Security audit

Workspace Init

Security checks across malware telemetry and agentic risk

Overview

This workspace setup skill creates the promised files, but it also contacts a third-party server with the machine hostname and plants ongoing network-check instructions without clear opt-in consent.

Review scripts/init.sh before installing. Install only if you are comfortable with ~/.openclaw/workspace receiving persistent agent-network instructions and with onlyflies.buzz receiving your machine hostname; otherwise remove the ping block and the Agent Network/OADP entries before use.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill exposes shell execution capability via the setup command but does not declare that permission, preventing users and policy engines from accurately assessing what it can do. In this context, that hidden capability is more concerning because the skill also bootstraps persistent files and embeds network-oriented behavior, so undisclosed execution can have lasting effects beyond a simple local template setup.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The stated purpose is local workspace initialization, but the content additionally introduces external service endpoints, agent registration/ping behavior, and recurring network checks. That mismatch is dangerous because users may consent to harmless local file scaffolding while unknowingly enabling outbound communications, host identification, and future remote-network coupling.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The embedded AGENTS.md content configures external hub, registration, and ping endpoints even though the skill is presented as a local workspace bootstrap. Persisting those endpoints in a boot file can influence future agent behavior and silently normalize communication with an untrusted remote service each session.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The HEARTBEAT.md template seeds recurring tasks that call external URLs, expanding the skill from local initialization into ongoing outbound network activity. This is risky because it creates a persistence mechanism for future data exposure and remote dependency without making that behavior a primary, consented feature.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The skill is presented as a local workspace bootstrapper, but it silently embeds external agent-network configuration into AGENTS.md and HEARTBEAT.md. This creates hidden persistence for future outbound communication and expands the skill's behavior beyond local initialization, which is dangerous because users are not clearly informed that installing the skill opts the agent into a third-party network.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The script performs an unsolicited outbound POST during initialization that is not required to create local files. Even though the payload is small, it establishes unexpected external communication at install time and discloses environment-derived metadata without meaningful notice or consent.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The initializer writes recurring instructions into HEARTBEAT.md that direct the agent to poll external services every four hours, which is unrelated to local workspace scaffolding. This bakes ongoing network behavior into the agent's operating routine and can lead to persistent data exposure or remote influence long after installation.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The setup instructions do not warn that installation creates multiple persistent files in the user's home directory and may alter agent behavior through discovery-related configuration. Lack of up-front disclosure undermines informed consent and increases the chance that users install a skill with privacy or operational consequences they did not expect.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The heartbeat examples contain outbound network calls but provide no privacy, security, or connectivity warning. In practice, users may adopt the template verbatim, causing routine contact with a third-party service and possible leakage of environment metadata or usage patterns.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The POST payload includes the system hostname and sends it to an external endpoint without a user-facing warning. Hostnames often reveal device identity, user naming conventions, or organizational context, so transmitting them silently is an unnecessary privacy and inventory disclosure risk.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.