ClawBot Network

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:21 PM UTC
• Version: 1.0.0

Overview

The skill’s collaboration goal is coherent, but its default setup relies on plaintext remote code downloads, unauthenticated agent APIs, and a hard-coded external server path that users should review carefully before installing.

Install only in a trusted test environment unless you first replace HTTP/ws with HTTPS/wss, remove curl-to-bash setup, verify all downloaded code, configure your own trusted server, add authentication/authorization for every agent and API call, and avoid letting remote tasks automatically trigger OpenClaw execution without human approval.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:55
• Finding: Documentation Executes Mutable Remote Scripts over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:55-59`; `references/QUICKSTART.md:7-22`; `assets/install-clawbot.sh:1-5` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code `SKILL.md:55-59`: ```bash **Option A: One-line install (MacBook/Mac Mini)** ```bash curl -fsSL http://YOUR-VPS:3001/install-clawbot.sh | bash ``` ``` `references/QUICKSTART.md:7-22`: ```bash ### MacBook users ```bash curl -fsSL http://3.148.174.81:3001/setup.sh | bash -s -- xiaoxing-macbook "小邢" "DevOps" cd agent-network-client && ./start.sh ``` ### Mac Mini users ```bash curl -fsSL http://3.148.174.81:3001/setup.sh | bash -s -- xiaojin-macmini "小金" "金融市场分析" cd agent-network-client && ./start.sh ``` ### Mac Mini 2 users ```bash curl -fsSL http://3.148.174.81:3001/setup.sh | bash -s -- xiaochen-macmini "小陈" "美股交易" cd agent-network-client && ./start.sh ``` ``` `assets/install-clawbot.sh:1-5`: ```bash #!/bin/bash # ClawBot Network Connector - Quick Setup # Let clawdbot instances on any device connect quickly to Agent Network # # Usage: curl -fsSL http://3.148.174.81:3001/install-clawbot.sh | bash ``` ### Technical Analysis The installation instructions stream a response from an external HTTP endpoint directly into Bash. The response is not protected by TLS, pinned to an immutable version, checked against a cryptographic digest, or authenticated with a digital signature. Consequently, the code actually executed can differ from the code reviewed in this project. The referenced `setup.sh` is not included in the audited artifact, so its effective behavior cannot be inspected or constrained. The hard-coded bare IP address does not provide a meaningful source identity, and plaintext HTTP permits both server-side payload replacement and on-path response modification. This behavior is not necessary for the declared collaboration functionality. A reviewed local installer, a signed release archive, or explicit download a ...[truncated 1111 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove every `curl | bash` and equivalent streamed-execution instruction. 2. Include the reviewed installer and client code directly in the Skill package, or distribute immutable, versioned release artifacts. 3. Require users to download the artifact to disk before execution. 4. Publish artifacts only over HTTPS with certificate verification. 5. Publish a SHA-256 or stronger digest through a separately authenticated channel and verify it before execution. 6. Prefer signed releases and verify the publisher’s signature against a pinned public key. 7. Provide an inspection step before execution and do not automatically start downloaded software. 8. Remove the unaudited `setup.sh` workflow unless that file is added to the reviewed package. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: assets/install-clawbot.sh:39
• Finding: Installer Downloads and Executes Unverified Python Payloads<![CDATA[ ## Vulnerability Details **File Location**: `assets/install-clawbot.sh:39-45`, `assets/install-clawbot.sh:53-72`, and `assets/install-clawbot.sh:156-161` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code `assets/install-clawbot.sh:39-45`: ```bash echo "📦 下载组件..." # 下载 Python 客户端 curl -fsSL "${SERVER_HTTP}/client/python_client.py" -o python_client.py # 下载 clawdbot 连接器 curl -fsSL "${SERVER_HTTP}/clawbot_connector.py" -o clawbot_connector.py ``` `assets/install-clawbot.sh:53-72`: ```bash cat > start.sh <<EOF #!/bin/bash cd "$(dirname "$0")" # 自动检测 bot 名称 if [ -f "${HOME}/.openclaw/workspace-clawdbot/SOUL.md" ]; then BOT_NAME=$(grep -i "name:" "${HOME}/.openclaw/workspace-clawdbot/SOUL.md" | head -1 | cut -d':' -f2 | tr -d ' ' || echo "") fi if [ -z "\$BOT_NAME" ]; then BOT_NAME="\${CLAWBOT_NAME:-ClawBot@${DEVICE_NAME}}" fi echo "🤖 启动 ClawBot Network Connector" echo " Bot: \$BOT_NAME" echo " Device: ${DEVICE_TYPE}" echo "" python3 clawbot_connector.py EOF chmod +x start.sh ``` `assets/install-clawbot.sh:156-161`: ```bash read -p "现在启动连接吗? (y/n) " -n 1 -r echo if [[ $REPLY =~ ^[Yy]$ ]]; then ./start.sh fi ``` ### Technical Analysis The installer downloads `python_client.py` and `clawbot_connector.py` from the mutable endpoint configured through `SERVER_HTTP`. Its default value is `http://3.148.174.81:3001`, which uses plaintext HTTP. Neither downloaded file is checked against a pinned digest or authenticated signature. The generated `start.sh` later runs `python3 clawbot_connector.py`. The installer also offers to invoke `start.sh` immediately. Therefore, reviewing the bundled installer does not establish the integrity of the code ultimately executed: the effective Python payload remains controlled by the remote server or anyone capable of modifying the HTTP response. The files are stored under `~/.clawbot-network`, creating a reusable execution path. Although this ...[truncated 1142 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Package the audited Python clients with the Skill instead of downloading runtime code. 2. If downloads are unavoidable, require HTTPS and validate certificates. 3. Pin each expected artifact to a cryptographic digest or signed release manifest. 4. Abort installation before writing or running files if verification fails. 5. Use versioned, immutable artifact URLs rather than mutable server paths. 6. Remove the immediate execution prompt for newly downloaded code. 7. Display the source, version, expected digest, destination, and permissions before installation. 8. Apply restrictive file permissions and avoid trusting an environment-selected server unless it is explicitly approved and authenticated. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/index.js:24
• Finding: Unauthenticated APIs Permit Agent Impersonation, Data Disclosure, and Task Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/index.js:24-26`, `scripts/index.js:42-104`, and `scripts/index.js:117-246` **Vulnerability Type**: Missing authentication and authorization **Risk Level**: High ### Vulnerable Code `scripts/index.js:24-26`: ```javascript const app = express(); app.use(cors()); app.use(express.json()); ``` `scripts/index.js:53-104`: ```javascript // Get all groups app.get('/api/groups', async (req, res) => { const groups = await db.getGroups(); res.json(groups); }); // Create group app.post('/api/groups', async (req, res) => { const { name, description, ownerId } = req.body; const group = await db.createGroup(name, description, ownerId); res.json(group); }); // Get group messages app.get('/api/groups/:id/messages', async (req, res) => { const messages = await db.getGroupMessages(req.params.id, 50); res.json(messages); }); // Get agent inbox app.get('/api/agents/:id/inbox', async (req, res) => { const inbox = await db.getAgentInbox(req.params.id); res.json(inbox); }); // Get tasks app.get('/api/tasks', async (req, res) => { const tasks = await db.getTasks(); res.json(tasks); }); // Create task app.post('/api/tasks', async (req, res) => { const task = await db.createTask(req.body); // Notify assignee if online const assigneeClient = clients.get(task.assigneeId); if (assigneeClient) { assigneeClient.ws.send(JSON.stringify({ type: 'task_assigned', task: task })); } res.json(task); }); ``` `scripts/index.js:127-156`: ```javascript case 'register': agentId = msg.agent.id; clients.set(agentId, { ws, info: msg.agent, groups: new Set(), joinedAt: new Date().toISOString() }); console.log(`✅ Agent registered: ${msg.agent.name} (${agentId})`); // Send confirmation ws.send(JSON.stringify({ type: 'registered', agentId: agentId, serverTime: new Date().toISOString() })); // Broadcast to all agents broadcastAg ...[truncated 2673 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require strong per-agent authentication for both REST and WebSocket connections. 2. Prefer mutually authenticated TLS or short-lived signed tokens bound to a specific agent ID. 3. Derive the effective agent identity from authenticated credentials; never trust a client-selected identity. 4. Reject duplicate identity registrations or define a secure, authenticated session-replacement procedure. 5. Authorize every group, inbox, message-history, direct-message, and task operation. 6. Ensure only the intended recipient can retrieve and acknowledge offline messages; do not delete them until authenticated delivery is confirmed. 7. Restrict CORS to explicitly trusted origins. 8. Add schema validation, request-size limits, rate limiting, audit logs, and abuse detection. 9. Require explicit human approval before an incoming network task can trigger agent tools or subprocesses. 10. Expose the service only through TLS and a restrictive firewall or private network. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/clawbot_connector.py:42
• Finding: Local Device Identity and Collaboration Data Are Disclosed over Plaintext Connections<![CDATA[ ## Vulnerability Details **File Location**: `scripts/clawbot_connector.py:42-56`, `scripts/clawbot_connector.py:65-107`, `scripts/clawbot_connector.py:115-139`, `scripts/clawbot_connector.py:269-278`; `scripts/python_client.py:48-52`, `scripts/python_client.py:98-116`, and `scripts/python_client.py:226-257` **Vulnerability Type**: Plaintext transmission and excessive automatic identity collection **Risk Level**: High ### Vulnerable Code `scripts/clawbot_connector.py:42-56`: ```python def __init__(self, server_url: str = "ws://3.148.174.81:3002", bot_id: Optional[str] = None, bot_name: Optional[str] = None, device_name: Optional[str] = None): """ Initialize connector Args: server_url: Agent Network server address bot_id: Unique clawdbot identifier bot_name: Display name device_name: Device name """ self.server_url = server_url self.bot_id = bot_id or self._generate_bot_id() self.bot_name = bot_name or self._detect_bot_name() self.device_name = device_name or self._detect_device() ``` `scripts/clawbot_connector.py:65-107`: ```python def _generate_bot_id(self) -> str: """Generate a unique bot ID""" import socket hostname = socket.gethostname().replace('.', '-') return f"clawdbot-{hostname}" def _detect_bot_name(self) -> str: """Detect bot name""" # Attempt to read the name from SOUL.md soul_path = os.path.expanduser('~/.openclaw/workspace-clawdbot/SOUL.md') if os.path.exists(soul_path): try: with open(soul_path) as f: content = f.read() import re match = re.search(r'(?:Name:|\*\*Name:\*\*)\s*(.+)', content) if match: return match.group(1).strip() except: pass import socket return f"ClawBot@{socket.gethostname()}" def _detect_device(self) -> str: """Detect device type ...[truncated 4232 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Default exclusively to `wss://` and `https://`, with normal certificate and hostname verification enabled. 2. Remove the hard-coded external IP and require explicit server configuration. 3. Refuse plaintext transport by default; permit it only through an explicit development-only option limited to localhost or a trusted private network. 4. Obtain informed user consent before reading `SOUL.md` or transmitting machine metadata. 5. Use a randomly generated pseudonymous agent ID instead of a hostname-derived stable identifier. 6. Make the bot name and device field optional and transmit only metadata required for the selected feature. 7. Authenticate the server and agents, and add application-level message signing where task integrity is important. 8. Avoid printing sensitive message content in logs unless explicitly enabled. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/package.json:10
• Finding: Unpinned Dependency Installation Prevents Reproducible and Verifiable Builds<![CDATA[ ## Vulnerability Details **File Location**: `scripts/package.json:10-21`; `SKILL.md:45-49`; `references/QUICKSTART.md:52-56` **Vulnerability Type**: Insecure dependency management **Risk Level**: Medium ### Vulnerable Code `scripts/package.json:10-21`: ```json "dependencies": { "ws": "^8.16.0", "express": "^4.18.2", "cors": "^2.8.5", "sqlite3": "^5.1.6", "uuid": "^9.0.1", "jsonwebtoken": "^9.0.2", "bcryptjs": "^2.4.3" }, "devDependencies": { "nodemon": "^3.0.3" } ``` `SKILL.md:45-49`: ```bash # Install and start the central server npm install npm start ``` `references/QUICKSTART.md:52-56`: ```bash # 3. 安装依赖 pip3 install websockets requests # 4. 运行（参考 test-laoxing.py 写法） python3 your_script.py ``` ### Technical Analysis The Node.js manifest permits dependency updates through caret ranges, and no lockfile was present in the audited directory structure. The Python installation command does not pin versions or hashes at all. As a result, two users installing the same reviewed project at different times may receive different dependency code. No specific malicious package, typosquatting package, or known vulnerable version was established by this static audit. The risk arises from non-reproducible dependency resolution and the inability to verify that installed artifacts match a reviewed dependency set. Package installation can also execute package lifecycle scripts, increasing the significance of supply-chain compromise. ### Attack Path 1. A user follows the installation instructions. 2. The package manager resolves the latest versions allowed by the ranges or unpinned names. 3. A permitted package version, transitive dependency, or package-distribution account is compromised. 4. The package manager installs the changed artifact because no reviewed lockfile and integrity baseline constrain resolution. 5. Malicious lifecycle or runtime code executes during installation or when the server/client starts. ### Impact Assessment A c ...[truncated 375 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Generate, review, and commit a package-manager lockfile. 2. Use deterministic installation such as `npm ci` in deployment and CI workflows. 3. Pin direct dependencies to exact reviewed versions and regularly review transitive changes. 4. Create a Python requirements file with exact versions and cryptographic hashes. 5. Install Python packages with hash enforcement, such as `pip install --require-hashes`. 6. Use trusted registries and enforce registry configuration in CI. 7. Run dependency vulnerability and provenance checks during builds. 8. Review package lifecycle scripts and consider disabling them where they are not required. 9. Perform dependency updates through controlled, reviewed pull requests. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (43)

External Script Fetching

High

• Category: Supply Chain

Content

**Option A: One-line install (MacBook/Mac Mini)**

```bash
curl -fsSL http://YOUR-VPS:3001/install-clawbot.sh | bash
```

Then start:

• Confidence: 99% confidence
• Finding: Fetching and executing a shell script directly from an external endpoint is a classic remote code execution pattern. Here it is especially dangerous because the example uses plain HTTP, so both server compromise and on-path tampering can replace the installer and fully compromise the target machine.

Chaining Abuse

High

• Category: Tool Misuse

Content

**Option A: One-line install (MacBook/Mac Mini)**

```bash
curl -fsSL http://YOUR-VPS:3001/install-clawbot.sh | bash
```

Then start:

• Confidence: 98% confidence
• Finding: Piping downloaded content directly into bash removes any opportunity for inspection and turns a network response into immediate execution. In this skill, which establishes cross-device agent connectivity, that pattern is particularly hazardous because a compromised installer can implant persistent remote-control functionality across multiple machines.

Chaining Abuse

High

• Category: Tool Misuse

Content

**Connection refused:**
- Check server is running: `curl http://your-vps:3001/api/health`
- Check firewall: `sudo ufw allow 3001/tcp && sudo ufw allow 3002/tcp`

**Messages not received:**
- Verify `bot_id` is unique per device

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

External Script Fetching

High

• Category: Supply Chain

Content

# ClawBot Network Connector - Quick Setup
# 让任何设备上的 clawdbot 快速接入 Agent Network
#
# 用法: curl -fsSL http://3.148.174.81:3001/install-clawbot.sh | bash

set -e

• Confidence: 99% confidence
• Finding: The advertised installation method instructs users to pipe a remotely hosted script directly into bash from an unauthenticated HTTP endpoint. This is dangerous because any compromise of the host, transit path, or DNS/network layer results in immediate arbitrary shell execution on the target machine with no opportunity for user review.

Chaining Abuse

High

• Category: Tool Misuse

Content

# ClawBot Network Connector - Quick Setup
# 让任何设备上的 clawdbot 快速接入 Agent Network
#
# 用法: curl -fsSL http://3.148.174.81:3001/install-clawbot.sh | bash

set -e

• Confidence: 99% confidence
• Finding: Using '| bash' executes whatever bytes are returned by the remote endpoint immediately, collapsing download, trust, and execution into one step. In the context of a networking skill that connects multiple agent instances, this is especially dangerous because it normalizes unsafe installation and could rapidly propagate malicious bootstrap code across several devices.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The installer fetches executable Python components from a remote server over plain HTTP and writes them into the user's environment without integrity verification or a clear upfront warning. This allows network attackers or a compromised server to replace the downloaded code with arbitrary malicious payloads, leading to code execution when the user later runs start.sh or imports the connector.

External Script Fetching

High

• Category: Supply Chain

Content

### MacBook 用户（小邢）
```bash
curl -fsSL http://3.148.174.81:3001/setup.sh | bash -s -- xiaoxing-macbook "小邢" "DevOps"
cd agent-network-client && ./start.sh
```

• Confidence: 99% confidence
• Finding: This command downloads a shell script from an external host and pipes it directly into bash, removing any opportunity for review and making execution dependent on the integrity of a remote HTTP endpoint. Because this skill is specifically designed to connect multiple agent instances across devices, compromise of the setup script could spread code execution across several systems in the operator's environment.

External Script Fetching

High

• Category: Supply Chain

Content

### Mac Mini 用户（小金）
```bash
curl -fsSL http://3.148.174.81:3001/setup.sh | bash -s -- xiaojin-macmini "小金" "金融市场分析"
cd agent-network-client && ./start.sh
```

• Confidence: 99% confidence
• Finding: This is the same unsafe remote-script execution pattern: code from an external server is piped straight into bash over unsecured HTTP. If the source or traffic is tampered with, the user's Mac Mini could execute arbitrary attacker-controlled commands immediately.

External Script Fetching

High

• Category: Supply Chain

Content

### Mac Mini 2 用户（小陈）
```bash
curl -fsSL http://3.148.174.81:3001/setup.sh | bash -s -- xiaochen-macmini "小陈" "美股交易"
cd agent-network-client && ./start.sh
```

• Confidence: 99% confidence
• Finding: This one-liner again creates an unauthenticated, unverified remote code execution path by piping a fetched script directly to bash over HTTP. In a distributed agent-collaboration skill, that is especially dangerous because it targets machines intended to trust and communicate with each other, increasing blast radius if one setup path is subverted.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

if system == "Darwin":
            # macOS - 检测是 MacBook 还是 Mac Mini
            try:
                result = os.popen("sysctl -n hw.model").read().strip()
                if "MacBook" in result:
                    return "MacBook"
                elif "Macmini" in result:

• Confidence: 85% confidence
• Finding: os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Exfiltration Commands

High

• Category: Prompt Injection

Content

}))
    
    async def send_message(self, group_id: str, content: str):
        """Send message to group"""
        if self.ws and self.connected:
            await self.ws.send(json.dumps({
                "type": "message",

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documents shell, network, and environment-capable operations but does not declare any explicit tool scope or permissions boundary. In a distributed-agent skill, this omission increases the chance that consumers will run commands or connect to remote services without clear sandboxing expectations or least-privilege controls.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill recommends a one-line installer that downloads and executes a remote shell script, but it does not provide a prominent warning that this runs arbitrary code from the server. Because the server is user-hosted and fetched over plain HTTP in the example, any compromise of the server or network path can immediately lead to code execution on the client machine.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The task-assignment examples normalize remote messages and tasks as inputs that can trigger execution-oriented actions on connected agents, yet no warning or approval requirement is described. In a multi-agent network, this creates a dangerous trust boundary where a spoofed, compromised, or misrouted message could induce automated command execution or downstream agent spawning.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

**Connection refused:**
- Check server is running: `curl http://your-vps:3001/api/health`
- Check firewall: `sudo ufw allow 3001/tcp && sudo ufw allow 3002/tcp`

**Messages not received:**
- Verify `bot_id` is unique per device

• Confidence: 79% confidence
• Finding: The troubleshooting guidance instructs use of sudo to open firewall ports, which can normalize privileged execution without clarifying scope or risk. In this context the commands are not inherently malicious, but they alter host network exposure and should be treated as security-sensitive administrative actions.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The script's descriptive comments and most runtime prompts are presented in Chinese, and there is no indication that the user can select another language. This creates a language/locale constraint without opt-in, which fits the policy's natural-language violation criteria.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The quickstart instructs users to fetch and immediately execute a shell script from a remote server over plain HTTP using curl-pipe-bash. This creates a direct remote code execution path where any compromise of the server, network path, or DNS could result in arbitrary commands running on the user's machine without inspection.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The manual installation steps tell users to download executable Python client code and configuration over plain HTTP without any integrity verification or trust warning. An attacker able to tamper with the server or traffic could deliver a trojanized client that the user then runs locally.

Session Persistence

Medium

• Category: Rogue Agent

Content

# 重启服务器
kill $(cat server.pid)
nohup node server/index.js > server.log 2>&1 &

# 查看状态
curl http://localhost:3001/api/health

• Confidence: 65% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The skill's stated purpose is to connect OpenClaw instances for messaging, mentions, task assignment, and group chat across devices. Invoking `os.popen("sysctl -n hw.model")` adds command-execution capability on the host, which is stronger than what is obviously required for a network connector and is not declared in the manifest description.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The connector automatically initiates a network connection to a hard-coded remote server and transmits bot identity, device information, and presence without any user consent, trust verification, or warning. In a distributed agent skill, this is especially dangerous because it creates an unvetted command-and-control channel through which external parties may message the bot, assign tasks, and potentially influence downstream agent behavior.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The clearOfflineMessages function performs a destructive DELETE operation on stored offline messages, but the code provides no confirmation prompt, user-visible log, or warning around this data removal. Because this removes persisted user/agent message data, it qualifies as a safety-relevant operation lacking disclosure in the code shown.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: This server stores group messages and offline direct/mention messages in the database and transmits message contents over WebSocket connections, but the file provides no user-facing disclosure, confirmation, or warning about retention and transmission of user data. Because these operations affect user privacy and data handling, they meet the missing-warning criterion for code files.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The usage example hardcodes Chinese display names and message content, which signals a specific language expectation in the skill's natural-language interface. Because the file does not offer an opt-in language choice or explain that the client is intended only for a Chinese-speaking environment, this is a locale policy concern.

External Transmission

Medium

• Category: Data Exfiltration

Content

def create_task(self, title: str, description: str, assignee_id: str, **kwargs) -> dict:
        """Create a task"""
        try:
            response = requests.post(f"{self.rest_url}/api/tasks", json={
                "title": title,
                "description": description,
                "assigneeId": assignee_id,

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.