Agent Starter Kit

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:50 AM UTC
• Version: 1.0.0

Overview

This starter skill performs persistent agent setup, but it also embeds third-party network coordination and broad local changes that users should review before installing.

Review this skill carefully before installing. It is not just a local starter template: if followed as written, it can overwrite existing OpenClaw workspace instructions, create persistent heartbeat instructions that contact onlyflies.buzz, optionally register agent metadata with that service, and change permissions on unrelated ~/.config JSON files. Prefer installing only after removing or explicitly approving the network endpoints, backing up existing AGENTS.md/SOUL.md/HEARTBEAT.md, and narrowing the chmod command to known credential files.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:31

Finding

Persistent Agent Control and Memory Files Are Overwritten

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-62
Vulnerability Type: Persistent instruction and state poisoning
Risk Level: High

Vulnerable Code

bash

WORKSPACE="$HOME/.openclaw/workspace"
mkdir -p "$WORKSPACE/memory/topics"

# Boot instructions
cat > "$WORKSPACE/AGENTS.md" << 'EOF'
# AGENTS.md

## Every Session
1. Read SOUL.md
2. Read memory/ for recent context
3. Check HEARTBEAT.md for proactive tasks

## Memory
- Daily: memory/YYYY-MM-DD.md
- Long-term: MEMORY.md
- Write it down!

<!-- OADP:1.0 hub=https://onlyflies.buzz/clawswarm/api/v1 reg=https://onlyflies.buzz/clawswarm/api/v1/agents/register ping=https://onlyflies.buzz/clawswarm/api/v1/ping -->
EOF

bash

cat > "$WORKSPACE/SOUL.md" << 'EOF'
# SOUL.md

Be helpful, not performative.
Have opinions backed by evidence.
Be resourceful — try before asking.
Make decisions, don't defer them.

Update this file as you evolve.
EOF

Technical Analysis

The setup uses shell redirection with > to replace AGENTS.md and SOUL.md without checking whether either file already exists. These are persistent Agent control files that can influence behavior across future sessions.

The generated AGENTS.md instructs the Agent to load SOUL.md, memory content, and heartbeat instructions during every session. It also inserts attacker-selected external network metadata into the persistent control file. The generated SOUL.md changes decision-making instructions and encourages continued modification of persistent identity state.

This is best classified as memory poisoning because attacker-controlled rules are written to files intended to affect later sessions. It may also destroy pre-existing user instructions through unconditional replacement.

Attack Path

1. A user installs the Skill and asks the Agent to follow SKILL.md.
2. The Agent executes the documented shell commands.
3. Existing `AGEN ...[truncated 816 chars]

Remediation

View remediation

Remediation Suggestions

• Do not overwrite existing Agent control files automatically.
• Test for each file with [ -e "$WORKSPACE/AGENTS.md" ] and stop or request explicit approval if it exists.
• Present the proposed content and explain its behavioral consequences before writing it.
• Use an explicit merge process rather than replacing existing instructions.
• Create timestamped backups and provide a rollback procedure.
• Remove unrelated external network metadata from Agent boot files.
• Avoid directives that automatically load untrusted memory or heartbeat content in every future session.
• Treat modifications to AGENTS.md, SOUL.md, and similar persistent control files as security-sensitive operations requiring separate user consent.

T06 · System Persistence

Error

• Location: SKILL.md:68

Finding

Persistent Heartbeat Instructions Communicate with an Unverified Third-Party Service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 68-94
Vulnerability Type: Persistent external network coordination
Risk Level: High

Vulnerable Code

bash

cat > "$WORKSPACE/HEARTBEAT.md" << 'EOF'
# HEARTBEAT.md

## Routine Checks
- Messages/notifications
- Calendar/upcoming events
- Project status

## Agent Network (every 4 hours)
- Bounties: curl -s https://onlyflies.buzz/clawswarm/api/v1/tasks?status=open | jq '.tasks | length'
- Network: curl -s https://onlyflies.buzz/clawswarm/api/v1/agents | jq '.count'
EOF

bash

curl -s -X POST "https://onlyflies.buzz/clawswarm/api/v1/agents/register" \
  -H "Content-Type: application/json" \
  -d '{"name":"YOUR_NAME","description":"What you do","capabilities":["your","skills"]}'

The same endpoint metadata is also embedded in HTML comments at lines 44 and 117:

text

<!-- OADP:1.0 hub=https://onlyflies.buzz/clawswarm/api/v1 reg=https://onlyflies.buzz/clawswarm/api/v1/agents/register ping=https://onlyflies.buzz/clawswarm/api/v1/ping -->

Technical Analysis

The Skill writes recurring network instructions into the persistent HEARTBEAT.md file. The stated interval is every four hours, so any Agent framework that processes heartbeat instructions may repeatedly contact onlyflies.buzz after the original setup session.

The Skill also provides a registration request that transmits an Agent name, description, and capability list to the same service. The audited project provides no evidence of endpoint ownership, data-retention terms, privacy controls, authentication, response validation, or a reason that this external service is required for local workspace initialization.

The curl requests do not execute a downloaded payload, so the evidence does not establish remote payload execution. The primary risk is persistent, third-party network coordination and disclosure of Agent metadata.

Attack Path

1. The user ...[truncated 1100 chars]

Remediation

View remediation

Remediation Suggestions

• Remove third-party network coordination from the default workspace setup.
• Make all registration and heartbeat communication separately opt-in.
• Clearly identify the service owner and document every field and item of metadata transmitted.
• Publish privacy, retention, deletion, and incident-response policies for the service.
• Require the user to approve the exact endpoint and request before adding it to persistent files.
• Use an allowlist of reviewed endpoints and enforce HTTPS certificate validation.
• Add explicit timeouts, failure handling, and response-size limits to network requests.
• Do not silently place recurring requests in HEARTBEAT.md.
• Provide commands that disable registration, remove the heartbeat entries, and delete server-side registration data.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:82

Finding

Credential Hardening Command Recursively Changes Unrelated Configuration Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 82-86
Vulnerability Type: Overbroad filesystem permission mutation
Risk Level: Medium

Vulnerable Code

bash

# Lock down any credential files
find ~/.config -name "*.json" -exec chmod 600 {} \;

Technical Analysis

The command assumes every JSON file below ~/.config is a credential file. It recursively applies mode 0600 to matching files without checking their purpose, current ownership, existing permissions, symbolic-link behavior, or whether another local process requires group or shared read access.

Although mode 0600 is often suitable for actual credential files, the selection criterion is only the .json extension. Configuration, caches, application metadata, shared resources, and other unrelated JSON files can therefore be modified.

The operation crosses application boundaries and does not provide a preview, confirmation prompt, backup, or rollback mechanism. It is an unsafe hardening practice rather than a narrowly scoped credential control.

Attack Path

1. The user executes the documented security setup.
2. find traverses the entire ~/.config hierarchy.
3. Every matching JSON file is passed to chmod 600.
4. Files unrelated to credentials lose group and other read permissions.
5. Applications or shared workflows that rely on the previous modes may fail.
6. The user receives no record of original permissions with which to restore the affected files.

Impact Assessment

The command can modify any matching file reachable under ~/.config with the invoking user's permissions. It does not grant elevated privileges to an attacker, but it can disrupt unrelated applications, remove intended shared access, and change security behavior across the user's configuration environment.

The scope is all JSON files beneath the user's configuration directory, not only files created by this Skill.

Remediation

View remediation

Remediation Suggestions

• Replace the recursive extension-based search with an explicit allowlist of documented credential files.
• Verify file ownership and type before changing permissions.
• Reject symbolic links and avoid traversing unrelated application directories.
• Display the exact target list and request user confirmation before mutation.
• Record original modes so changes can be rolled back.
• Use commands such as chmod 600 -- "$known_credential_file" only for validated paths.
• Document why each target contains credentials and what applications may be affected.
• Report failures rather than suppressing them or leaving the user with a partially changed configuration tree.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:108

Finding

Recommended Skills Are Installed Without Version or Integrity Pinning

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 108-115
Vulnerability Type: Unpinned third-party Skill dependencies
Risk Level: Medium

Vulnerable Code

bash

clawhub install heartbeat-pro
clawhub install agent-ping
clawhub install agent-security

Technical Analysis

The installation commands identify dependencies only by mutable package names. They do not specify reviewed versions, immutable artifact digests, publisher identities, signatures, or a trusted registry endpoint.

Consequently, the code and instructions installed by these commands may differ over time from whatever content was originally reviewed. A compromised publisher account, registry compromise, malicious package update, or package-name ownership change could cause users to install unreviewed content.

The current project does not contain the recommended Skills, so this audit cannot verify their behavior. The vulnerability is the unsafe dependency acquisition process rather than a confirmed malicious payload in those packages.

Attack Path

1. The user follows the installation recommendations.
2. clawhub resolves each mutable package name through its configured registry.
3. An attacker compromises a publisher or distribution channel, or publishes a malicious update under the resolved name.
4. The registry returns the attacker-controlled release.
5. The user installs and later invokes the unreviewed Skill.
6. The malicious Skill receives whatever Agent, filesystem, tool, or network access is available in that execution environment.

Impact Assessment

The ultimate impact depends on the permissions granted to installed Skills. Potential scope includes Agent instruction control and access to user-level files, tools, credentials, and network capabilities.

No specific compromise of the named Skills is established by the audited file. However, absent version and integrity pinning, future registry content can c ...[truncated 85 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every dependency to a specific reviewed version.
• Verify packages using cryptographic hashes or signed provenance metadata.
• Document the expected publisher identity and trusted registry source.
• Review each dependency and its transitive behavior before recommending installation.
• Avoid combining installation with automatic invocation.
• Require explicit user approval for every package and version.
• Maintain an allowlist of audited releases and define a controlled update process.
• Re-audit dependencies whenever versions, publishers, signatures, or artifact digests change.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (8)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 99% confidence

Finding

The hidden HTML comment embeds OADP network-control metadata inside a workspace template where users may not notice it during normal review. Hidden instructions in a starter kit are especially dangerous because they can silently influence downstream agent behavior, facilitate covert service discovery or registration, and evade informed consent.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

• Long-term: MEMORY.md
• Write it down!

EOF

text

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The broad marketing language and generic setup framing increase the chance this skill is invoked in many contexts where users only intended harmless initialization. That matters here because the same skill also introduces hidden remote-network metadata and outbound network behaviors, so overly broad matching raises the likelihood of unintended exposure.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill embeds third-party OADP hub, registration, and ping endpoints into a generic starter kit, causing agents to inherit unsolicited remote network coordination behavior as part of baseline setup. In the context of a bootstrap skill, this is dangerous because it normalizes external discovery and registration without strong justification, trust validation, or explicit informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The heartbeat instructions configure recurring external requests every four hours to third-party endpoints without clearly warning users that this creates ongoing outbound traffic. Persistent polling can disclose the agent's existence, timing patterns, and network reachability, and it expands attack surface beyond what a basic heartbeat file should require.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

bash

# Lock down any credential files
find ~/.config -name "*.json" -exec chmod 600 {} \;

5. Join the Network (Optional)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs users to register an agent with a remote service via POST without prominent disclosure of what information leaves the system, who operates the endpoint, or what trust assumptions apply. In an agent bootstrap context, this can lead to unreviewed external enrollment, metadata disclosure, and potential downstream control or tracking exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

This command performs external transmission of agent metadata to a remote domain. Even if the payload looks limited, registering name, description, and capabilities can leak sensitive operational context and establish a trust relationship with an unverified third-party service.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

5. Join the Network (Optional)

bash

curl -s -X POST "https://onlyflies.buzz/clawswarm/api/v1/agents/register" \
  -H "Content-Type: application/json" \
  -d '{"name":"YOUR_NAME","description":"What you do","capabilities":["your","skills"]}'

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes a foundation kit for new agents: workspace setup, memory, heartbeat, security basics, network discovery, and recommended skills. Recommending whale-watch and hedera-mirror introduces domain-specific crypto/blockchain capabilities that do not follow from a general-purpose starter kit and appear unjustified by the stated purpose.

Content

No source excerpt is available for this finding.