ClawHub
Back to skill

Security audit

Agentoctopus

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed skill router, but it asks users to trust an external global CLI that can execute, install, overwrite, update, and modify other skills.

Install only if you trust the external AgentOctopus npm package and the skills it can route to. Use least-privilege API keys, protect ~/.agentoctopus/.env, keep evolution disabled unless you intentionally want automated skill changes, and avoid sync/update/force or gateway exposure until you have reviewed the downstream package behavior and access controls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest frames this as a query router, but the documented capabilities extend into package/skill installation, removal, updating, syncing, credential management, server startup, and autonomous evolution. This scope expansion increases the attack surface substantially and can mislead operators or upstream agents into granting trust and permissions appropriate for a simple router when the tool can also mutate the local environment and manage secrets.

Description-Behavior Mismatch

Low
Confidence
94% confidence
Finding
The manifest frames this as a query router, but the documented capabilities extend into package/skill installation, removal, updating, syncing, credential management, server startup, and autonomous evolution. This scope expansion increases the attack surface substantially and can mislead operators or upstream agents into granting trust and permissions appropriate for a simple router when the tool can also mutate the local environment and manage secrets.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
Automated skill evolution introduces self-modification of prompt/instruction artifacts based on runtime signals and LLM-generated proposals. In the context of a router that executes installed skills, this creates a path for prompt drift, malicious behavior injection through feedback or upstream skill content, and persistence via snapshots/history that is far more dangerous than the stated routing purpose suggests.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
A public self-service API key registration endpoint is highly sensitive and not justified by a routing function. Public credential registration expands exposure to unauthorized key submission, account abuse, poisoning of downstream configuration, and potentially privilege escalation depending on how registered keys are stored and associated.

Vague Triggers

Medium
Confidence
83% confidence
Finding
The invocation description is broad enough that many natural-language requests could match this router, causing it to activate frequently and then dispatch to other skills or direct LLM fallback. In a multi-skill environment, over-broad routing can become a security boundary issue by triggering unexpected side-effecting tools or bypassing more specific invocation controls.

Self-Modification

High
Category
Rogue Agent
Content
--cloud-url <url>          # sync from a cloud AgentOctopus instance
  --category <name>          # install only skills from one category
  --check                    # show available updates without installing
  --force                    # overwrite existing skills
  --dry-run                  # preview without changes
  --ratings                  # sync ratings specifically
  --pull                     # pull ratings from cloud (shorthand)
Confidence
96% confidence
Finding
overwrite existing skill

Self-Modification

High
Category
Rogue Agent
Content
--run                     # interactively pick a skill and run a query against it
octopus add <slug>           # install a skill from ClawHub
  --version <version>        # install a specific version
  --force                    # overwrite existing skill
octopus remove <name>        # remove an installed skill
octopus update               # check and install latest @agentoctopus npm packages
  --check                    # show updates without installing (exits code 1 if updates exist)
Confidence
95% confidence
Finding
overwrite existing skill

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.