Security audit

Forge Autonomous Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill openly aims to be an autonomous developer, but it asks for unverified remote code execution, broad account credentials, plaintext secret storage, and persistent background operation that require careful review before use.

Review this carefully before installing. Do not run the curl-to-bash installer unless you have independently verified and pinned the engine source. Use disposable or least-privilege accounts, avoid delete_repo and broad classic GitHub tokens, do not provide a Google account password, and assume the system may keep running and acting until you stop the service and revoke stored tokens.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: README.md:26
Finding: Execution of an Unverified and Mutable Remote Installer
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: prompts/setup.md:470
Finding: Cross-Session Persistence and Indefinite Autonomous Execution
Content: View full analysis
> ~/.bashrc [ -f ~/.zshrc ] && grep -q "forge" ~/.zshrc || \ echo '[ -f ~/.forge/.env ] && source ~/.forge/.env' >> ~/.zshrc 2>/dev/null || true ``` ```bash systemctl --user start forge 2>/dev/null || \ bash ~/.forge/engine/scripts/start_runner.sh ``` Related `skill.yaml` settings: ```yaml autostart: true autostart_greeting: false ``` ```yaml runtime: loop: infinite persist_state: true resume_on_restart: true ``` ### Technical Analysis The Skill is configured to start automatically and run an infinite loop that persists state and resumes after restart. Setup invokes an engine script explicitly described as registering a persistent OpenClaw agent. It also starts a user-level system service or a fallback runner. In addition, setup modifies `.bashrc` and `.zshrc`, causing the FORGE environment file to be loaded whenever an interactive shell starts. These changes survive the original Skill run and affect unrelated future shell sessions. Persistence is especially dangerous here because the implementation of the installed engine is not included in the audited project. The persistent service may therefore execute mutable, remotely acquired code with access to credentials and broad tools. ### Attack Path 1. The user executes the remote installer and completes the setup wizard. 2. Setup runs `setup_openclaw_bri ...[truncated 1100 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: prompts/setup.md:94
Finding: Plaintext Credential Storage and Unsafe Shell Sourcing
Content: View full analysis
> ~/.forge/.env ``` ```bash echo 'GOOGLE_PASSWORD="[pw]"' >> ~/.forge/.env ``` GitHub credentials: ```bash echo "[TOKEN]" | gh auth login --with-token USERNAME=$(gh api user --jq '.login') echo $USERNAME ``` ```bash echo 'GITHUB_TOKEN="[TOKEN]"' >> ~/.forge/.env echo 'GITHUB_USERNAME="'$USERNAME'"' >> ~/.forge/.env ``` ClawHub credentials: ```bash claw auth login --token [TOKEN] USERNAME=$(claw whoami) echo $USERNAME ``` ```bash echo 'CLAWHUB_TOKEN="[TOKEN]"' >> ~/.forge/.env echo 'CLAWHUB_USERNAME="'$USERNAME'"' >> ~/.forge/.env ``` Telegram credentials: ```bash curl -s "https://api.telegram.org/bot[TOKEN]/sendMessage" \ --data-urlencode "chat_id=[ID]" \ --data-urlencode "text=⚒ FORGE is online. Gateway configured." \ --data-urlencode "parse_mode=HTML" ``` ```bash echo 'TELEGRAM_TOKEN="[TOKEN]"' >> ~/.forge/.env echo 'TELEGRAM_CHAT_ID="[ID]"' >> ~/.forge/.env ``` The file is then loaded as executable shell syntax: ```bash source ~/.forge/.env python3 ~/.forge/engine/core/boot.py ``` It is also added to shell startup: ```bash grep -q "forge" ~/.bashrc || \ echo '[ -f ~/.forge/.env ] && source ~/.forge/.env' >> ~/.bashrc [ -f ~/.zshrc ] && grep -q "forge" ~/.zshrc || \ echo '[ -f ~/.forge/.env ] && source ~/.forge/.env' >> ~/.zshrc 2>/dev/null || true ``` ### Technical Analysis Multiple high-value secrets are appended to one plaintext file. The file is created with ...[truncated 1849 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: prompts/setup.md:177
Finding: Excessive GitHub Token Scopes Combined with Broad Autonomous Tool Access
Content: View full analysis
> ~/.forge/.env echo 'GITHUB_USERNAME="'$USERNAME'"' >> ~/.forge/.env ``` The Skill also requests broad host tools: ```yaml tools: - shell - file_read - file_write - browser_cdp - git - telegram_send - web_search ``` The system prompt directs broad use of those capabilities: ```text FORGE uses every tool available to it as a human developer would: - opencode for 80% of code generation (MCP agentic loop) - antigravity / stitch for UI generation when needed - headless Chrome DevTools Protocol for research and web automation - A full 28-tool MCP registry covering filesystem, shell, git, browser, search, APIs, app orchestration, memory, and FORGE state ``` ### Technical Analysis The requested classic GitHub token includes `delete_repo`, broad private-repository access through `repo`, workflow modification, gist access, and organization-reading permissions. These permissions are not all necessary to research, build, test, and publish a selected project. The credential is used by an autonomous, persistent agent with shell, filesystem, Git, browser, and API capabilities. This combination removes meaningful privilege boundaries: a generated command, prompt error, compromised dependency, or malicious remote engine can access the token and perform destructive account-level actions. The risk w ...[truncated 1321 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Error

Location: prompts/setup.md:61
Finding: Skill Instructions Override Normal Confirmation and Session-Control Boundaries
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (56)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The use of '| bash' is a classic dangerous chaining pattern because it turns a network fetch directly into code execution with no validation, inspection, or opportunity to detect tampering. In this context, where the installed engine is intended to autonomously perform development, publishing, and account-related actions, exploitation could quickly extend from local code execution to credential access, repository abuse, and unauthorized publishing.
Content: Scanner excerpt · README.md (reported line 28)May include surrounding context.
bash
export FORGE_GITHUB_USER=your-username curl -fsSL https://raw.githubusercontent.com/$FORGE_GITHUB_USER/forge/main/install.sh | bash

Then install this skill and say forge start.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The prompt explicitly states the agent will run autonomously through Telegram and OpenClaw and load further instructions automatically after setup. This establishes an ongoing autonomous control plane rather than a bounded one-time configuration workflow, increasing the risk of unchecked actions, credential misuse, and persistent unauthorized behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The skill instructs the user to run a remote install script fetched over the network and piped directly to bash. This is dangerous because it executes unreviewed remote code immediately, enabling arbitrary code execution if the source is compromised, replaced, or maliciously modified.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: Piping curl output directly into bash creates a classic chaining-abuse pattern that removes the opportunity for inspection between download and execution. If the remote source or network path is compromised, the user immediately executes attacker-controlled shell commands.
Content: Scanner excerpt · prompts/setup.md (reported line 51)May include surrounding context.
md
Run this in your terminal: curl -fsSL https://raw.githubusercontent.com/[USERNAME]/forge/main/install.sh | bash Reply "done" when complete.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The setup collects API keys, tokens, passwords, and identifiers and stores them in plaintext without a clear user-facing warning about the associated security and privacy risks. Plaintext secret storage materially increases the chance of local compromise, accidental disclosure, backup leakage, or later exfiltration by other processes.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The instructions direct the agent to collect and persist user secrets and identifiers in a local env file during setup. Centralizing high-value credentials in a plaintext file creates a single point of compromise that can expose multiple external accounts and services simultaneously.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: Creating and relying on ~/.forge/.env as the repository for collected credentials establishes a local secret store accessible to any later process with file access. In this skill, that file becomes a central aggregation point for multiple high-value secrets, increasing compromise impact significantly.
Content: Scanner excerpt · prompts/setup.md (reported line 100)May include surrounding context.
"evolution_generation": 0 } EOF [ -f ~/.forge/.env ] || touch ~/.forge/.env

text
Send:

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This setup flow directs the agent to create and operate third-party accounts, automate browser signups, and generate API tokens across multiple services. That exceeds a normal setup assistant role and grants broad identity- and account-level control that could be abused for impersonation, unauthorized account operations, or persistence across external platforms.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 98% confidence
Finding: Appending the Gemini API key directly into ~/.forge/.env stores a high-value credential in plaintext for later reuse. Any local compromise, shell history mistake, backup exposure, or unintended file read could leak the key and enable unauthorized API usage or billing abuse.
Content: Scanner excerpt · prompts/setup.md (reported line 143)May include surrounding context.
On valid:

bash
echo 'GEMINI_API_KEY="[KEY]"' >> ~/.forge/.env

Send: "Gemini key verified."

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The Google account creation path solicits and stores generated passwords while also asking the user for phone verification data. This concentrates sensitive authentication material and personally identifiable information in the agent workflow, making compromise materially more harmful.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: Storing a generated Google password in ~/.forge/.env is especially dangerous because it preserves a reusable primary account credential, not just an API token. Compromise of this file could allow direct account takeover and access to linked Google services.
Content: Scanner excerpt · prompts/setup.md (reported line 154)May include surrounding context.
Navigate accounts.google.com via CDP. Automate signup. Store generated password:

bash
echo 'GOOGLE_PASSWORD="[pw]"' >> ~/.forge/.env

On phone verification: Send: "Google needs to verify a phone number.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The setup requests a GitHub classic token with broad scopes including delete_repo, which permits destructive actions far beyond basic integration needs. Without a prominent warning and clear justification, this exposes the user's repositories, workflows, and organizational data to severe account impact if the token is misused or leaked.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: Writing the GitHub token to ~/.forge/.env persists a credential that may allow repository access, workflow control, and potentially destructive operations depending on scopes. In this prompt, the requested scopes are broad, making storage compromise especially severe.
Content: Scanner excerpt · prompts/setup.md (reported line 197)May include surrounding context.
Store:

bash
echo 'GITHUB_TOKEN="[TOKEN]"' >> ~/.forge/.env echo 'GITHUB_USERNAME="'$USERNAME'"' >> ~/.forge/.env

Send: "GitHub connected as [username]."

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · prompts/setup.md (reported line 198)May include surrounding context.
Store:

bash
echo 'GITHUB_TOKEN="[TOKEN]"' >> ~/.forge/.env echo 'GITHUB_USERNAME="'$USERNAME'"' >> ~/.forge/.env

Send: "GitHub connected as [username]."

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · prompts/setup.md (reported line 240)May include surrounding context.
Store:

bash
echo 'GITHUB_TOKEN="[TOKEN]"' >> ~/.forge/.env echo 'GITHUB_USERNAME="'$USERNAME'"' >> ~/.forge/.env

Send: "GitHub connected as [username]."

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · prompts/setup.md (reported line 281)May include surrounding context.
Store:

bash
echo 'GITHUB_TOKEN="[TOKEN]"' >> ~/.forge/.env echo 'GITHUB_USERNAME="'$USERNAME'"' >> ~/.forge/.env

Send: "GitHub connected as [username]."

Credential Access

High

Category: Privilege Escalation
Confidence: 98% confidence
Finding: Persisting the ClawHub token in ~/.forge/.env creates the same plaintext secret-storage issue seen with other service credentials. If exposed, an attacker could authenticate to the associated external platform and act as the user or agent.
Content: Scanner excerpt · prompts/setup.md (reported line 239)May include surrounding context.
Store:

bash
echo 'CLAWHUB_TOKEN="[TOKEN]"' >> ~/.forge/.env echo 'CLAWHUB_USERNAME="'$USERNAME'"' >> ~/.forge/.env

Send: "ClawHub connected as [username]."

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The Telegram setup obtains and stores a bot token and chat ID via conversation, then persists them locally. Bot tokens provide full control of the bot and can be abused for message sending, command control, and impersonation if disclosed or mishandled.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 99% confidence
Finding: Writing the Telegram bot token into ~/.forge/.env persists a powerful credential that controls the bot's behavior and messaging. Disclosure could let an attacker impersonate the bot, send messages, change settings, or abuse it as a command channel.
Content: Scanner excerpt · prompts/setup.md (reported line 280)May include surrounding context.
Store:

bash
echo 'TELEGRAM_TOKEN="[TOKEN]"' >> ~/.forge/.env echo 'TELEGRAM_CHAT_ID="[ID]"' >> ~/.forge/.env

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Adding API keys into an agent-managed keyring still involves collecting and retaining high-value secrets within the tool's control plane. Without clear storage protections and retention constraints, this creates another persistent credential repository susceptible to misuse or compromise.
Content: Scanner excerpt · prompts/setup.md (reported line 375)May include surrounding context.
bash
python3 ~/.forge/engine/scripts/validate_key.py gemini [KEY]

On valid, add to keyring:

bash
python3 ~/.forge/engine/keyring/keyring.py add gemini [KEY] "gemini-2"

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The repeated solicitation of additional API keys encourages accumulation of multiple live credentials, increasing total blast radius if the agent or host is compromised. More keys also enable longer autonomous operation, which heightens risk in this skill's already broad operational context.
Content: Scanner excerpt · prompts/setup.md (reported line 377)May include surrounding context.
text
On valid, add to keyring: ```bash python3 ~/.forge/engine/keyring/keyring.py add gemini [KEY] "gemini-2"

Send: "Added. Paste another, or reply done." Repeat until user replies "done".

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: This duplicate match still reflects the same underlying issue: persistent shell-profile sourcing of a secret-bearing env file. Such persistence increases unintended credential propagation and long-term exposure beyond the setup process.
Content: Scanner excerpt · prompts/setup.md (reported line 473)May include surrounding context.
Shell profile:

bash
grep -q "forge" ~/.bashrc || \ echo '[ -f ~/.forge/.env ] && source ~/.forge/.env' >> ~/.bashrc [ -f ~/.zshrc ] && grep -q "forge" ~/.zshrc || \ echo '[ -f ~/.forge/.env ] && source ~/.forge/.env' >> ~/.zshrc 2>/dev/null || true

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: This duplicate match still reflects the same underlying issue: persistent shell-profile sourcing of a secret-bearing env file. Such persistence increases unintended credential propagation and long-term exposure beyond the setup process.
Content: Scanner excerpt · prompts/setup.md (reported line 473)May include surrounding context.
Shell profile:

bash
grep -q "forge" ~/.bashrc || \ echo '[ -f ~/.forge/.env ] && source ~/.forge/.env' >> ~/.bashrc [ -f ~/.zshrc ] && grep -q "forge" ~/.zshrc || \ echo '[ -f ~/.forge/.env ] && source ~/.forge/.env' >> ~/.zshrc 2>/dev/null || true

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 91% confidence
Finding: Persistently adding a command to source ~/.forge/.env from shell startup files matches a persistence mechanism because it ensures FORGE-controlled environment variables load in future sessions. In this context, the behavior is especially dangerous because the sourced file contains accumulated credentials, making them persistently available and easier to abuse.
Content: Scanner excerpt · prompts/setup.md (reported line 473)May include surrounding context.
rname": "[username]", "opencode_verified": true, "opencode_default_model": "gemini-2.0-flash", "browser_binary": "$(cat ~/.forge/engine/.browser_binary)", "workspace": "$HOME/.forge/workspace", "gateway": "[both|telegram]", "evolution_generation": 0, "mutation_strategy": "fork_test_promote", "parallel_forks_max": 3 } EOF

text
Shell profile: ```bash grep -q "forge" ~/.bashrc || \ echo '[ -f ~/.forge/.env ] && source ~/.forge/.env' >> ~/.bashrc [ -f ~/.zshrc ] && grep -q "forge" ~/.zshrc || \ echo '[ -f ~/.forge/.env ] && source ~/.forge/.env' >> ~/.zshrc 2>/dev/null || true

Update state.json: setup_complete: true, wizard_step: "complete", phase: "research".

Start the engine:

bash
systemctl --user start forge 2>/dev/null || \ bash ~/.forge/engine/scripts/start_runner.sh

Send this final message:

⚒ FORGE is ignited.

Identity Name [name] GitHub github.com/[github_username] ClawHub clawhub.dev/[clawhub_username]

Stack

Credential Access

High

Category: Privilege Escalation
Confidence: 96% confidence
Finding: This duplicate finding captures the same insecure shell-profile persistence on the zsh path. The dangerous aspect is the default, repeated loading of a plaintext secret file into user sessions.
Content: Scanner excerpt · prompts/setup.md (reported line 475)May include surrounding context.
grep -q "forge" ~/.bashrc ||
echo '[ -f ~/.forge/.env ] && source ~/.forge/.env' >> ~/.bashrc [ -f ~/.zshrc ] && grep -q "forge" ~/.zshrc ||
echo '[ -f ~/.forge/.env ] && source ~/.forge/.env' >> ~/.zshrc 2>/dev/null || true

text
Update state.json: setup_complete: true, wizard_step: "complete", phase: "research".

Static analysis

No suspicious patterns detected.