Feelgoodbot

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:52 AM UTC
• Version: 1.1.0

Overview

This skill is purpose-aligned security tooling, but its setup path installs mutable remote code as a persistent daemon and changes Clawdbot webhook configuration without enough containment.

Review before installing. Pin or verify the feelgoodbot version before running the setup script, inspect the upstream project, ensure the config directory and config.yaml are private to your user, and only enable Clawdbot hooks if you intend to trust this local integration. After setup, enroll and verify TOTP separately before relying on step-up protection.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:16

Finding

Unpinned Remote Dependency Is Downloaded and Executed with Persistent Capabilities

Content

View full analysis

/dev/null || true feelgoodbot daemon stop 2>/dev/null || true feelgoodbot daemon start ``` ### Technical Analysis The setup script downloads the `feelgoodbot` package using the mutable `@latest` reference. This does not pin the installation to a reviewed version or immutable commit and does not verify a checksum or cryptographic signature. Consequently, the effective code executed by the Skill can change after the Skill itself has been reviewed. A compromised upstream repository, maintainer account, release process, Go module dependency, or future malicious release could cause arbitrary code to be installed. The exposure is amplified because the downloaded executable is immediately invoked to initialize a filesystem baseline and install a persistent daemon. The documented monitoring scope includes security-sensitive locations such as launch services, shell configuration, `authorized_keys`, sudoers, and PAM configuration. Although the audited files do not directly modify SSH keys or request elevated privileges, a compromised downloaded executable would run with all permissions held by the invoking user. Installing a daemon is consistent with continuous file-integrity monitoring and is dis ...[truncated 1707 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup.sh:58

Finding

Webhook Authentication Token Is Written Without Enforced Restrictive Permissions

Content

View full analysis

"$CONFIG_DIR/config.yaml" << EOF # feelgoodbot configuration scan_interval: 5m alerts: clawdbot: enabled: true webhook: "http://127.0.0.1:18789/hooks/wake" secret: "$TOKEN" local_notification: true response: on_critical: - alert on_warning: - alert on_info: - log EOF ``` ### Technical Analysis The script writes the Clawdbot webhook authentication token into `~/.config/feelgoodbot/config.yaml`, but it does not set a restrictive `umask`, assign mode `0700` to the configuration directory, or assign mode `0600` to the secret-bearing file. With a common `022` umask, a newly created configuration file may receive mode `0644`, making it readable by other local users. If the file already exists, shell redirection truncates and rewrites it while retaining its existing permission mode, which could already be overly permissive. The webhook is bound to a loopback URL, which reduces remote exposure but does not protect the token from other users or compromised processes on the same host. The token's placement in a plaintext configuration file is operationally understandable, but the file must be protected as credential material. ### Attack Path 1. The setup script creates or overwrites `~/.config/feelgoodbot/config.yaml`. 2. The current umask or pre-existing file mode permits another local account or process to read the file. 3. The attacker extracts the value under `alerts.clawdbot.secret`. 4. The attacker connects locally to `http://127.0.0.1:18789/hooks/wake`. 5. The attacker submits requests authenticated with the exposed token. 6. Depending on the Clawdbot webhook's behavior and downstream controls, the attacker may generate unauthorized wake e ...[truncated 623 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill claims to set up both file integrity monitoring and TOTP step-up authentication, but the documented setup only installs the daemon and configures Clawdbot webhooks; it does not actually configure TOTP by default. That mismatch is dangerous because operators may assume sensitive actions are protected when they are not, and the skill also modifies adjacent infrastructure (Clawdbot hooks and gateway) beyond the core stated purpose, expanding its effective privileges and attack surface.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.

feelgoodbot totp reset

Or manually remove (loses access without backup codes!)

rm ~/.config/feelgoodbot/totp.json rm ~/.config/feelgoodbot/totp-session

text

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

Or manually remove (loses access without backup codes!)

rm ~/.config/feelgoodbot/totp.json rm ~/.config/feelgoodbot/totp-session

text

---

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill description promises TOTP step-up authentication for sensitive actions, but the script never configures any OTP/TOTP mechanism. This is dangerous because users may rely on a claimed security control that is not actually present, leading to a false sense of protection around privileged agent actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill documents manual reset commands that remove TOTP state, but the warning is easy to miss and does not prominently communicate the operational and security consequences. In a security/authentication skill, normalizing direct deletion of auth material can lead users or downstream agents to disable protections and lose recovery capability, weakening the control the skill is supposed to enforce.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script performs side effects beyond a straightforward feelgoodbot install by modifying Clawdbot configuration, generating a webhook token, and restarting the Clawdbot gateway. This is dangerous because users invoking a security-monitoring setup script may not expect unrelated service reconfiguration, which can alter local trust boundaries and create unexpected integration paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script enables webhooks and restarts the Clawdbot gateway automatically, changing system behavior without explicit user approval. In a security-sensitive skill, hidden service reconfiguration is risky because it can expand the attack surface, disrupt existing workflows, or activate integrations the operator did not intend to trust.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup.sh (reported line 55)May include surrounding context.

sh

exit 1
fi

# Create config
CONFIG_DIR=~/.config/feelgoodbot
mkdir -p "$CONFIG_DIR"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script writes the Clawdbot webhook secret directly into a persistent config file under the user's home directory without warning, hardening, or permission checks. If local files are exposed through backup sync, lax filesystem permissions, or another compromise, the secret could be reused to spoof webhook events to the local service.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file header documentation frames this as a feelgoodbot setup script that also configures Clawdbot webhook integration. That documented intent diverges from the declared skill purpose, which emphasizes file integrity monitoring and TOTP step-up authentication; the script's own documentation highlights an additional integration that the manifest does not disclose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.