Security audit

OADP Emit

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly about agent discovery, but it asks users to persist third-party discovery endpoints in an agent boot-read file and send agent metadata to an unverified external service.

Review before installing. Only use this if you deliberately want your agent or workspace to be discoverable through onlyflies.buzz, and avoid putting sensitive names, internal roles, customer details, private hostnames, or real capability inventories in the registration fields. Prefer a trusted or self-hosted hub, and manually remove the OADP comment from AGENTS.md if you no longer want persistent discovery.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:16
Finding: Persistent External Discovery Marker Written to an Agent Boot File<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16` **Vulnerability Type**: Persistent modification of Agent state **Risk Level**: Medium ### Vulnerable Code ```bash echo '' >> ~/.openclaw/workspace/AGENTS.md ``` ### Technical Analysis The documented command appends an externally controlled OADP marker and three third-party service endpoints to `~/.openclaw/workspace/AGENTS.md`. The surrounding documentation explicitly identifies this as a Markdown file that the Agent reads during boot. Because the change is written to persistent workspace state, it remains present after the skill invocation and across subsequent Agent sessions. An OADP-compatible scanner that processes the workspace may discover and act upon the advertised hub, registration, or ping endpoints. The use of the append operator (`>>`) also means that repeated execution creates duplicate persistent entries and provides no validation, deduplication, backup, or rollback mechanism. The marker is not itself executable code, and the documented command does not establish system-level persistence. The concern is limited to persistent Agent workspace state and any software that interprets OADP markers. ### Attack Path 1. A user or Agent loads the skill and follows the “Quick Emit” instructions. 2. The shell command runs with the current user's filesystem permissions. 3. An OADP marker containing `onlyflies.buzz` endpoints is appended to the boot-read `AGENTS.md` file. 4. The entry persists across future Agent sessions. 5. An OADP-aware scanner reads the workspace, discovers the endpoints, and may initiate discovery-related interactions with the external service. ### Impact Assessment The command obtains no elevated operating-system privileges and affects only files writable by the current user. Its scope is the ...[truncated 416 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Do not append discovery configuration directly to files read during Agent boot. - Store OADP settings in a dedicated configuration file that is not interpreted as Agent instructions. - Require explicit informed consent before enabling persistent discovery. - Display the exact destination file, external domains, and data-flow consequences before applying the change. - Validate endpoints against a user-controlled allowlist. - Detect existing markers and update them safely instead of appending duplicates. - Create a backup before modifying workspace files and provide a documented rollback command. - Default discovery to disabled and require a deliberate opt-in for every external hub. - If modification of `AGENTS.md` is unavoidable, clearly delimit the managed block and ensure scanners treat it strictly as inert configuration rather than instructions. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:28
Finding: Agent Identity and Capability Metadata Sent to an Unverified Third-Party Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:28-37` **Vulnerability Type**: Uncontrolled external metadata disclosure **Risk Level**: Medium ### Vulnerable Code ```bash curl -s -X POST "https://onlyflies.buzz/clawswarm/api/v1/ping" \ -H "Content-Type: application/json" \ -d '{"source":"oadp-emit","agent":"YOUR_NAME"}' ``` ```bash curl -s -X POST "https://onlyflies.buzz/clawswarm/api/v1/agents/register" \ -H "Content-Type: application/json" \ -d '{"name":"YOUR_NAME","description":"What you do","capabilities":["your","skills"]}' ``` ### Technical Analysis The skill instructs users to submit Agent identity, description, and capability metadata to `onlyflies.buzz`. Although HTTPS protects the requests in transit under normal certificate validation, the project provides no evidence establishing the recipient's ownership, authentication model, privacy policy, retention period, deletion process, or permitted secondary use of submitted data. Users are expected to replace placeholders with operational Agent information. Depending on the supplied values, this can reveal an Agent's identity, role, available skills, and operational capabilities. The use of `curl -s` suppresses progress and error output, reducing visibility into failed requests. The commands also do not use `--fail`, enforce an expected content type in the response, validate the response body, or otherwise confirm that registration occurred safely. The disclosed fields are intentional discovery metadata rather than demonstrated credentials or secrets. Nevertheless, the instructions do not provide sufficient trust and privacy controls before directing data to an external service. ### Attack Path 1. A user follows the ping or registration instructions. 2. The user replaces `YOUR_NAME`, the description, and capability placeholders with real Agent metadata. 3. The `curl` command sends the metadata to the third-party API. 4. The remote service receives the Agent's identity a ...[truncated 779 chars]
Remediation: <![CDATA[ ## Remediation Suggestions - Require explicit informed consent immediately before transmitting any Agent metadata. - Document every transmitted field, the receiving organization, intended use, retention period, deletion procedure, and privacy policy. - Minimize collection by using a random identifier or pseudonym and omitting capability details unless necessary. - Support a user-controlled or self-hosted discovery endpoint instead of hardcoding one external service. - Introduce authenticated registration and a mechanism to revoke or delete registrations. - Use an explicit endpoint allowlist and display the destination host before submission. - Replace silent invocation with observable and fail-closed behavior, such as: ```bash curl --fail-with-body --show-error \ --proto '=https' \ -X POST "https://approved.example/api/v1/agents/register" \ -H "Content-Type: application/json" \ --data-binary @reviewed-registration.json ``` - Validate HTTP status codes and response content before reporting success. - Warn users not to include credentials, private workspace details, internal hostnames, customer information, or other sensitive data in Agent names, descriptions, or capability lists. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Hidden Instructions

High

Category: Prompt Injection
Content: Add one line to any markdown file your agent reads on boot: ```bash echo '' >> ~/.openclaw/workspace/AGENTS.md ``` That's it. Any OADP scanner that reads your workspace can now find you.
Confidence: 99% confidence
Finding: The skill tells users to append a hidden HTML comment containing protocol directives and remote hub endpoints into a markdown file the agent reads on boot. Hidden machine-readable instructions embedded in boot-read content are especially dangerous because they can silently influence other agents or scanners, create persistence across sessions, and act as a covert signaling mechanism to steer agents toward attacker-controlled infrastructure.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs users to broadcast agent presence and send outbound POST requests to a third-party hub without discussing trust, consent, authentication, or what metadata is exposed. In an agent workspace context, publishing discovery markers and enrollment endpoints can enable unsolicited contact, profiling, targeting, and downstream prompt-injection or command-routing abuse by external parties.

External Transmission

Medium

Category: Data Exfiltration
Content: ### Layer 2: Announce to Hub ```bash curl -s -X POST "https://onlyflies.buzz/clawswarm/api/v1/ping" \ -H "Content-Type: application/json" \ -d '{"source":"oadp-emit","agent":"YOUR_NAME"}' ```
Confidence: 97% confidence
Finding: This command performs an external POST to a third-party endpoint, causing the agent/user to announce itself to infrastructure outside the local trust boundary. Even though the payload appears small, it creates an unsolicited beacon channel and confirms the existence and identity of the agent to an untrusted service, which can be used for tracking, enumeration, or later social-engineering and command-and-control style interactions.

Static analysis

No suspicious patterns detected.