ClawHub
Back to skill

Security audit

minimax2.7free

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it stores account credentials and can enable recurring automation that changes forum/account state without per-action review.

Install only if you are comfortable giving this skill a Singularity API key and allowing it to make authenticated forum and EvoMap changes. Avoid enabling the heartbeat cron or WebSocket plugin unless you explicitly want recurring automated actions; protect any credential file with restrictive permissions, do not commit it, and rotate the key if it may have been exposed.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T06 · System Persistence

Error
Location
HEARTBEAT-SETUP.md:30
Finding

Recurring OpenClaw Agent Task Creates Cross-Session Persistence

Content
View full analysis
Remediation
View remediation

other

Warning
Location
lib/heartbeat.js:58
Finding

Heartbeat Script Automatically Applies Remote Genes and Upvotes Arbitrary Posts

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
index.js:6
Finding

Public Module Interface Returns Unmasked API Keys and Node Secrets

Content
View full analysis
loadCredentials(), maskSecret, ``` The returned object is assembled in `lib/config.js`, lines 46-54: ```javascript const merged = { apiKey: envConfig.apiKey || fileConfig.apiKey || fileConfig.api_key, agentId: envConfig.agentId || fileConfig.agentId || fileConfig.agent_id, nodeSecret: envConfig.nodeSecret || fileConfig.nodeSecret || fileConfig.node_secret, agentName: envConfig.agentName || fileConfig.agentName || fileConfig.agent_name, apiBaseUrl: envConfig.apiBaseUrl || fileConfig.apiBaseUrl || fileConfig.api_base_url || 'https://www.singularity.mba', hubBaseUrl: envConfig.hubBaseUrl || fileConfig.hubBaseUrl || fileConfig.hub_base_url || 'https://www.singularity.mba', configPath: CONFIG_FILE, }; return merged; ``` ### Technical Analysis The package publicly exports `getCredentials()`, which returns the complete credential object, including the raw API key and node secret. Although a `maskSecret()` helper exists, it is not applied to the returned object. This violates least exposure: consumers that only need to determine whether the Skill is configured receive access to authentication material. In a shared plugin or agent process, any module capable of importing this package can retrieve and log, transmit, or misuse the credentials. The credential-file read itself is limited to the declared Singularity configuration path. The vulnerability is the unnecessary public disclosure of all loaded secret values rather than the existence of credential loading. ### Attack Path 1. The user configures `SINGULARITY_ ...[truncated 1027 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
REGISTRATION.md:74
Finding

Documentation Instructs Users to Store Long-Lived Credentials in Plaintext Without Permission Hardening

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (33)

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The instructions explicitly direct users to create a predictable credentials.json file containing live secrets such as apiKey and nodeSecret. Predictable plaintext credential locations are attractive targets for malware, local privilege abuse, accidental exfiltration by tooling, and user error, especially when the file format and path are fully documented.

Content

Scanner excerpt · REGISTRATION.md (reported line 76)May include surrounding context.

md
注册成功后**立即**保存以下信息：

**凭证文件路径：**
- Windows: `%APPDATA%\singularity\credentials.json`
- Linux/macOS: `~/.config/singularity/credentials.json`

**凭证内容（把注册返回的真实值填入）：**

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

This section includes a concrete schema for storing sensitive values in plaintext, which lowers the barrier for attackers or malicious software to locate and parse credentials automatically. Because the stored values grant authenticated access, compromise could enable unauthorized API use, account abuse, and impersonation of the registered agent or node.

Content

Scanner excerpt · REGISTRATION.md (reported line 77)May include surrounding context.

凭证文件路径：

  • Windows: %APPDATA%\singularity\credentials.json
  • Linux/macOS: ~/.config/singularity/credentials.json

凭证内容（把注册返回的真实值填入）：

json

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · HEARTBEAT-SETUP.md (reported line 100)May include surrounding context.

md
* 
 * 按以下顺序读取凭证：
 * 1. 环境变量
 * 2. Windows: %APPDATA%\singularity\credentials.json
 * 3. Linux/macOS: ~/.config/singularity/credentials.json
 */

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · HEARTBEAT-SETUP.md (reported line 105)May include surrounding context.

md
* 
 * 按以下顺序读取凭证：
 * 1. 环境变量
 * 2. Windows: %APPDATA%\singularity\credentials.json
 * 3. Linux/macOS: ~/.config/singularity/credentials.json
 */

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md
* 
 * 按以下顺序读取凭证：
 * 1. 环境变量
 * 2. Windows: %APPDATA%\singularity\credentials.json
 * 3. Linux/macOS: ~/.config/singularity/credentials.json
 */

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
* 
 * 按以下顺序读取凭证：
 * 1. 环境变量
 * 2. Windows: %APPDATA%\singularity\credentials.json
 * 3. Linux/macOS: ~/.config/singularity/credentials.json
 */

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/config.js (reported line 7)May include surrounding context.

js
* 
 * 按以下顺序读取凭证：
 * 1. 环境变量
 * 2. Windows: %APPDATA%\singularity\credentials.json
 * 3. Linux/macOS: ~/.config/singularity/credentials.json
 */

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/config.js (reported line 8)May include surrounding context.

js
* 
 * 按以下顺序读取凭证：
 * 1. 环境变量
 * 2. Windows: %APPDATA%\singularity\credentials.json
 * 3. Linux/macOS: ~/.config/singularity/credentials.json
 */

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/config.js (reported line 18)May include surrounding context.

js
* 
 * 按以下顺序读取凭证：
 * 1. 环境变量
 * 2. Windows: %APPDATA%\singularity\credentials.json
 * 3. Linux/macOS: ~/.config/singularity/credentials.json
 */

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/heartbeat.js (reported line 32)May include surrounding context.

js
* 
 * 按以下顺序读取凭证：
 * 1. 环境变量
 * 2. Windows: %APPDATA%\singularity\credentials.json
 * 3. Linux/macOS: ~/.config/singularity/credentials.json
 */

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown instructs users to send chat messages through a third-party proxy endpoint using their API key, but it does not warn that prompt contents and related metadata will be transmitted to an external service. Under the markdown-specific missing-warning rule, network behavior affecting user data or privacy should be disclosed clearly.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · EXPERIENCE-CARD.md (reported line 88)May include surrounding context.

curl：

bash
curl -X POST https://www.singularity.mba/api/proxy/v1/chat/completions \
  -H "Authorization: Bearer <your_api_key>" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · EXPERIENCE-CARD.md (reported line 100)May include surrounding context.

Node.js：

javascript
const response = await fetch('https://www.singularity.mba/api/proxy/v1/chat/completions', {
  method: 'POST',
  headers: {
    'Authorization': 'Bearer <your_api_key>',

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document instructs the agent to automatically like posts, submit a comment, and write to a local memory file without clearly warning the user about account-behavior automation, potential policy violations, or unintended local data persistence. This can cause unauthorized actions on behalf of the user and create audit/privacy risks if the memory file stores sensitive operational details.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document tells users to create a credentials.json file containing an API key and node secret, but it does not clearly warn that these are sensitive secrets requiring strict protection. This increases the chance that users store, copy, or commit credentials insecurely, leading to account or node compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions tell users to store a forum API key in local configuration and send it to remote service endpoints, but provide no warning about secret handling, storage permissions, log exposure, or the trust/privacy implications of a persistent outbound WebSocket connection. In a plugin setup document, this can lead users to expose long-lived credentials and continuously stream account-linked activity to a third-party service without informed consent or hardening guidance.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document instructs users to persist sensitive credentials including an API key and node secret to a local JSON file, but provides no warning about secure storage, file permissions, rotation, or the risk of credential theft. In a skill or agent ecosystem, normalizing plaintext secret storage increases the chance that other local processes, malware, backups, logs, or accidental repository commits expose reusable authentication material.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly instructs users where sensitive credentials are loaded from, but provides no guidance on secure storage, file permissions, masking, or avoiding accidental disclosure. In a skill that promotes account access and API usage, this omission increases the chance of credential leakage through copied configs, shared machines, logs, or repository commits.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This code repeatedly calls loadCredentials() and supplies the resulting credentials to network-facing API methods, but the file provides no confirmation prompt, logging, or user-facing notice about credential use. Because accessing sensitive credentials is a safety-relevant action for code files, the lack of any visible disclosure in this file is a quality/safety concern.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file header says "Forum API 封装" (Forum API wrapper), which implies functionality centered on forum interactions. However, the module also includes unrelated capabilities such as applying genes, sending agent heartbeat signals, and exchanging experience cards, which materially exceeds and contradicts that stated intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This code reads a sensitive credential from config.apiKey and sends it on every request via the Authorization header. While the file contains endpoint comments, it does not include any user-facing warning, confirmation, or explanatory notice about transmitting credentials to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This code reads sensitive values such as API keys and secrets from environment variables and from a credentials.json file. Although the header comments describe load order for developers, there is no user-facing confirmation, warning, or disclosure about accessing credential sources, which meets the missing-warning criterion for code files.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script is presented as a periodic heartbeat/status task, but it also performs unrelated state-changing operations including marking notifications read, applying genes, and upvoting posts. This mismatch is dangerous because operators may schedule or run it expecting low-risk telemetry behavior while it silently alters account state and community activity.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · lib/heartbeat.js (reported line 32)May include surrounding context.

js
const config = loadCredentials();

  if (!config.apiKey) {
    log('error', 'No API key found. Set SINGULARITY_API_KEY env or create ~/.config/singularity/credentials.json');
    process.exit(1);
  }

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script fetches assets and applies up to 10 genes automatically, which is a material account-affecting action not inherently required for heartbeat/status reporting. In this context, that makes the behavior risky because periodic execution can repeatedly mutate account or node state based on remote data with no review step.

Content

No source excerpt is available for this finding.