Back to skill

Security audit

claw-negotiate

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its SAFE negotiation purpose, but it under-discloses persistent scheduler installation and has weak token/secret handling in its authorization design.

Review this carefully before installing. It can use Telegram and sshsign as part of the advertised workflow, but it may also create a persistent scheduler job on the host and stores/signs authorization tokens in a way that weakens the promised negotiation bounds. Use only in an isolated demo environment unless those issues are fixed and the scheduler behavior is explicitly controlled.

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Error
Location
negotiate_safe/run_safe.py:1097
Finding

Automatic Installation of a Persistent System or OpenClaw Cron Job

Content
View full analysis
tuple[bool, str | None]: """Install the ``negotiate_safe-scan`` cron job if absent.""" prefer_system_cron = runner is None allow_system_fallback = runner is None or system_runner is not None if runner is None: runner = subprocess.run if system_runner is None: system_runner = runner def _fallback(reason: str) -> tuple[bool, str | None]: if not allow_system_fallback: return False, reason ok, fallback_err = _ensure_system_cron(runner=system_runner) if ok: return True, None return False, f"{reason}; system cron fallback failed: {fallback_err}" if prefer_system_cron: ok, err = _ensure_system_cron(runner=system_runner) if ok: return True, None # Fall through to OpenClaw cron only if the deterministic # code-level heartbeat cannot be installed on this host. ``` ```python # negotiate_safe/run_safe.py:2928-2944 add_argv = [ "openclaw", "cron", "add", "--name", CRON_JOB_NAME, "--every", interval, "--system-event", "negotiate_safe_scan", "- ...[truncated 4632 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
negotiate_safe/minting.py:267
Finding

Symmetric APOA Token Secrets Are Published as Public Keys and Verification Can Fail Open

Content
View full analysis
dict: return { "iss": principal_id, "sub": f"did:apoa:{role}-agent", "aud": service, "role": role, "scope": ["offer:submit", "offer:accept", "document:sign"], "constraints": constraints_payload, "exp": expires_at_epoch, } (tokens_dir / "founder.jwt").write_text( create_local_token(payload=_payload("founder", founder_constraints), secret=founder_secret), encoding="utf-8", ) (tokens_dir / "investor.jwt").write_text( create_local_token(payload=_payload("investor", investor_constraints), secret=investor_secret), encoding="utf-8", ) ``` ```python # negotiate_safe/local_protocol.py:52-87 def create_local_token(*, payload: dict[str, Any], secret: str) -> str: header = {"alg": "HS256", "typ": "JWT"} head = _b64url(json.dumps(header, separators=(",", ":")).encode("utf-8")) body = _b64url(json.dumps(payload, separators=(",", ":")).encode("utf-8")) sig = hmac.new(secret.encode("utf-8"), f"{head}.{body}".encode("ascii"), hashlib.sha256).digest() return f"{head}.{body}.{_b64 ...[truncated 6709 chars]
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (70)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 88)May include surrounding context.

Copy the example config:

bash
cp .env.example .env

Edit .env:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 94)May include surrounding context.

Edit .env:

bash
nano .env

Use NEGOTIATE_SAFE_BOT_ROLE=founder on the founder OpenClaw and NEGOTIATE_SAFE_BOT_ROLE=investor on the investor OpenClaw.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 102)May include surrounding context.

Edit .env:

bash
nano .env

Use NEGOTIATE_SAFE_BOT_ROLE=founder on the founder OpenClaw and NEGOTIATE_SAFE_BOT_ROLE=investor on the investor OpenClaw.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

A skill that mainly performs installation/runtime validation but is described as conducting secure negotiation can mislead users into enabling capabilities they do not need. While not necessarily malicious, this mismatch broadens trust and can expose local environment details through diagnostic commands.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

A skill that mainly performs installation/runtime validation but is described as conducting secure negotiation can mislead users into enabling capabilities they do not need. While not necessarily malicious, this mismatch broadens trust and can expose local environment details through diagnostic commands.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A skill that mainly performs installation/runtime validation but is described as conducting secure negotiation can mislead users into enabling capabilities they do not need. While not necessarily malicious, this mismatch broadens trust and can expose local environment details through diagnostic commands.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

A skill that mainly performs installation/runtime validation but is described as conducting secure negotiation can mislead users into enabling capabilities they do not need. While not necessarily malicious, this mismatch broadens trust and can expose local environment details through diagnostic commands.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

A skill that mainly performs installation/runtime validation but is described as conducting secure negotiation can mislead users into enabling capabilities they do not need. While not necessarily malicious, this mismatch broadens trust and can expose local environment details through diagnostic commands.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

A skill that mainly performs installation/runtime validation but is described as conducting secure negotiation can mislead users into enabling capabilities they do not need. While not necessarily malicious, this mismatch broadens trust and can expose local environment details through diagnostic commands.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

A skill that mainly performs installation/runtime validation but is described as conducting secure negotiation can mislead users into enabling capabilities they do not need. While not necessarily malicious, this mismatch broadens trust and can expose local environment details through diagnostic commands.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

A skill that mainly performs installation/runtime validation but is described as conducting secure negotiation can mislead users into enabling capabilities they do not need. While not necessarily malicious, this mismatch broadens trust and can expose local environment details through diagnostic commands.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A skill that mainly performs installation/runtime validation but is described as conducting secure negotiation can mislead users into enabling capabilities they do not need. While not necessarily malicious, this mismatch broadens trust and can expose local environment details through diagnostic commands.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A skill that mainly performs installation/runtime validation but is described as conducting secure negotiation can mislead users into enabling capabilities they do not need. While not necessarily malicious, this mismatch broadens trust and can expose local environment details through diagnostic commands.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A skill that mainly performs installation/runtime validation but is described as conducting secure negotiation can mislead users into enabling capabilities they do not need. While not necessarily malicious, this mismatch broadens trust and can expose local environment details through diagnostic commands.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

A skill that mainly performs installation/runtime validation but is described as conducting secure negotiation can mislead users into enabling capabilities they do not need. While not necessarily malicious, this mismatch broadens trust and can expose local environment details through diagnostic commands.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

A skill that mainly performs installation/runtime validation but is described as conducting secure negotiation can mislead users into enabling capabilities they do not need. While not necessarily malicious, this mismatch broadens trust and can expose local environment details through diagnostic commands.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
87% confidence
Finding

A skill that mainly performs installation/runtime validation but is described as conducting secure negotiation can mislead users into enabling capabilities they do not need. While not necessarily malicious, this mismatch broadens trust and can expose local environment details through diagnostic commands.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

A skill that mainly performs installation/runtime validation but is described as conducting secure negotiation can mislead users into enabling capabilities they do not need. While not necessarily malicious, this mismatch broadens trust and can expose local environment details through diagnostic commands.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

A skill that mainly performs installation/runtime validation but is described as conducting secure negotiation can mislead users into enabling capabilities they do not need. While not necessarily malicious, this mismatch broadens trust and can expose local environment details through diagnostic commands.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

A skill that mainly performs installation/runtime validation but is described as conducting secure negotiation can mislead users into enabling capabilities they do not need. While not necessarily malicious, this mismatch broadens trust and can expose local environment details through diagnostic commands.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

A skill that mainly performs installation/runtime validation but is described as conducting secure negotiation can mislead users into enabling capabilities they do not need. While not necessarily malicious, this mismatch broadens trust and can expose local environment details through diagnostic commands.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The module advertises itself as local and self-contained, but it performs outbound ssh calls to fetch envelope and signature data. That mismatch is security-relevant because operators may approve or sandbox the skill under the assumption that it has no network dependency, while it actually transmits identifiers to a remote host and trusts remote responses to populate the executed agreement.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

load_apoa_token only verifies the HMAC signature if pubkey_path is provided and readable; otherwise it sets secret = "" and proceeds to parse and trust the token payload anyway. In this skill, the token carries negotiation constraints, so an attacker who can supply or replace the token file can forge arbitrary constraints, remove bounds entirely, or extend expiration, undermining the user-approved safety envelope the skill claims to enforce.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code generates token-signing secrets and writes them to disk as both 'private' and 'public' PEM files, even though the manifest describes human-approved sshsign signing. Persisting credential material locally increases the chance of theft, reuse, or misuse, and the identical public/private contents suggest a nonstandard trust model that could mislead downstream consumers.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

Sensitive credential material is written to disk without user-facing warning and apparently without explicit permission hardening. Any local compromise, backup system, shared workspace, or later process reading those files could obtain the secrets and mint or use negotiation tokens improperly.

Content

No source excerpt is available for this finding.