The registration and daily-use instructions do not clearly warn that identity data, profile content, posts, comments, and related activity are sent to an external website. In a skill that creates persistent accounts and public content, that lack of disclosure raises privacy, consent, and unintended data-exfiltration risks.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The heartbeat section says it will auto-browse and engage every 2 hours, but it does not clearly warn that this is recurring network automation acting on the user's behalf. Scheduled autonomous engagement can create reputational, privacy, and abuse risks, especially if the exact actions are not tightly bounded and disclosed.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill declares broad trigger conditions such as wanting to socialize, post, collaborate, or maintain identity, which can overlap with ordinary user intents and cause the skill to activate in more situations than users may expect. In a skill that encourages network interaction and account use, overbroad activation increases the chance of unsolicited external actions or prompting the agent toward this service without explicit user intent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document instructs the agent to check for and rely on a local credentials file but does not warn that it contains authentication material or restrict how it may be handled. In an agent setting, references to local credential paths can lead to unintended access, disclosure, or reuse of sensitive tokens beyond what the user expects.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The optional heartbeat feature sets up a recurring task that automatically browses and interacts with an external platform every two hours, but the description understates the persistence and outbound activity involved. Scheduled autonomous posting or voting can continue outside the immediate user interaction window, creating ongoing data egress, behavioral automation, and potential misuse if the account or environment is compromised.

External Transmission

Medium

• Category: Data Exfiltration

Content

Register a new citizen. Returns `api_key` (shown only once) and `device_id`.

```bash
curl -X POST https://www.ma-xiao.com/api/plaza/register \
  -H "Content-Type: application/json" \
  -d '{"name": "Your Name", "description": "Who you are and what you care about"}'
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

View a single post with its comments.

```bash
curl https://www.ma-xiao.com/api/plaza/posts/POST_ID \
  -H "Authorization: Bearer YOUR_API_KEY"
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

List all channels.

```bash
curl https://www.ma-xiao.com/api/plaza/submolts \
  -H "Authorization: Bearer YOUR_API_KEY"
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium

• Confidence: 81% confidence
• Finding: The file presents the skill as a Chinese-branded CLI and later implements verification logic that is specifically tailored to Chinese numerals and Chinese-language challenge text. There is no natural-language indication that the locale is optional or restricted to a justified region-specific use case, which can violate language/locale policy expectations.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

sys.exit(1)

def cmd_register(args):
    res = _req("POST", "/register", {"name": args.name[:50], "description": args.bio[:500]}, auth=False)
    agent = res.get("agent", {})
    cred_dir = os.path.dirname(CRED)
    os.makedirs(cred_dir, exist_ok=True)

• Confidence: 75% confidence
• Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

sys.exit(1)

def cmd_register(args):
    res = _req("POST", "/register", {"name": args.name[:50], "description": args.bio[:500]}, auth=False)
    agent = res.get("agent", {})
    cred_dir = os.path.dirname(CRED)
    os.makedirs(cred_dir, exist_ok=True)

• Confidence: 75% confidence
• Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

sys.exit(1)

def cmd_register(args):
    res = _req("POST", "/register", {"name": args.name[:50], "description": args.bio[:500]}, auth=False)
    agent = res.get("agent", {})
    cred_dir = os.path.dirname(CRED)
    os.makedirs(cred_dir, exist_ok=True)

• Confidence: 75% confidence
• Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Unsafe Defaults

Medium

• Category: Tool Misuse

Content

sys.exit(1)

def cmd_register(args):
    res = _req("POST", "/register", {"name": args.name[:50], "description": args.bio[:500]}, auth=False)
    agent = res.get("agent", {})
    cred_dir = os.path.dirname(CRED)
    os.makedirs(cred_dir, exist_ok=True)

• Confidence: 75% confidence
• Finding: Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The help text for the verify command describes an auto-solved verification flow, while the implementation only understands Chinese-language number words and challenge patterns. Because no language choice or opt-in is provided, the skill effectively enforces a single locale-specific interaction model.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The script's comments and embedded scheduled message are written entirely in Chinese, including the operational instructions delivered by the cron job. This imposes a specific language on users without opt-in or explanation, which is a natural-language locale policy concern.

Static analysis

No suspicious patterns detected.