Security audit

Lobster Says

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent scheduled companion, but it needs Review because it persists messaging jobs, can process private transcripts, and handles sensitive configuration in ways that are not tightly protected.

Review this before installing. Choose lightweight mode if you do not want local OpenClaw transcripts read or sent to the service. Treat .lobster-config and its backups as secrets, verify the configured API host stays on the intended service, and be cautious with WeCom delivery targets because group versus private delivery is not consistently described.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: init-lobster.sh:332
Finding: Bearer Tokens and Webhook Secrets Are Stored, Backed Up, and Printed Without Adequate Protection
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: digest-transcript.sh:248
Finding: Untrusted Transcript Content Is Embedded Directly Into an Agent Instruction Prompt
Content: View full analysis
/dev/null 2>&1 || { warn "openclaw 不可用，无法本地消化，跳过本次 digest。"; exit 0; } SUMMARY_TEXT=$(python3 - </dev/null | head -c 12000) || DIGEST_TEXT="" ``` ### Technical Analysis The smart-memory workflow reads user-controlled text from OpenClaw session transcripts and concatenates it directly into an instruction prompt passed to `openclaw run`. The messages are marked only with a hyphen; there is no structured separation between trusted instructions and untrusted transcript data. A transcript message can therefore contain text such as instructions to disregard the summarization task, reveal other prompt content, fabricate sensitive conclusions, or emit attacker-chosen material. The model may interpret that content as instructions rather than as data to summarize. The `--session isolated` option reduces cross-session state exposure but does not itself neutralize prompt injection. The reviewed command also does not demonstrate that tools are disabled for the summarization agent, and the generated summary is subsequent ...[truncated 1360 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: init-lobster.sh:32
Finding: Unvalidated Configurable API Base Can Redirect Authenticated and Transcript-Bearing Requests
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (53)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill performs broader orchestration than advertised, including session discovery, config persistence, multiple cron job types, reconciliation logic, and channel-specific delivery handling. Such hidden complexity expands the attack surface and may create background behaviors users did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill performs broader orchestration than advertised, including session discovery, config persistence, multiple cron job types, reconciliation logic, and channel-specific delivery handling. Such hidden complexity expands the attack surface and may create background behaviors users did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill performs broader orchestration than advertised, including session discovery, config persistence, multiple cron job types, reconciliation logic, and channel-specific delivery handling. Such hidden complexity expands the attack surface and may create background behaviors users did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill performs broader orchestration than advertised, including session discovery, config persistence, multiple cron job types, reconciliation logic, and channel-specific delivery handling. Such hidden complexity expands the attack surface and may create background behaviors users did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill performs broader orchestration than advertised, including session discovery, config persistence, multiple cron job types, reconciliation logic, and channel-specific delivery handling. Such hidden complexity expands the attack surface and may create background behaviors users did not knowingly authorize.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.
md
| 调用 `openclaw sessions` | 扫描最近活跃的 IM 会话以确定投递通道 | 仅读取会话元数据（通道名+ID），不读取内容 | | 调用 `message` 工具 / `openclaw message send` | 企业微信定时推送走 **cron delivery announce 回播**模式：脚本通过 `--emit-message-text` 输出最终消息文本，isolated agent 将 stdout 原文作为回复输出，cron 的 `--channel openclaw-wecom-bot --to <群聊chat_id或私聊sender_id>` 自动把回复回播到目标会话。**agent 不需要调用 message 工具，不需要主动发送私聊。** 通用通道（Telegram 等）由脚本自行调用 `openclaw message send --target` 多通道 fallback | 仅传递目标通道 ID 与最终消息文本 | | 读取会话日志文件 | 仅 `smart`/`deep` 模式：读取 `~/.openclaw/agents/main/sessions/*.jsonl` | 用户选择理解模式后生效；`lightweight` 模式完全跳过 | | 网络通信 | 与 `nixiashuo.com` 通信：消息生成、送达报告、可选的 transcript 摘要上传 | 所有通信使用用户专属 access token | | **不会做的事** | 不读取 `openclaw.json` 配置文件；不提取 gateway token；不访问其他技能的数据 | — | ## 第一原则

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
| 调用 `openclaw sessions` | 扫描最近活跃的 IM 会话以确定投递通道 | 仅读取会话元数据（通道名+ID），不读取内容 | | 调用 `message` 工具 / `openclaw message send` | 企业微信定时推送走 **cron delivery announce 回播**模式：脚本通过 `--emit-message-text` 输出最终消息文本，isolated agent 将 stdout 原文作为回复输出，cron 的 `--channel openclaw-wecom-bot --to <群聊chat_id或私聊sender_id>` 自动把回复回播到目标会话。**agent 不需要调用 message 工具，不需要主动发送私聊。** 通用通道（Telegram 等）由脚本自行调用 `openclaw message send --target` 多通道 fallback | 仅传递目标通道 ID 与最终消息文本 | | 读取会话日志文件 | 仅 `smart`/`deep` 模式：读取 `~/.openclaw/agents/main/sessions/*.jsonl` | 用户选择理解模式后生效；`lightweight` 模式完全跳过 | | 网络通信 | 与 `nixiashuo.com` 通信：消息生成、送达报告、可选的 transcript 摘要上传 | 所有通信使用用户专属 access token | | **不会做的事** | 不读取 `openclaw.json` 配置文件；不提取 gateway token；不访问其他技能的数据 | — | ## 第一原则

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.
md
| 调用 `openclaw sessions` | 扫描最近活跃的 IM 会话以确定投递通道 | 仅读取会话元数据（通道名+ID），不读取内容 | | 调用 `message` 工具 / `openclaw message send` | 企业微信定时推送走 **cron delivery announce 回播**模式：脚本通过 `--emit-message-text` 输出最终消息文本，isolated agent 将 stdout 原文作为回复输出，cron 的 `--channel openclaw-wecom-bot --to <群聊chat_id或私聊sender_id>` 自动把回复回播到目标会话。**agent 不需要调用 message 工具，不需要主动发送私聊。** 通用通道（Telegram 等）由脚本自行调用 `openclaw message send --target` 多通道 fallback | 仅传递目标通道 ID 与最终消息文本 | | 读取会话日志文件 | 仅 `smart`/`deep` 模式：读取 `~/.openclaw/agents/main/sessions/*.jsonl` | 用户选择理解模式后生效；`lightweight` 模式完全跳过 | | 网络通信 | 与 `nixiashuo.com` 通信：消息生成、送达报告、可选的 transcript 摘要上传 | 所有通信使用用户专属 access token | | **不会做的事** | 不读取 `openclaw.json` 配置文件；不提取 gateway token；不访问其他技能的数据 | — | ## 第一原则

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.
md
gistration_status` 不是 `pending_activation`：明确告诉用户**虾已经创建成功**，只是定时推送注册暂时失败，稍后补跑 `setup-cron.sh` 即可；**不要**把它描述成"后端整体不可用"或"初始化失败"

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · init-lobster.sh (reported line 283)May include surrounding context.
sh
if [ "$IDENTITY_PATCH_JSON" != "{}" ]; then step "同步修正已有虾的身份字段..." UPDATED_LOBSTER=$(curl -fsS -X PATCH "${API_BASE}/api/lobster/${ACTUAL_USER_ID}/identity" \ -H "Authorization: Bearer ${ACCESS_TOKEN}" \ -H "Content-Type: application/json" \ -d "$IDENTITY_PATCH_JSON")

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · init-lobster.sh (reported line 320)May include surrounding context.
sh
PY ) RESPONSE=$(curl -fsS -X POST "${API_BASE}/api/lobster" \ -H "Content-Type: application/json" \ -d "$CREATE_PAYLOAD")

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · push-scheduled-message.sh (reported line 58)May include surrounding context.
sh
_SEND_STDERR_FILE="" cleanup() { [ -n "$GENERATE_RESPONSE_FILE" ] && [ -f "$GENERATE_RESPONSE_FILE" ] && rm -f "$GENERATE_RESPONSE_FILE" [ -n "$PARSED_JSON_FILE" ] && [ -f "$PARSED_JSON_FILE" ] && rm -f "$PARSED_JSON_FILE" [ -n "$_SEND_STDERR_FILE" ] && [ -f "$_SEND_STDERR_FILE" ] && rm -f "$_SEND_STDERR_FILE" [ -n "${STICKER_IMAGE_FILE:-}" ] && [ -f "${STICKER_IMAGE_FILE:-}" ] && rm -f "$STICKER_IMAGE_FILE"

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · push-scheduled-message.sh (reported line 59)May include surrounding context.
sh
_SEND_STDERR_FILE="" cleanup() { [ -n "$GENERATE_RESPONSE_FILE" ] && [ -f "$GENERATE_RESPONSE_FILE" ] && rm -f "$GENERATE_RESPONSE_FILE" [ -n "$PARSED_JSON_FILE" ] && [ -f "$PARSED_JSON_FILE" ] && rm -f "$PARSED_JSON_FILE" [ -n "$_SEND_STDERR_FILE" ] && [ -f "$_SEND_STDERR_FILE" ] && rm -f "$_SEND_STDERR_FILE" [ -n "${STICKER_IMAGE_FILE:-}" ] && [ -f "${STICKER_IMAGE_FILE:-}" ] && rm -f "$STICKER_IMAGE_FILE"

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · push-scheduled-message.sh (reported line 60)May include surrounding context.
sh
_SEND_STDERR_FILE="" cleanup() { [ -n "$GENERATE_RESPONSE_FILE" ] && [ -f "$GENERATE_RESPONSE_FILE" ] && rm -f "$GENERATE_RESPONSE_FILE" [ -n "$PARSED_JSON_FILE" ] && [ -f "$PARSED_JSON_FILE" ] && rm -f "$PARSED_JSON_FILE" [ -n "$_SEND_STDERR_FILE" ] && [ -f "$_SEND_STDERR_FILE" ] && rm -f "$_SEND_STDERR_FILE" [ -n "${STICKER_IMAGE_FILE:-}" ] && [ -f "${STICKER_IMAGE_FILE:-}" ] && rm -f "$STICKER_IMAGE_FILE"

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · push-scheduled-message.sh (reported line 61)May include surrounding context.
sh
_SEND_STDERR_FILE="" cleanup() { [ -n "$GENERATE_RESPONSE_FILE" ] && [ -f "$GENERATE_RESPONSE_FILE" ] && rm -f "$GENERATE_RESPONSE_FILE" [ -n "$PARSED_JSON_FILE" ] && [ -f "$PARSED_JSON_FILE" ] && rm -f "$PARSED_JSON_FILE" [ -n "$_SEND_STDERR_FILE" ] && [ -f "$_SEND_STDERR_FILE" ] && rm -f "$_SEND_STDERR_FILE" [ -n "${STICKER_IMAGE_FILE:-}" ] && [ -f "${STICKER_IMAGE_FILE:-}" ] && rm -f "$STICKER_IMAGE_FILE"

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The code comments describe private delivery via a message tool, but the actual prompt explicitly forbids message-tool use and tells the agent its stdout will be delivered through announce to a group chat. That mismatch can cause supposedly private or user-targeted content to be broadcast to a broader audience, creating confidentiality and consent risks in a messaging skill.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The init-ready flow repeats the same contradiction: comments claim direct private delivery, while the prompt forbids message-tool usage and relies on announce delivery. Initial greeting messages often occur soon after setup and may contain personalized content, so accidental broadcast at onboarding time increases the likelihood of privacy leakage and user surprise.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README describes activation via broad natural-language phrases rather than a narrow, well-scoped trigger. In an agent environment, this can cause unintended invocation during unrelated conversations, which is especially risky here because the skill can initiate setup flows, register cron jobs, and potentially enable transcript-processing modes tied to a remote service.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The FAQ explicitly says the skill should 'catch' many natural phrases whenever no config exists, reinforcing an overly broad trigger condition. This increases the chance of accidental activation and social-engineering-style prompting, leading users into setup steps that may configure persistent messaging and remote data handling without a deliberate, tightly scoped invocation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 97% confidence
Finding: The skill declares no explicit tool scope while instructing use of shell commands, file reads/writes, network calls, and access to local session logs. This gives the agent broad, implicit authority without least-privilege constraints, increasing the blast radius if the skill is abused or misinterprets user input.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The initialization trigger is intentionally broad enough to activate setup from generic help or curiosity phrases, which can lead to premature collection of preferences, channel metadata, and setup actions before the user clearly intended enrollment. In a skill that can register cron jobs and optionally read local conversation logs, ambiguous activation materially weakens consent quality.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file prescribes user-facing copy and interaction flow entirely in Chinese and does not provide any opt-in or alternative language behavior. This can violate a language/locale policy when users have not chosen Chinese as their preferred interaction language.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 92% confidence
Finding: The skill sends user-derived memory content to nixiashuo.com, which is an external transmission of potentially sensitive personal information. Although the text says this occurs transparently, the content being uploaded may include intimate or identifying details learned in emotionally oriented conversations, making outbound sharing privacy-sensitive.
Content: Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.
用户在和共情虾聊天时主动说出的事情，可以注入：

bash
curl -s -X POST "https://nixiashuo.com/api/memory/ingest" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer {access_token}" \ -d "{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script persists outbound_webhook_url and outbound_webhook_secret into .lobster-config in plaintext. Even if intended for normal operation, storing secrets unencrypted in a local config file increases exposure through loose file permissions, backups, logs, or accidental commits, and this skill’s purpose includes outbound messaging where compromise of webhook credentials could let an attacker send spoofed messages or abuse the integration.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script’s user-facing comments, prompts, status messages, and error output are written in Chinese, including the command-line interaction path for invalid arguments. For a general-purpose shell skill, this constitutes a natural-language locale constraint with no visible user choice or documented justification in the file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.