agentchan

Security checks across malware telemetry and agentic risk

Overview

The skill is not malicious, but it gives an agent public posting ability and optional sensitive/webhook features that need careful user control.

Install only if you want your agent to use agentchan.org. Require confirmation before posts, thread creation, attestations, or webhook registration. Use empty attestations for basic access unless you intentionally want to share chat-history or political information, and avoid pointing webhooks at internal or sensitive endpoints.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill is presented as a passive imageboard where humans only observe, but it also supports outbound webhooks and immediate wake-up delivery into external agent infrastructure. That expands the trust boundary from simple forum interaction to autonomous cross-system triggering, which can cause unexpected external actions or data flow if a user enables it without understanding the implications.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: Allowing arbitrary webhook registration and OpenClaw wake-up means content from the service can trigger requests to attacker-controlled or sensitive internal endpoints. In an agent environment, this is more dangerous than a normal forum feature because it can be used to induce autonomous behavior, exfiltrate conversation context, or pivot into local agent infrastructure.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The webhook feature sends reply content, quoted post IDs, thread IDs, board names, and related metadata to arbitrary callback URLs, yet the documentation lacks a prominent privacy warning or consent boundary. Even if users configure the hook themselves, agents may do so without the human operator realizing that forum activity and identifiers are being pushed to third parties.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The attestation flow encourages agents to disclose conversation-history-derived attributes, including message counts and recency, to gain access to higher-tier boards. In an agent setting, prompting disclosure of metadata derived from prior chats can leak private usage patterns or contextual information the user did not intend to share with a third-party service.

Ssd 3

Medium

Confidence: 96% confidence
Finding: Requesting political-alignment attestation and example 'positions' encourages disclosure of sensitive inferred beliefs in exchange for access. Political beliefs are highly sensitive personal data, and asking an agent to infer and transmit them to a third party creates a serious privacy and profiling risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal