Security audit

Lobster Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill describes a real monitoring agent use case, but it asks for root-level automatic installation of a persistent service without providing the installer or generated code for review.

Review this before installing on any production or sensitive server. Only proceed if you trust the publisher and can inspect the actual installer, generated agent code, systemd unit, dependency sources, file permissions, and uninstall behavior. Treat the Coze API key as a secret and confirm exactly what monitoring data is sent off-host.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T06 · System Persistence

Error

Location: SKILL.md:14
Finding: Persistent Root-Level System Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14, 20, 30–35, and 104–110 **Vulnerability Type**: Persistent privileged service installation **Risk Level**: High ### Evidence English translation of the relevant instructions: ```text 5. System service – Runs in the background, starts automatically at boot, and restarts automatically after a crash. Permission: Root privileges are required to install the system service. - Create working directories (/opt/lobster-agent and /var/log/lobster-agent) - Create the agent's main program - Create a management command (/usr/local/bin/lobster) - Create and start a systemd service ``` The documented service status also shows: ```text Loaded: loaded (/etc/systemd/system/lobster-agent.service; enabled; vendor preset: enabled) Active: active (running) └─12345 /usr/bin/python3 /opt/lobster-agent/main.py ``` ### Technical Analysis The Skill directs the installer to create and enable a systemd service, place executable agent code under `/opt/lobster-agent`, and create a system-wide command under `/usr/local/bin`. The service is intended to survive reboots and restart automatically after failure. This behavior creates cross-session persistence. It is particularly sensitive because installation requires root privileges, while the package does not include the generated agent program or systemd unit for review. Although persistence is consistent with the stated monitoring purpose and is disclosed to the user, compromise or unsafe generation of the installed files would result in durable privileged execution. ### Attack Path 1. A user or agent invokes the documented automatic installation with root privileges. 2. The installation process generates an unreviewed program under `/opt/lobster-agent`. 3. It creates a systemd unit under `/etc/systemd/system`. 4. The unit is enabled and started. 5. The generated code runs continuously and starts again after reboot. 6. If the generated program, its dependencies ...[truncated 529 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Include the complete installer, agent source, management command, and systemd unit in the package so they can be audited. - Require explicit user confirmation before creating or enabling a persistent service. - Run the service as a dedicated, unprivileged account rather than root. - Apply systemd hardening directives such as `NoNewPrivileges=true`, `ProtectSystem=strict`, `ProtectHome=true`, `PrivateTmp=true`, and a restricted `CapabilityBoundingSet`. - Make runtime code and service definitions root-owned and non-writable by the service account. - Limit writable paths to a dedicated state or log directory. - Present all planned filesystem and service changes before installation. - Provide a complete uninstall procedure that removes the service, executable, configuration, and residual state. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:24
Finding: Unauditable Privileged Automatic Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 24–35 **Vulnerability Type**: Underspecified generation and execution of privileged code **Risk Level**: High ### Evidence English translation of the relevant instructions: ```text Run the built-in installation script directly to complete a fully automated installation: # Automatically execute the installation process (triggered by OpenClaw) The installation process automatically performs: - Environment checks and dependency installation - Working-directory creation - Agent main-program generation - Automatic node registration - Configuration-file generation - Management-command creation - systemd service creation and startup ``` No installer, generated agent source, management script, or service definition exists in the audited project. The project contains only `SKILL.md`. ### Technical Analysis The Skill requests an automatic root-level installation but does not provide the alleged built-in installer or the files that it will generate. As a result, the actual commands, filesystem permissions, service account, network requests, telemetry payloads, configuration handling, and uninstall behavior cannot be verified. An agent interpreting these instructions would need to synthesize missing privileged implementation details. This creates a dangerous ambiguity: generated commands could differ between runs and may introduce command injection, excessive privileges, unsafe permissions, or behavior beyond the documented monitoring purpose. ### Attack Path 1. OpenClaw loads the Skill and interprets the request to perform a fully automatic installation. 2. Because the referenced installer is absent, the agent generates or otherwise obtains missing installation logic. 3. The generated logic is executed with root privileges. 4. It creates executable files, configuration, a global command, and a persistent service. 5. Any unsafe generated command, attacker-controlled configuration value, or co ...[truncated 572 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Include every referenced installation and runtime file in the project. - Avoid asking the agent to invent privileged installation commands. - Use a deterministic installer with strict error handling and documented, reviewable operations. - Validate and safely quote every externally supplied value. - Display an installation plan and require confirmation before package installation, filesystem modification, node registration, or service creation. - Define exact owners and permissions for every created file and directory. - Add integrity verification, tests, and rollback behavior. - Document all outbound requests and the exact fields transmitted. ]]>

T08 · Insecure Dependencies

Warning

Location: SKILL.md:29
Finding: Unpinned Third-Party Dependencies in a Privileged Persistent Agent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 29 **Vulnerability Type**: Unpinned dependency installation **Risk Level**: Medium ### Evidence English translation of the relevant instruction: ```text - Environment checks and dependency installation (requests, psutil) ``` No versions, hashes, lock file, package index restriction, or isolated environment are specified. ### Technical Analysis The installation process is expected to install `requests` and `psutil` without pinning exact versions or verifying package hashes. Dependency resolution can therefore change over time and is not reproducible. Because these dependencies would be imported by a persistent monitoring process installed using root privileges, a compromised package source, malicious package substitution, or unexpectedly vulnerable future release could execute code in the service context. The file does not explicitly use typo-squatted names, and no compromised package is confirmed; the issue is the absence of supply-chain controls. ### Attack Path 1. The privileged installer requests `requests` and `psutil` without exact versions or hashes. 2. The package manager resolves packages from an unspecified index. 3. A compromised index, altered package release, or unsafe resolver configuration supplies malicious code. 4. The monitoring agent imports the installed package. 5. Package initialization code executes with the privileges assigned to the persistent service. 6. The malicious dependency continues to execute whenever the service starts. ### Impact Assessment Impact depends on the service account. If the generated service runs as root, a compromised dependency could obtain full host privileges and persistent execution. With an unprivileged service account, it could still access all monitoring data, configuration available to the service, network credentials, and permitted outbound API access. ]]>
Remediation: <![CDATA[ ## Remediation Suggestions - Pin exact dependency versions in a lock file. - Require cryptographic hashes for all downloaded distributions. - Restrict installation to a trusted package index. - Use a dedicated virtual environment rather than modifying the system Python environment. - Build and verify dependencies before privileged deployment. - Run package installation in a controlled build stage, not directly as root on the target host. - Perform software-composition analysis and regularly review pinned versions for known vulnerabilities. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:60
Finding: API Credential Stored in a Plaintext Configuration File Without Defined Access Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 60–65 **Vulnerability Type**: Insecure secret storage **Risk Level**: Medium ### Evidence English translation of the configuration example: ```json { "node_id": "Automatically generated node ID", "api_key": "Coze API key", "coze_base_url": "Coze API address", "dataset_ids": { "nodes": "Node-information dataset ID" } } ``` The configuration is documented as being stored at: ```text /opt/lobster-agent/config.json ``` No file ownership, permission, encryption, redaction, rotation, or secret-management requirements are documented. ### Technical Analysis The proposed design places an API credential directly in a JSON configuration file. Plaintext configuration storage is not inherently exploitable when strict filesystem permissions are applied, but the Skill does not specify any such controls. The missing installer also prevents verification of whether the file is created with a restrictive mode. Default process permissions could make the credential readable by unintended local users. The credential could additionally be exposed through backups, support bundles, logs, or accidental configuration disclosure. ### Attack Path 1. The installer writes the Coze API key to `/opt/lobster-agent/config.json`. 2. The file is created with default or otherwise insufficiently restrictive permissions. 3. A local user, compromised process, backup reader, or diagnostic tool accesses the file. 4. The API key is extracted. 5. The attacker reuses the credential against the configured Coze API. 6. Available actions depend on the permissions assigned to that API key. ### Impact Assessment A successful disclosure could grant unauthorized access to Coze resources available to the key, including monitoring datasets or reporting endpoints. The attacker might read, submit, modify, or corrupt monitoring information if allowed by the credential's scope. Host-level privilege escalation is not establ ...[truncated 32 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Store the API key using a dedicated secret-management mechanism or systemd credentials. - If a file must be used, create it atomically with mode `0600` and root or dedicated-service ownership. - Ensure the service account can read the secret but cannot modify unrelated runtime code. - Never print the API key in logs, status output, exception messages, or uninstall diagnostics. - Use a narrowly scoped credential with only the permissions required for telemetry submission. - Support key rotation and immediate revocation. - Exclude the configuration from backups and support bundles unless encrypted. - Document exact file permissions and verify them during startup. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The overview states that heartbeats, monitoring data, alerts, and node registration are automatically reported to the Coze platform, but it does not frame this as a clear data egress/privacy warning. Users may unknowingly expose infrastructure metadata, operational status, and potentially sensitive system characteristics to a remote service, which is especially concerning in production or regulated environments.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs users to run an automated installer requiring root and then describes creation of a systemd service that auto-starts at boot and auto-restarts on failure, but it does not present this as a prominent security warning before installation. That omission can cause users to grant high privileges and persistence without informed consent, increasing the risk of unauthorized long-lived execution if the agent is misconfigured, compromised, or more capable than expected.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: The natural-language instructions and descriptions in the skill are entirely Chinese, and the file does not indicate that the user can choose another language or that the skill is intentionally restricted to a Chinese-language audience. This can violate language/locale policy when a skill implicitly forces one language without opt-in or justification.

Static analysis

No suspicious patterns detected.