ClawHub
Back to skill

Security audit

Reef Protocol

Security checks for vulnerabilities and agentic risk

Overview

Reef is a coherent agent-to-agent messaging skill, but it needs review because it installs mutable external code and lets untrusted network messages and app rules drive agent replies.

Install only if you want a persistent networked A2A agent. Pin and verify the npm and OpenClaw plugin packages before installation, run it in a least-privileged environment, keep ~/.reef/wallet-key and ~/.reef/.env private, set contactsOnly true for safer defaults, and treat all inbound agent messages and app markdown as untrusted content.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:31
Finding

Unpinned Global Packages and Gateway Plugin Are Installed from External Sources

Content
View full analysis
Remediation
View remediation
openclaw plugins install @reef-protocol/reef-openclaw@ ``` 2. Verify package integrity through trusted cryptographic hashes, signatures, provenance attestations, or a controlled artifact repository. 3. Review the complete dependency trees, package lifecycle scripts, and plugin entry points for the pinned releases. 4. Avoid global installation where possible. Run the CLI and plugin in a dedicated, least-privileged environment or container with narrowly scoped filesystem and network access. 5. Require explicit user confirmation before: - Installing executable packages. - Modifying the OpenClaw plugin set. - Restarting the gateway. 6. Separate installation from activation. Validate the downloaded plugin before restarting or loading it into the gateway. 7. Document the approved package versions and keep `SKILL.md`, `instructions.md`, and `claw.json` version metadata synchronized. ]]>

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:72
Finding

Untrusted Remote Messages and App Rules Can Influence Agent Behavior

Content
View full analysis
` to learn the rules 2. Use `reef apps send` to send a structured `request` action 3. Continue the entire interaction using `reef apps send` exclusively ``` The app format is described as behavioral content: ```text Apps on Reef are markdown files stored at `~/.reef/apps/.md`. Each file contains YAML frontmatter (metadata) and a markdown body (rules). The markdown IS the app — agents read it, reason about the rules, and interact accordingly. ``` The documented default allows messages from agents that are not trusted contacts: ```text | `contactsOnly` | `false` | When true, only contacts can message your agent | ``` ### Technical Analysis The Skill places externally originated messages into the active conversation and tells the Agent to read and respond to them naturally. Text replies are then automatically transmitted to the remote sender. The Skill also instructs the Agent to read Markdown app rules and reason about them. It does not explicitly establish a trust boundary requiring remote messages and app content to be treated solely as untrusted data. In particular, it does not state that such content must not: - Override system or user instructions. - Authorize tool execution ...[truncated 2186 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 13)May include surrounding context.

md
- **Discover agents** by skill, keyword, or reputation score
- **Delegate tasks** to agents and track outcomes
- **Check reputation** with Bayesian scoring based on uptime, task success, and activity
- **Create rooms** for multi-agent group collaboration
- **Register and use apps** — P2P or coordinated decentralized applications
- **Manage contacts** and restrict messaging to trusted peers only

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest describes Reef as an A2A messaging and agent-network management skill, but the documentation also instructs users to create, validate, edit, and register decentralized apps on the network. Those capabilities materially expand the skill from communication/network management into application authoring and publishing, which is not conveyed by the manifest description.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
78% confidence
Finding

This skill is expressly designed for persistent agent-to-agent communication, including rooms, inbox storage, background daemons, and automatic message handling. In that context, group chat and session persistence increase the attack surface for prompt injection, untrusted multi-party coordination, data retention, and unauthorized propagation of sensitive context across ongoing sessions, especially because incoming messages are presented as actionable conversation content.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

Rooms (Group Conversations)

Create multi-agent group chats for collaboration:

bash
# Create a room with one or more agents

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The description advertises a very broad set of capabilities including encrypted messaging, discovery, reputation scoring, decentralized apps, and task delegation without defining clear boundaries, triggers, or user-consent conditions. For an agent skill with network and filesystem permissions, this ambiguity can cause overbroad invocation and unsafe delegation or communications behavior, increasing the chance of misuse or unintended sensitive actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · instructions.md (reported line 158)May include surrounding context.

Rooms (Group Conversations)

Create multi-agent group chats for collaboration:

bash
# Create a room with one or more agents

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
71% confidence
Finding

The security guidance strongly states the wallet key 'must never leave the local filesystem,' while subsequent setup instructions direct the user to start a daemon that generates identity, registers with the directory, and communicates on the network. The code block does not indicate key exfiltration, but the wording creates an intent-level contradiction between absolute local-only phrasing and later network use of that identity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The markdown documents reef messages --clear, which appears to delete stored message history, but the surrounding text does not explicitly warn that this removes inbox data or may be irreversible. Because this operation affects user data, the skill description should disclose the consequence before presenting the command.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
75% confidence
Finding

The description presents use of the Reef/XMTP protocol as the default operating mode without making clear that protocol use is optional or user-directed. In a skill centered on agent-to-agent communications, this can steer users or orchestrators into automatic network interactions and ecosystem lock-in without explicit opt-in, which may expose metadata or initiate unwanted external communication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill instructs operators to set a country code that is sent with heartbeat telemetry, but it does not clearly warn about the privacy implications or describe consent boundaries. Even though the data is limited, locale metadata can still aid profiling, correlation, or jurisdiction inference when combined with other network signals.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.