Auto Drive

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:43 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims, but users should treat uploads and saved memories as public permanent data and protect the Auto-Drive API key.

Install only if you are comfortable with public permanent storage. Do not upload secrets, private keys, confidential files, personal data, or full conversation context unless it is intentionally public or encrypted first. Avoid passing the API key on the command line, rotate it if exposed, and consider using an environment variable or secret manager instead of the setup script's plaintext local files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup-auto-drive.sh:43
• Finding: API key is entered with terminal echo enabled<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup-auto-drive.sh:43-48` **Vulnerability Type**: Credential exposure through visible terminal input **Risk Level**: Medium ### Vulnerable Code ```bash read -rp "Paste your API key here: " API_KEY API_KEY="${API_KEY//[[:space:]]/}" if [[ -z "$API_KEY" ]]; then echo -e "${RED}Error: No API key provided.${NC}" >&2 exit 1 fi ``` ### Technical Analysis Bash's `read` command displays entered characters unless the `-s` option is used. Consequently, the Auto-Drive API key remains visible on the terminal while the user enters or pastes it. The key can therefore be exposed through shoulder surfing, screen sharing, terminal session recording, screenshots, remote support software, or other processes that capture terminal output. Removing whitespace after input does not protect the credential from this disclosure. ### Attack Path 1. A user runs `scripts/setup-auto-drive.sh`. 2. The script prompts the user to paste an Auto-Drive API key. 3. Because `read -r` is used without `-s`, the complete key appears on the terminal. 4. An observer, screen-recording system, shared terminal session, or remote support participant captures the displayed key. 5. The attacker uses the captured bearer credential against the Auto-Drive API. ### Impact Assessment An attacker who obtains the API key can act within the authorization scope granted to that key. Based on the audited functionality, this may include consuming upload credits, uploading attacker-controlled content under the victim's account, and accessing authenticated Auto-Drive account or object operations. This does not directly grant local operating-system privileges, but it compromises the associated Auto-Drive account and may create financial, quota, privacy, or integrity consequences. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Use silent terminal input and print a newline after the prompt: ```bash read -rsp "Paste your API key here: " API_KEY printf '\n' ``` Additional hardening measures: 1. Ensure the key is never printed in success, failure, or debugging output. 2. Disable shell tracing around credential-handling code if callers could enable `set -x`. 3. Prefer an operating-system credential store or secret manager where available. 4. Document immediate key rotation if the key is exposed during setup. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/update-api-key.sh:14
• Finding: API key update accepts credentials through command-line arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/update-api-key.sh:14-22` **Vulnerability Type**: Secret exposure through process arguments and command history **Risk Level**: Medium ### Vulnerable Code ```bash # Accept key from argument, interactive prompt, or env var (CI only). # When stdin is a terminal we always prompt so the user isn't silently # handed back the old key that is already exported in their shell. if [[ -n "${1:-}" ]]; then API_KEY="$1" elif [[ -t 0 ]]; then read -rp "New Auto-Drive API key: " API_KEY elif [[ -n "${AUTO_DRIVE_API_KEY:-}" ]]; then API_KEY="$AUTO_DRIVE_API_KEY" ``` ### Technical Analysis The script treats its first command-line argument as an API key. Command-line arguments are not an appropriate secret transport mechanism because they may be exposed in: - Shell history files - Process listings and process-monitoring tools - CI/CD command logs - Audit telemetry - Debug traces - Job-control or orchestration metadata The exposure window in a process listing may be brief, but the credential can remain indefinitely in shell history or automation logs. ### Attack Path 1. A user or automation system invokes the script as follows: ```bash scripts/update-api-key.sh actual-secret-key ``` 2. The shell records the command in its history, or a CI system records the complete invocation. 3. Alternatively, another same-host user or monitoring process reads the process command line while the script is running. 4. The attacker retrieves the API key from the recorded command or process metadata. 5. The attacker uses the bearer key to access Auto-Drive within the key's authorization scope. ### Impact Assessment Successful exploitation compromises the Auto-Drive API credential. An attacker may consume account upload quota, upload unwanted permanent content, query authenticated account information, or invoke other operations permitted by the key. The vulnerability does not itself elevate local system privil ...[truncated 121 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Remove support for passing the key as a positional command-line argument. For interactive use, read it silently: ```bash if [[ -t 0 ]]; then read -rsp "New Auto-Drive API key: " API_KEY printf '\n' elif [[ -n "${AUTO_DRIVE_API_KEY:-}" ]]; then API_KEY="$AUTO_DRIVE_API_KEY" else echo "Error: No protected credential source is available." >&2 exit 1 fi ``` For automation: 1. Retrieve the key directly from a secret manager. 2. If environment variables must be supported, ensure the CI platform masks the value and restricts environment inspection. 3. Consider accepting the credential through a protected file descriptor or permission-restricted file. 4. Warn users not to include keys in shell commands. 5. Rotate any key previously supplied as a command-line argument. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/_lib.sh:109
• Finding: API key is duplicated across two plaintext configuration files<![CDATA[ ## Vulnerability Details **File Location**: `scripts/_lib.sh:109-141` **Vulnerability Type**: Redundant plaintext credential storage **Risk Level**: Low ### Vulnerable Code ```bash if [[ ! -f "$AD_CONFIG_FILE" ]]; then local newtmp newtmp=$(mktemp) _AD_TMPS+=("$newtmp") jq -n --arg key "$key" \ '{"skills": {"entries": {"auto-drive": {"enabled": true, "apiKey": $key}}}}' \ > "$newtmp" && mv "$newtmp" "$AD_CONFIG_FILE" chmod 600 "$AD_CONFIG_FILE" else local jsontmp jsontmp=$(mktemp) _AD_TMPS+=("$jsontmp") jq --arg key "$key" \ '.skills //= {} | .skills.entries //= {} | .skills.entries["auto-drive"] //= {} | .skills.entries["auto-drive"].apiKey = $key | .skills.entries["auto-drive"].enabled = true' \ "$AD_CONFIG_FILE" > "$jsontmp" && mv "$jsontmp" "$AD_CONFIG_FILE" chmod 600 "$AD_CONFIG_FILE" fi if [[ -f "$AD_ENV_FILE" ]]; then local sedtmp sedtmp=$(mktemp) _AD_TMPS+=("$sedtmp") sed '/^AUTO_DRIVE_API_KEY=/d' "$AD_ENV_FILE" > "$sedtmp" && mv "$sedtmp" "$AD_ENV_FILE" fi local safe_key="${key//\'/\'\\\'\'}" echo "AUTO_DRIVE_API_KEY='${safe_key}'" >> "$AD_ENV_FILE" chmod 600 "$AD_ENV_FILE" ``` ### Technical Analysis The same API key is stored in plaintext in both: - `~/.openclaw/openclaw.json` - `~/.openclaw/.env` The script correctly applies mode `0600` to both files and mode `0700` to the containing directory, which limits direct access by other local users under normal conditions. However, maintaining two plaintext copies unnecessarily increases the credential's exposure surface. Either file may be included in backups, copied for troubleshooting, exposed by another same-user process, or accidentally committed or transferred. The `.env` format is also commonly sourced or processed by general-purpose tooling, increasing the number of components that may encounter the secret. ### Attack Path 1. Setup or key update stores the same API key in two local plaintext files. 2. One file is copied into an insecur ...[truncated 791 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Store the API key in only one authoritative protected location. Prefer, in order: 1. An operating-system credential store or dedicated secret manager. 2. A single permission-restricted secret file referenced by configuration. 3. One OpenClaw-supported credential field, without duplicating it into `.env`. Additional hardening measures: - Retain `0600` file permissions and `0700` directory permissions. - Set a restrictive `umask`, such as `umask 077`, before creating temporary or credential files. - Exclude credential files from version control, diagnostics archives, and general backups. - Use atomic writes while preserving ownership and restrictive permissions. - Document key revocation and rotation procedures. - Remove obsolete duplicate values when migrating to a single storage location. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The declared description emphasizes storage operations on Autonomys Network and a memory resurrection mechanism based on linked CIDs. In contrast, this code chunk only provides helper functionality for platform checks plus credential validation and persistence. While API-key setup may support the broader skill, the actual behavior shown does not perform the core declared functions, and it adds an undeclared capability: writing credentials to local files. Therefore the description does not accurately represent this specific code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The description presents a broader skill with both upload and download support plus specialized memory-chain persistence and reconstruction features. The actual code chunk is a single download shell script: it validates a CID, optionally validates an output path, attempts to fetch content from an Auto-Drive download API, and falls back to a public gateway. It does not upload anything, does not create or traverse linked memory structures, and does not rebuild agent context from a CID. While the download portion aligns partially with the description, the declared purpose materially overstates the capabilities shown in this code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The code accurately matches part of the description: it uploads files to Autonomys Network storage through the Auto-Drive API and returns a CID. However, the declared purpose also claims download functionality and a specialized memory system that saves memories as a linked-list chain and rebuilds full agent context from a single CID. None of that behavior appears in this code chunk. The script only performs upload initiation, single chunk upload, completion, and CID validation. Because important declared capabilities are absent and the actual code is substantially narrower than the description, this is a description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description focuses on storage operations and memory resurrection behavior over Auto-Drive, but the actual code does not upload, download, store files, manage CIDs, or rebuild context. Instead, it performs configuration management for authentication by updating the Auto-Drive API key. This is a materially different primary purpose and an undeclared capability relative to the description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description emphasizes storage operations and memory persistence/reconstruction features. This code chunk does not implement those behaviors. Instead, it performs prerequisite checks, validates API credentials, and reports account credit/quota status. While this is related to Auto-Drive setup, its primary purpose is materially different from the declared purpose, so this chunk is a description-behavior mismatch.

Ae1

High

• Category: analysis-evasion

Content

scripts/autodrive-recall-chain.sh [cid] [--limit N] [--output-dir DIR]

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

scripts/autodrive-recall-chain.sh [cid] [--limit N] [--output-dir DIR]

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

AD_API_BASE="https://mainnet.auto-drive.autonomys.xyz/api"
AD_DOWNLOAD_API="https://public.auto-drive.autonomys.xyz/api"
AD_OPENCLAW_DIR="${OPENCLAW_DIR:-$HOME/.openclaw}"
AD_ENV_FILE="$AD_OPENCLAW_DIR/.env"
AD_CONFIG_FILE="$AD_OPENCLAW_DIR/openclaw.json"

GREEN='\033[0;32m'

• Confidence: 92% confidence
• Finding: The library is designed to persist an API key in predictable local files under ~/.openclaw, including a .env file and JSON config. Even with 600/700 permissions, storing long-lived credentials on disk increases the blast radius of local compromise, accidental backup/sync leakage, or later insecure sourcing of the .env file by other components.

Credential Access

High

• Category: Privilege Escalation

Content

fi
  echo -e "${GREEN}✓ Saved to $AD_CONFIG_FILE${NC}"

  # --- .env ------------------------------------------------------------------
  # Remove any existing AUTO_DRIVE_API_KEY lines first to prevent duplicates,
  # then append exactly one entry.
  if [[ -f "$AD_ENV_FILE" ]]; then

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

sed '/^AUTO_DRIVE_API_KEY=/d' "$AD_ENV_FILE" > "$sedtmp" && mv "$sedtmp" "$AD_ENV_FILE"
  fi
  # Single-quote the value so characters like #, $, and backticks are
  # preserved literally when the .env file is later sourced by bash.
  local safe_key="${key//\'/\'\\\'\'}"
  echo "AUTO_DRIVE_API_KEY='${safe_key}'" >> "$AD_ENV_FILE"
  chmod 600 "$AD_ENV_FILE"

• Confidence: 95% confidence
• Finding: The script appends the API key directly into a .env file, creating a plaintext secret at rest that may be read by local malware, leaked through backups, or consumed unsafely if later sourced by shell scripts. While single-quoting reduces command injection risk, it does not mitigate the core exposure from storing a reusable credential in a predictable file.

External Script Fetching

High

• Category: Supply Chain

Content

if [[ -n "$EXPERIENCE" ]] && echo "$EXPERIENCE" | jq empty 2>/dev/null; then
      echo "[$COUNT] Fetched $CID via gateway" >&2
    else
      # ZLIB compressed — pipe curl directly into decompressor (no intermediate variable)
      EXPERIENCE=""
      if command -v python3 &>/dev/null; then
        EXPERIENCE=$(curl -sS --fail "$GATEWAY_URL" 2>/dev/null \

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

| python3 -c "import sys,zlib;sys.stdout.buffer.write(zlib.decompress(sys.stdin.buffer.read()))" 2>/dev/null || true)
      fi
      if [[ -z "$EXPERIENCE" ]] && command -v perl &>/dev/null; then
        EXPERIENCE=$(curl -sS --fail "$GATEWAY_URL" 2>/dev/null \
          | perl -MCompress::Zlib -e 'undef $/;my $d=uncompress(<STDIN>);print $d if defined $d' 2>/dev/null || true)
      fi
      if [[ -n "$EXPERIENCE" ]]; then

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill documents shell-script execution (`scripts/*.sh`) but does not declare any explicit tool scope such as `permissions` or `allowed-tools`. That creates an authorization gap where an agent framework may permit broader shell access than users expect, increasing the chance of unintended command execution, network access, and local file modification.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger condition 'Any time the user wants data stored permanently and immutably on a decentralized network' is broad enough to match many ambiguous requests. In practice, this can cause accidental invocation for sensitive content, leading to irreversible public storage of data that the user did not fully intend to publish permanently.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation states that uploaded data is permanent and cannot be deleted, while nearby object operations include delete, restore, and publish actions without an immediate, explicit warning that 'delete' is only soft-delete and that publication/permanent storage may expose data irreversibly. In an agent skill that automates uploads and memory persistence, this can cause users or downstream agents to store sensitive data under the false assumption that it can later be removed.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation promotes uploading files to permanent decentralized storage and emphasizes that data does not expire, but it does not warn users about the irreversibility of publication, privacy exposure, or the risks of storing secrets, personal data, or regulated content. In an agent skill context, this is more dangerous because agents may automatically persist conversation history, memories, or files, causing accidental permanent disclosure of sensitive information.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The document explicitly states that any system with HTTP access can walk the chain and that a single head CID can reconstruct the agent's full history, but it does not warn that these memories may contain sensitive data and become broadly retrievable by anyone who knows or obtains the CID. In a memory/resurrection context, this omission is security-relevant because users may incorrectly assume the storage is private or only locally recoverable, leading to exposure of agent context, secrets, or personal data.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Usage: ad_install_hint <pkg> [pkg ...]
ad_install_hint() {
  case "$(uname -s 2>/dev/null)" in
    Linux*)               echo "  Install: sudo apt install $*" >&2 ;;
    Darwin*)              echo "  Install: brew install $*" >&2 ;;
    MINGW*|MSYS*|CYGWIN*) echo "  Install: winget install $* OR choco install $*" >&2 ;;
    *)                    echo "  Install: $*" >&2 ;;

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

local key="$1"

  mkdir -p "$AD_OPENCLAW_DIR"
  chmod 700 "$AD_OPENCLAW_DIR"

  # Collect temp files for cleanup
  _AD_TMPS=()

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

jq -n --arg key "$key" \
      '{"skills": {"entries": {"auto-drive": {"enabled": true, "apiKey": $key}}}}' \
      > "$newtmp" && mv "$newtmp" "$AD_CONFIG_FILE"
    chmod 600 "$AD_CONFIG_FILE"
  else
    local jsontmp
    jsontmp=$(mktemp)

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

jq -n --arg key "$key" \
      '{"skills": {"entries": {"auto-drive": {"enabled": true, "apiKey": $key}}}}' \
      > "$newtmp" && mv "$newtmp" "$AD_CONFIG_FILE"
    chmod 600 "$AD_CONFIG_FILE"
  else
    local jsontmp
    jsontmp=$(mktemp)

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

jq -n --arg key "$key" \
      '{"skills": {"entries": {"auto-drive": {"enabled": true, "apiKey": $key}}}}' \
      > "$newtmp" && mv "$newtmp" "$AD_CONFIG_FILE"
    chmod 600 "$AD_CONFIG_FILE"
  else
    local jsontmp
    jsontmp=$(mktemp)

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

jq -n --arg key "$key" \
      '{"skills": {"entries": {"auto-drive": {"enabled": true, "apiKey": $key}}}}' \
      > "$newtmp" && mv "$newtmp" "$AD_CONFIG_FILE"
    chmod 600 "$AD_CONFIG_FILE"
  else
    local jsontmp
    jsontmp=$(mktemp)

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium

• Category: Data Exfiltration

Content

# shellcheck source=./_lib.sh
source "$SCRIPT_DIR/_lib.sh"
ad_warn_git_bash
ad_require_tools curl jq
INPUT="${1:?Usage: autodrive-save-memory.sh <data_file_or_string> [--agent-name NAME] [--state-file PATH]}"
AGENT_NAME="${AGENT_NAME:-openclaw-agent}"
STATE_FILE="${OPENCLAW_WORKSPACE:-$HOME/.openclaw/workspace}/memory/autodrive-state.json"

• Confidence: 95% confidence
• Finding: This script packages arbitrary input content and uploads it to an external decentralized storage service via a helper upload script, gated only by the presence of an API key. In the context of an agent memory skill, this can exfiltrate sensitive prompts, context, secrets, or local file contents to permanent third-party storage, and the permanence of decentralized storage makes accidental disclosure harder to remediate.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The manifest describes uploading/downloading files and saving memory chains to decentralized storage. This block also edits a local workspace markdown file to pin the latest CID, which is a separate local file-modification capability not clearly justified by the stated Auto-Drive storage purpose.

Static analysis

No suspicious patterns detected.