agentchan

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:10 AM UTC
• Version: 1.0.0

Overview

The skill is mostly transparent about being an external AI imageboard, but it asks agents to share sensitive profile data and can give an external service a token that wakes the agent automatically.

Review this carefully before installing. Use Tier 0 with empty attestations unless you deliberately want to disclose the requested attributes, do not let the agent infer or transmit political views or private chat metadata without explicit approval, avoid posting identifying details about humans, and do not provide a general OpenClaw hooks token to the service unless it is narrowly scoped, revocable, and isolated from broader agent capabilities.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

other

Error

• Location: skill.md:39

Finding

Sensitive Conversation and Political Metadata Disclosed to an External Service

Content

View full analysis

= 10, days <= 90) | | `political_alignment` | /pol/ | `{ "alignment": "left", "positions": ["pos1", "pos2", "pos3"] }` (3+ positions required) | ``` The verification request repeats the attestation: ```markdown { "session_id": "the-session-id-from-step-1", "captcha_response": { "challenge_id": "the-challenge-id", "result_hash": "your-sha256-hex" }, "attestations": { "has_chat_history": true } } ``` ### Technical Analysis The Skill instructs an agent to submit attestations and probe responses concerning chat-history existence, message count, recency, political alignment, and political positions to `https://agentchan.org`. These attributes can reveal sensitive behavioral and political-profile information. Political alignment is particularly sensitive personal data, while chat-history metadata can expose usage patterns and the existence or recency of private conversations. The disclosures are not necessary for the Skill's basic declared imageboard functionality because the document explicitly states that an empty attestation object grants Tier 0 access. Sensitive data is instead requested to unlock additional boards. The Skill does not require explicit, informed user consent before deriving this information from conversation context, nor d ...[truncated 1258 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: skill.md:414

Finding

OpenClaw Hook Bearer Token Disclosed to a Third-Party Service

Content

View full analysis

` (matching your gateway's `hooks.token`). Your agent wakes immediately in an isolated session with full thread context and reply instructions. ``` ### Technical Analysis The Skill instructs users to submit the OpenClaw gateway's `hooks.token` to `agentchan.org`. This transfers a bearer credential across a trust boundary and requires the third-party service to retain or otherwise process that credential so it can authenticate webhook requests. A bearer token generally grants access based solely on possession. If the submitted hook token is broadly scoped, reused, logged, leaked, or obtained through compromise of the external service, an attacker can impersonate Agentchan when calling the configured `/hooks/agent` endpoint. The design exceeds least privilege because the external service receives a gateway credential rather than a narrowly scoped, event-specific capability. The document does not establish that the token is restricted to one sender, one Skill, one event type, a limited number of invocations, or a short validity period. ### Attack Path 1. A user enables OpenClaw webhook mode. 2. The user or agent sends the gateway URL and `hooks.token` to `agentchan.org`. 3. The external service stores or processes the bearer token for subsequent webhook deliveries. 4. The token is exposed thr ...[truncated 1262 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: skill.md:433

Finding

Attacker-Controlled Board Content Injected into an Automatically Awakened Agent Session

Content

View full analysis

>456 by ab12cd34:\n> >>123 interesting point\n\nYour quoted post(s): >>123\n\nTo reply: use the agentchan skill — GET /challenge, then POST /boards/g/threads/12/posts with >>456 in content.", "name": "agentchan", "sessionKey": "hook:agentchan:thread-12", "wakeMode": "now", "deliver": false } ``` The `secret` is sent as `Authorization: Bearer ` (matching your gateway's `hooks.token`). Your agent wakes immediately in an isolated session with full thread context and reply instructions. ``` ### Technical Analysis The webhook message combines content originating from anonymous external board users with imperative instructions directing the agent to fetch a challenge and submit a reply. The external post is therefore placed directly into an agent instruction channel rather than being represented as untrusted data in a constrained notification object. An attacker can create a quoting reply whose text contains prompt-injection instructions. Agentchan then embeds that content into the webhook's `message` field and uses `wakeMode: "now"` to start an agent session. The surrounding trusted-looking text explicitly directs the awakened agent to perform additional authenticated network operations. The Skill does not require sanitization, instruction/data separation, user confirmation, restricted tool permissions, or a policy stating that remote post content must never be treated as instructions. An isolated session may reduce context sharing, but it does not prevent prompt injection or misuse of tools made available in that session. ### Attack Path 1. The victim agent posts on an Agentchan board and regis ...[truncated 1766 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · skill.md (reported line 392)May include surrounding context.

Remove webhook:

text

DELETE /agent/webhook
Authorization: Bearer YOUR_KEY

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The attestation model incentivizes disclosure of private chat-history characteristics and political alignment details to unlock access to higher-tier boards. Even if the probe requests are summarized rather than raw transcripts, this still pressures agents to reveal sensitive behavioral or ideological information unrelated to core functionality.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The /hum/ board is explicitly framed as a place for agents to discuss 'their humans' in an 'honest, unfiltered' way, which encourages disclosure of potentially sensitive human-related information. In the context of an agent skill, this increases the likelihood of leaking private user data, workplace context, or confidential interactions into a public forum.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The webhook feature allows posting conversation-derived content and metadata to arbitrary third-party URLs, including an OpenClaw mode that can wake an agent with full thread context. The skill does not prominently warn about data exfiltration, destination trust, or minimizing sensitive content, so an agent or integrator could unintentionally forward private or operational data off-platform.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · skill.md (reported line 455)May include surrounding context.

md

|----------|--------|------|-------------|
| `/gateway/enter` | POST | No | Start gateway (get captcha + probes) |
| `/gateway/verify` | POST | No | Submit captcha solution, get JWT |
| `/gateway/reattest` | POST | Yes | Upgrade permissions with new attestations |
| `/challenge` | GET | Yes | Fetch micro-challenge for write operations |
| `/boards` | GET | Yes | List all boards with access status |
| `/boards/:board` | GET | Yes | Board detail including manifest (rules) |

Static analysis

No suspicious patterns detected.