Import

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:25 AM UTC
• Version: 1.2.4

Overview

This migration skill is understandable for its purpose, but it asks for broad access to private agent data and secrets with limited review controls and mutable runtime tooling.

Review carefully before installing. Use it only if you intend to migrate the full agent state to LaunchThatBot, and prefer an air-gapped or pinned-tool workflow. Before approving an export, inspect the exact files being sent, exclude memory or third-party skills that may contain secrets, verify the API destination is official, and avoid running unpinned npx commands for tools that will touch tokens or private data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

other

Error

• Location: SKILL.md:155
• Finding: Broad Collection and External Transmission of Sensitive Agent Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:155-167`, `SKILL.md:203-226` **Vulnerability Type**: `other: Sensitive Data Exfiltration` **Risk Level**: High ### Vulnerable Code ```markdown ### Step 3: Collect Agent Data Gather the following from the local filesystem: **soul.md** (agent personality/instructions): - Check `/home/node/.openclaw/config/agents/*/soul.md` - Or wherever the agent's soul.md is located **Memory files**: - Check `/home/node/.openclaw/memory/` - Include all `.md` and `.json` files **Skills**: - Check `/home/node/.openclaw/skills/` - Include all skill directories and their contents - Exclude this skill (`launchthatbot-import`) from the export **Environment secrets** (`.env` file): - Read `/home/node/.openclaw/.env` - Parse each `KEY=VALUE` line - These will be encrypted before sending ``` ```markdown ### Step 6A (Quick API): Send the Payload (via mcporter) Send everything via LaunchThatBot MCP through `mcporter`: npx -y mcporter call launchthatbot.import_push --args '{ "importToken": "<importToken>", "apiUrl": "https://api.ltb.it.com", "payload": { "config": { "soulMd": "<contents of soul.md>", "memory": [ { "filename": "MEMORY.md", "content": "<file contents>" }, { "filename": "daily-log.json", "content": "<file contents>" } ], "skills": [ { "path": "web-search/SKILL.md", "content": "<file contents>" }, { "path": "email-sender/SKILL.md", "content": "<file contents>" } ] }, "encryptedSecrets": [ { "key": "OPENAI_API_KEY", "ciphertextB64": "<base64 encrypted value>" }, { "key": "ANTHROPIC_API_KEY", "ciphertextB64": "<base64 encrypted value>" } ] } }' ``` ### Technical Analysis The Skill explicitly instructs the Agent to enumerate and read broad categories of private OpenClaw state: - Agent personality and instruction files. - Every Markdown and JSON memory file. - Every file in every installed Skill directory, ...[truncated 2463 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace recursive collection with an explicit allowlist of user-selected files. 2. Require separate opt-in approval for configuration, memory, Skills, and credentials. 3. Before approval, display every proposed path, file size, content category, destination hostname, and payload encryption status. 4. Scan all exported files for API keys, tokens, private keys, passwords, cookies, connection strings, and other secret patterns. 5. Encrypt and authenticate the entire migration payload, not only values parsed from `.env`. 6. Preserve relative paths safely while rejecting symbolic links, path traversal, device files, sockets, and files outside the approved OpenClaw directories. 7. Apply strict size and file-count limits to prevent accidental bulk disclosure or denial of service. 8. Default to excluding memory and third-party Skill contents unless the user explicitly selects them. 9. Provide a dry-run manifest and require confirmation against a cryptographic hash of that exact manifest. 10. Document which destination components can access payload metadata and plaintext after decryption. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:127
• Finding: Destination-Provided Encryption Key Does Not Independently Authenticate the Recipient<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:127-148`, `SKILL.md:169-194` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: High ### Vulnerable Code ```markdown ### Step 1: Collect Information from the User Ask the user for: 1. **Import Token** -- a 64-character hex string from the LaunchThatBot dashboard 2. **API URL** -- the LaunchThatBot API URL (default: `https://api.ltb.it.com`) The user gets the import token by clicking **Import Agent** on their agent's detail page in the LaunchThatBot dashboard. ### Step 2A (Quick API): Fetch the Public Key (Handshake via mcporter) Call LaunchThatBot MCP through `mcporter`: npx -y mcporter call launchthatbot.import_handshake \ importToken:"<importToken>" \ apiUrl:"https://api.ltb.it.com" Response: { "publicKey": "-----BEGIN PUBLIC KEY-----\n...\n-----END PUBLIC KEY-----", "agentName": "My Agent", "expiresAt": 1708000000000 } ``` ```javascript const crypto = require("crypto"); function encryptSecret(value, publicKeyPem) { const encrypted = crypto.publicEncrypt( { key: publicKeyPem, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256", }, Buffer.from(value, "utf8"), ); return encrypted.toString("base64"); } ``` ### Technical Analysis RSA-OAEP with SHA-256 is an appropriate encryption primitive when the public key is authentic. The weakness is key authentication rather than the encryption algorithm. In quick mode, the public key is obtained from the same configurable API destination that receives the resulting ciphertext. The documented process does not require: - An allowlist for the API origin. - A pinned TLS certificate or public key. - A trusted signature over the returned import public key. - Out-of-band verification of the key fingerprint. - Redirect rejection. - Binding between the key, target Agent, import token, and expiration time through independently verified signed metadata. Because the ...[truncated 1929 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Restrict quick mode to a hardcoded allowlist of official HTTPS origins unless an advanced override is explicitly enabled. 2. Authenticate handshake metadata with a vendor signing key embedded or pinned in the audited Skill. 3. Sign the public key together with the import token hash, target Agent identifier, API origin, expiration time, and protocol version. 4. Verify the signature locally before reading or encrypting any secret. 5. Display the recipient key fingerprint and require out-of-band verification for custom endpoints and air-gapped sessions. 6. Reject HTTP, URL credentials, unexpected ports, redirects, non-canonical hostnames, and hostname changes between handshake and upload. 7. Bind the upload cryptographically to the verified handshake response. 8. Encrypt and authenticate the complete payload using a hybrid encryption scheme, such as an authenticated symmetric cipher with its key wrapped by the verified RSA key. 9. Clearly warn that encryption provides confidentiality only if the recipient public key is authentic. 10. Avoid sending the import token to any endpoint before destination verification succeeds. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:91
• Finding: Mutable Unpinned Packages Are Downloaded and Executed in the Sensitive Migration Path<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:91-109`, `SKILL.md:136`; `README.md:20-27` **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: High ### Vulnerable Code ```markdown 1. Check `mcporter` is runnable: ```bash mcporter --version || npx -y mcporter --version ``` 2. Check LaunchThatBot MCP is configured and discoverable: ```bash (mcporter list || npx -y mcporter list) (mcporter list launchthatbot --schema || npx -y mcporter list launchthatbot --schema) ``` Recommended MCP config: ```json { "mcpServers": { "launchthatbot": { "command": "npx", "args": ["-y", "@launchthatbot/mcp-server"] } } } ``` ``` ```markdown npx -y mcporter call launchthatbot.import_handshake \ importToken:"<importToken>" \ apiUrl:"https://api.ltb.it.com" ``` ```markdown npx clawhub@latest install launchthatbot-import ``` ### Technical Analysis The documented workflow downloads and executes packages through `npx` without exact versions or integrity hashes. The installation instructions also use the mutable `@latest` tag. The project has no lockfile governing these runtime tools, and `package.json` does not declare or pin them as dependencies. This creates a supply-chain boundary in the most sensitive part of the workflow. `mcporter` and `@launchthatbot/mcp-server` handle the import token, handshake response, complete migration payload, encrypted secret values, and plaintext configuration data. A compromised publisher account, malicious package update, registry compromise, or unexpected dependency change could execute arbitrary code with the Agent's local permissions. The `-y` option suppresses the interactive installation prompt, reducing the opportunity for a user to inspect the exact package and version before execution. Although the audit did not identify an already malicious package inside this repository, the instructions allow the effective executable code to change after review. ### Attack Path 1. An at ...[truncated 1501 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin exact audited versions of `mcporter`, `@launchthatbot/mcp-server`, and the installer rather than using implicit latest versions or `@latest`. 2. Verify package integrity using trusted hashes or signed provenance before execution. 3. Declare runtime tools in a lockfile-backed dependency manifest and distribute a reproducible installation. 4. Remove `npx -y` fallback execution from the sensitive migration flow. 5. Require the user to install and verify dependencies before any private data or token is collected. 6. Use package-manager settings that disable lifecycle scripts unless they are explicitly required and audited. 7. Run the MCP process in a sandbox with read access only to a prepared migration staging directory. 8. Restrict outbound network access to the authenticated, allowlisted migration endpoint. 9. Separate data collection and network submission into different least-privileged processes. 10. Publish checksums, software bills of materials, signed releases, and reproducible build instructions for all migration components. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to execute `npx clawhub@latest install launchthatbot-import`, which fetches and runs remote package code at the latest version rather than a pinned, reviewed release. That creates a supply-chain risk: if the package is compromised or a breaking/malicious version is published, users may execute attacker-controlled code during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The fallback command `npx -y mcporter --version` executes an unpinned package from the registry if `mcporter` is not already installed locally. Because no version is pinned, users may run whatever code is published as the current latest package, exposing them to dependency confusion or package compromise risks.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The command `mcporter list || npx -y mcporter list` includes an unpinned `npx` fallback that may download and execute the latest registry version of `mcporter`. In a security-sensitive migration workflow involving agent configuration and encrypted secrets, running unreviewed tooling increases the chance of local compromise or interception before encryption.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The command `mcporter list launchthatbot --schema || npx -y mcporter list launchthatbot --schema` again permits execution of an unpinned remote package. In this skill's context, the tool is used immediately before an import flow handling agent config, memory, skills, and encrypted secrets, so compromise of the helper binary could subvert the migration process, exfiltrate data before encryption, or tamper with what gets imported.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill tells the agent to run `npx -y mcporter` without pinning a specific version, which causes arbitrary latest code from the package registry to be fetched and executed at runtime. In this skill's context, that tool is then used in a workflow that reads local config, memory, skills, and secrets, so a compromised or malicious package update could exfiltrate sensitive data or alter the transfer process.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: This instruction recommends enabling or installing `npx mcporter` without a pinned version, again creating a supply-chain execution point where unreviewed code may be downloaded and run. Because this skill is specifically designed to operate on agent state and secrets, the blast radius is larger than a normal convenience command.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The `mcporter list` fallback to `npx -y mcporter list` executes code from the registry if the local binary is missing, with no version pinning or integrity assurance. In a skill that automates migration of highly sensitive local artifacts, this introduces a practical supply-chain path to code execution and data exposure.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The recommended MCP config runs `npx -y @launchthatbot/mcp-server` without pinning an exact version, allowing whatever package version is current at execution time to run with the agent's privileges. Since this MCP server participates directly in the secret-import flow, a malicious or compromised release could intercept tokens, manipulate public keys, or alter payload handling.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The handshake step uses `npx -y mcporter call ...` without version pinning, meaning the transport/helper code that handles the one-time import token and server response can change unexpectedly. In context, this is especially dangerous because the command initiates trust establishment for encryption material, so compromised helper code could substitute keys or leak credentials.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The schema validation step again relies on unpinned `npx -y mcporter`, repeating the same supply-chain risk throughout the workflow. Repetition makes the issue more dangerous because users are nudged to execute the unsafe pattern multiple times, increasing exposure to compromised package resolution or typosquatting attacks.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The final data push step uses unpinned `npx -y mcporter` while sending the full export payload, making this the highest-value execution point for a supply-chain compromise. A malicious package at this stage could capture config, memory contents, skill files, import tokens, and encrypted secret blobs, or redirect data to an attacker-controlled endpoint.

Whitespace Padding

Medium

• Category: Prompt Injection

Content

## Error Handling

| Error                     | What to Do                                                                                       |
| ------------------------- | ------------------------------------------------------------------------------------------------ |
| 401 Unauthorized          | Token is invalid, expired, or already used. Generate a new one from the LaunchThatBot dashboard. |
| 400 Bad Request           | Check the payload format matches the schema above.                                               |

• Confidence: 70% confidence
• Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Vague Triggers

Low

• Confidence: 86% confidence
• Finding: The skill says to act when the user says something like "export my config to LaunchThatBot" or "migrate to LaunchThatBot," but it does not define a precise trigger set, scope boundaries, or negative examples. This ambiguity could cause unintended invocation for casual discussion about migration rather than an explicit request to run the export workflow.

Natural-Language Policy Violations

Low

• Confidence: 75% confidence
• Finding: The natural-language instructions tell the agent to contact support on the LaunchThatBot Discord for server-side issues, which can impose a communication-channel preference on users. There is no opt-in framing or equivalent alternative in the operational guidance at that point, so the instruction may violate organizational policy against forcing a specific user-facing channel without choice.