ClawHub
Back to skill

Security audit

Agent Soul Sync

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but it should be reviewed because a configurable server URL can receive the user's Mysta API key and selected skill files without validation.

Install only if you intend to upload local SKILL.md files to Mysta. Before use, review selected skill files for secrets or private prompts, keep MYSTA_MCP_URL unset unless you intentionally use a trusted Mysta environment, and use a limited API key that you can revoke. Remember that synced skills persist remotely and same-name uploads overwrite the remote copy.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:67
Finding

Untrusted MCP Endpoint Override Can Exfiltrate API Credentials and Skill Contents

Content
View full analysis
/dev/null | grep -i "mcp-session-id" | tr -d '\r' | awk '{print $2}') ``` Selected local skill contents are also sent to the configured endpoint at lines 169–176: ```bash SKILL_CONTENT=$(cat "$SKILL_PATH") RESULT=$(curl -sf -X POST "${MCP_URL}" \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -H "Authorization: Bearer ${MYSTA_API_KEY}" \ -H "Mcp-Session-Id: ${MCP_SESSION}" \ -d "$(jq -n --arg name "$SKILL_NAME" --arg content "$SKILL_CONTENT" --arg agentId "$AGENT_ID" \ '{jsonrpc:"2.0",id:3,method:"tools/call",params:{name:"mysta_sync_skill",arguments:{agentId:$agentId,skillName:$name,content:$content}}}')") ``` ### Technical Analysis `MYSTA_MCP_URL` is accepted without validating its scheme, hostname, port, or destination. Every MCP request then sends `MYSTA_API_KEY` as a bearer credential to this endpoint. The override can therefore point to an arbitrary HTTP or HTTPS server rather than an approved Mysta service. Although control of an environment variable is required, inherited environment values can originate from shell profiles, wrappers, development containers, automation configuration, or an ...[truncated 1687 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md
find ~/.openclaw/skills ~/Workspace/openclaw/skills -maxdepth 2 -name "SKILL.md" -type f 2>/dev/null

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
API key setup (user consent required).
license: MIT
compatibility:
  - curl
  - jq
  - MYSTA_API_KEY
metadata:

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

: "${MYSTA_API_KEY:?Please set MYSTA_API_KEY environment variable}"

MCP server URL (defaults to staging, override with MYSTA_MCP_URL for other envs)

MCP_URL="${MYSTA_MCP_URL:-https://api.staging.mysta.tech/api/v2/mcp}"

text

## MCP Protocol

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

Then send the initialized notification:

bash
curl -sf -X POST "${MCP_URL}" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer ${MYSTA_API_KEY}" \
  -H "Mcp-Session-Id: ${MCP_SESSION}" \

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md
Parse the response to find agent IDs and names.

- If **no agents** found, tell the user to create one at https://app.staging.mysta.tech
- If **one agent**, auto-select it
- If **multiple**, ask which one to sync to

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

This code uploads the full contents of local SKILL.md files to a remote service. That is the core function of the skill, but it creates a real data exfiltration risk if local skill files contain secrets, internal prompts, credentials, or other sensitive information, especially because batch upload can send many files at once.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

md
jq -n --arg name "$name" --arg content "$content" '{name:$name,content:$content}'
done | jq -s '.')

RESULT=$(curl -sf -X POST "${MCP_URL}" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Authorization: Bearer ${MYSTA_API_KEY}" \

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical
Code
suspicious.generated_source_template_injection
Location
SKILL.md:83