Security audit

OADP Emit

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly about agent discovery, but it asks users to persist third-party discovery endpoints in an agent boot-read file and send agent metadata to an unverified external service.

Review before installing. Only use this if you deliberately want your agent or workspace to be discoverable through onlyflies.buzz, and avoid putting sensitive names, internal roles, customer details, private hostnames, or real capability inventories in the registration fields. Prefer a trusted or self-hosted hub, and manually remove the OADP comment from AGENTS.md if you no longer want persistent discovery.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:16
Finding: Persistent External Discovery Marker Written to an Agent Boot File
Content: View full analysis
' >> ~/.openclaw/workspace/AGENTS.md ``` ### Technical Analysis The documented command appends an externally controlled OADP marker and three third-party service endpoints to `~/.openclaw/workspace/AGENTS.md`. The surrounding documentation explicitly identifies this as a Markdown file that the Agent reads during boot. Because the change is written to persistent workspace state, it remains present after the skill invocation and across subsequent Agent sessions. An OADP-compatible scanner that processes the workspace may discover and act upon the advertised hub, registration, or ping endpoints. The use of the append operator (`>>`) also means that repeated execution creates duplicate persistent entries and provides no validation, deduplication, backup, or rollback mechanism. The marker is not itself executable code, and the documented command does not establish system-level persistence. The concern is limited to persistent Agent workspace state and any software that interprets OADP markers. ### Attack Path 1. A user or Agent loads the skill and follows the “Quick Emit” instructions. 2. The shell command runs with the current user's filesystem permissions. 3. An OADP marker containing `onlyflies.buzz` endpoints is appended to the boot-read `AGENTS.md` file. 4. The entry persists across future Agent sessions. 5. An OADP-aware scanner reads the workspace, discovers the endpoints, and may initiate discovery-related interactions with the external service. ### Impact Assessment The command obtains no elevated operating-system privileges and affects only files writable by the current user. Its scope is the ...[truncated 416 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:28
Finding: Agent Identity and Capability Metadata Sent to an Unverified Third-Party Service
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Hidden Instructions

High

Category: Prompt Injection
Confidence: 99% confidence
Finding: The skill tells users to append a hidden HTML comment containing protocol directives and remote hub endpoints into a markdown file the agent reads on boot. Hidden machine-readable instructions embedded in boot-read content are especially dangerous because they can silently influence other agents or scanners, create persistence across sessions, and act as a covert signaling mechanism to steer agents toward attacker-controlled infrastructure.
Content: Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.
Add one line to any markdown file your agent reads on boot:

bash
echo '' >> ~/.openclaw/workspace/AGENTS.md

That's it. Any OADP scanner that reads your workspace can now find you.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs users to broadcast agent presence and send outbound POST requests to a third-party hub without discussing trust, consent, authentication, or what metadata is exposed. In an agent workspace context, publishing discovery markers and enrollment endpoints can enable unsolicited contact, profiling, targeting, and downstream prompt-injection or command-routing abuse by external parties.
Content: No source excerpt is available for this finding.

External Transmission