Feelgoodbot

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:52 AM UTC
• Version: 1.1.0

Overview

This skill is purpose-aligned security tooling, but its setup path installs mutable remote code as a persistent daemon and changes Clawdbot webhook configuration without enough containment.

Review before installing. Pin or verify the feelgoodbot version before running the setup script, inspect the upstream project, ensure the config directory and config.yaml are private to your user, and only enable Clawdbot hooks if you intend to trust this local integration. After setup, enroll and verify TOTP separately before relying on step-up protection.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:16
• Finding: Unpinned Remote Dependency Is Downloaded and Executed with Persistent Capabilities<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh:16` (with subsequent execution at lines 29 and 85-87) **Vulnerability Type**: Unpinned third-party dependency and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```bash # Install feelgoodbot echo "📦 Installing feelgoodbot..." go install github.com/kris-hansen/feelgoodbot/cmd/feelgoodbot@latest ``` The downloaded executable is subsequently run and installed as a daemon: ```bash # Initialize if no baseline exists if [ ! -f ~/.config/feelgoodbot/snapshots/baseline.json ]; then echo "📸 Creating initial baseline..." feelgoodbot init else echo "✓ Baseline already exists" fi ``` ```bash # Install and start daemon echo "🚀 Installing daemon..." feelgoodbot daemon install 2>/dev/null || true feelgoodbot daemon stop 2>/dev/null || true feelgoodbot daemon start ``` ### Technical Analysis The setup script downloads the `feelgoodbot` package using the mutable `@latest` reference. This does not pin the installation to a reviewed version or immutable commit and does not verify a checksum or cryptographic signature. Consequently, the effective code executed by the Skill can change after the Skill itself has been reviewed. A compromised upstream repository, maintainer account, release process, Go module dependency, or future malicious release could cause arbitrary code to be installed. The exposure is amplified because the downloaded executable is immediately invoked to initialize a filesystem baseline and install a persistent daemon. The documented monitoring scope includes security-sensitive locations such as launch services, shell configuration, `authorized_keys`, sudoers, and PAM configuration. Although the audited files do not directly modify SSH keys or request elevated privileges, a compromised downloaded executable would run with all permissions held by the invoking user. Installing a daemon is consistent with continuous file-integrity monitoring and is dis ...[truncated 1707 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with a reviewed, immutable version or commit: ```bash go install github.com/kris-hansen/feelgoodbot/cmd/feelgoodbot@vX.Y.Z ``` 2. Maintain and review `go.sum` data for a reproducible build rather than resolving dependencies dynamically during setup. 3. Verify release checksums or cryptographic signatures before executing the binary. 4. Prefer distributing a reproducibly built, signed artifact from a trusted release process. 5. Audit transitive Go dependencies and automate vulnerability scanning. 6. Separate installation from execution so the user can inspect the resolved version before initialization. 7. Display the exact version and source to the user and require explicit confirmation before installing the daemon. 8. Run the daemon with the least-privileged account and narrowly scoped filesystem permissions required for monitoring. 9. Document how to stop and uninstall the daemon and remove all generated configuration. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup.sh:58
• Finding: Webhook Authentication Token Is Written Without Enforced Restrictive Permissions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh:58-76` **Vulnerability Type**: Insecure storage of a sensitive authentication token **Risk Level**: Medium ### Vulnerable Code ```bash # Create config CONFIG_DIR=~/.config/feelgoodbot mkdir -p "$CONFIG_DIR" cat > "$CONFIG_DIR/config.yaml" << EOF # feelgoodbot configuration scan_interval: 5m alerts: clawdbot: enabled: true webhook: "http://127.0.0.1:18789/hooks/wake" secret: "$TOKEN" local_notification: true response: on_critical: - alert on_warning: - alert on_info: - log EOF ``` ### Technical Analysis The script writes the Clawdbot webhook authentication token into `~/.config/feelgoodbot/config.yaml`, but it does not set a restrictive `umask`, assign mode `0700` to the configuration directory, or assign mode `0600` to the secret-bearing file. With a common `022` umask, a newly created configuration file may receive mode `0644`, making it readable by other local users. If the file already exists, shell redirection truncates and rewrites it while retaining its existing permission mode, which could already be overly permissive. The webhook is bound to a loopback URL, which reduces remote exposure but does not protect the token from other users or compromised processes on the same host. The token's placement in a plaintext configuration file is operationally understandable, but the file must be protected as credential material. ### Attack Path 1. The setup script creates or overwrites `~/.config/feelgoodbot/config.yaml`. 2. The current umask or pre-existing file mode permits another local account or process to read the file. 3. The attacker extracts the value under `alerts.clawdbot.secret`. 4. The attacker connects locally to `http://127.0.0.1:18789/hooks/wake`. 5. The attacker submits requests authenticated with the exposed token. 6. Depending on the Clawdbot webhook's behavior and downstream controls, the attacker may generate unauthorized wake e ...[truncated 623 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Set a restrictive umask before creating any credential-bearing files: ```bash umask 077 ``` 2. Create the configuration directory with an explicit mode: ```bash install -d -m 0700 "$HOME/.config/feelgoodbot" ``` 3. Create the configuration in a temporary file owned by the current user, set mode `0600`, and atomically rename it into place. 4. Explicitly correct the final permissions even when the file already exists: ```bash chmod 0600 "$CONFIG_DIR/config.yaml" ``` 5. Verify that the file is owned by the intended user and reject symlinks or unexpected file types before overwriting it. 6. Where supported, store the token in the macOS Keychain and keep only a credential reference in the YAML configuration. 7. Rotate the webhook token if insecure permissions are detected or if the file may have been exposed. 8. Validate permissions during daemon startup and refuse to run when the token file is accessible to group or other users. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill claims to set up both file integrity monitoring and TOTP step-up authentication, but the documented setup only installs the daemon and configures Clawdbot webhooks; it does not actually configure TOTP by default. That mismatch is dangerous because operators may assume sensitive actions are protected when they are not, and the skill also modifies adjacent infrastructure (Clawdbot hooks and gateway) beyond the core stated purpose, expanding its effective privileges and attack surface.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

feelgoodbot totp reset

# Or manually remove (loses access without backup codes!)
rm ~/.config/feelgoodbot/totp.json
rm ~/.config/feelgoodbot/totp-session
```

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Or manually remove (loses access without backup codes!)
rm ~/.config/feelgoodbot/totp.json
rm ~/.config/feelgoodbot/totp-session
```

---

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The skill description promises TOTP step-up authentication for sensitive actions, but the script never configures any OTP/TOTP mechanism. This is dangerous because users may rely on a claimed security control that is not actually present, leading to a false sense of protection around privileged agent actions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill documents manual reset commands that remove TOTP state, but the warning is easy to miss and does not prominently communicate the operational and security consequences. In a security/authentication skill, normalizing direct deletion of auth material can lead users or downstream agents to disable protections and lose recovery capability, weakening the control the skill is supposed to enforce.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The script performs side effects beyond a straightforward feelgoodbot install by modifying Clawdbot configuration, generating a webhook token, and restarting the Clawdbot gateway. This is dangerous because users invoking a security-monitoring setup script may not expect unrelated service reconfiguration, which can alter local trust boundaries and create unexpected integration paths.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script enables webhooks and restarts the Clawdbot gateway automatically, changing system behavior without explicit user approval. In a security-sensitive skill, hidden service reconfiguration is risky because it can expand the attack surface, disrupt existing workflows, or activate integrations the operator did not intend to trust.

Session Persistence

Medium

• Category: Rogue Agent

Content

exit 1
fi

# Create config
CONFIG_DIR=~/.config/feelgoodbot
mkdir -p "$CONFIG_DIR"

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script writes the Clawdbot webhook secret directly into a persistent config file under the user's home directory without warning, hardening, or permission checks. If local files are exposed through backup sync, lax filesystem permissions, or another compromise, the secret could be reused to spoof webhook events to the local service.

Intent-Code Divergence

Low

• Confidence: 83% confidence
• Finding: The file header documentation frames this as a feelgoodbot setup script that also configures Clawdbot webhook integration. That documented intent diverges from the declared skill purpose, which emphasizes file integrity monitoring and TOTP step-up authentication; the script's own documentation highlights an additional integration that the manifest does not disclose.

Static analysis

No suspicious patterns detected.