Agentoctopus

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:24 AM UTC
• Version: 1.3.0

Overview

This skill is disclosed as a powerful router, but it can install, overwrite, update, evolve, and execute skills from remote sources with limited documented trust controls.

Review this carefully before installing. Use it only if you trust the npm package publisher and the skill sources you sync from; prefer pinned versions, avoid arbitrary cloud URLs, avoid --force unless you have reviewed the replacement, keep evolution disabled unless you want routing behavior to change over time, and do not paste real API keys directly into shell commands where they may enter history.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12
• Finding: Unpinned Global Installation of an Executable npm Package## Vulnerability Details **File Location**: `SKILL.md`, lines 12-16 **Vulnerability Type**: Unpinned executable dependency and supply-chain exposure **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash ## Install npm install -g agentoctopus ``` ### Technical Analysis The documented installation command globally installs the `agentoctopus` npm package without pinning an exact, audited version or verifying package integrity. A global npm installation exposes package executables through the user's command path and may run package lifecycle scripts during installation. The reviewed project contains only `SKILL.md`; it does not include the installed package's source code, a dependency lockfile, integrity hashes, or signed provenance. Consequently, the behavior of the executable dependency cannot be verified from the reviewed artifact, and future package releases can change the effective implementation after this Skill has been audited. ### Attack Path 1. An attacker compromises the npm publisher account, package repository, release pipeline, or one of the package's transitive dependencies. 2. The attacker publishes a malicious version under the expected package name. 3. A user follows the unpinned `npm install -g agentoctopus` instruction. 4. npm resolves the package to the compromised release. 5. Malicious lifecycle scripts or installed CLI code execute with the privileges of the installing user. 6. The compromised executable can subsequently intercept routed queries, access user-readable files, or alter installed skills. ### Impact Assessment Successful exploitation can provide arbitrary code execution with the privileges of the user performing the installation. The affected scope may include the user's files, environment variables, API credentials, command history, network access, and other resources available to that account. Administrative impact is possible if the installation is performed through an elev ...[truncated 91 chars]
• Remediation: ## Remediation Suggestions - Pin the installation command to an exact, reviewed package version rather than resolving the latest release. - Publish and verify package integrity hashes or signed build provenance. - Avoid global installation where possible; use a project-local, isolated installation. - Include auditable source code, a lockfile, and reproducible build documentation in the reviewed project. - Disable npm lifecycle scripts during installation unless they are explicitly required and independently reviewed. - Document the package publisher, expected integrity value, and supported version. - Periodically re-audit dependency updates before recommending newer releases.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43
• Finding: Remotely Sourced Skills Are Fed into a Local Execution Pipeline Without Documented Trust Controls## Vulnerability Details **File Location**: `SKILL.md`, lines 43-56 and 91-101 **Vulnerability Type**: Unsafe third-party skill acquisition and execution **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash octopus sync # interactive: sync skills from ClawHub, ratings from GitHub Gist --cloud-url <url> # sync from a cloud AgentOctopus instance --category <name> # install only skills from one category --check # show available updates without installing --force # overwrite existing skills --dry-run # preview without changes --ratings # sync ratings specifically --pull # pull ratings from cloud (shorthand) --push # push ratings to cloud (shorthand) octopus search <query> # search local skills with scored relevance ranking --run # interactively pick a skill and run a query against it octopus add <slug> # install a skill from ClawHub --version <version> # install a specific version --force # overwrite existing skill ``` ```text 1. **Embedding index** — each skill's name and description is embedded. The query is embedded against this index. 2. **Cosine similarity + keyword boost** — skills are scored; ineligible skills (wrong OS, missing binaries, missing env vars) are filtered out. 3. **LLM re-rank** — top candidates are sent to the chat LLM with `"none"` as a valid answer. If the LLM returns `"none"`, no skill runs. 4. **Execute** — the best skill is executed via the appropriate adapter (subprocess, HTTP, or MCP, inferred from the skill directory). On failure, the next candidate is tried (up to `maxRetries`, default 3). 5. **Fallback** — if all candidates fail or no skill matches, the query is answered directly by the chat LLM. ``` ### Technical ...[truncated 1990 chars]
• Remediation: ## Remediation Suggestions - Restrict skill sources to a documented allowlist; do not accept arbitrary cloud URLs by default. - Require cryptographic signatures, immutable versions, and verified integrity hashes for every downloaded skill. - Validate publisher identity and show provenance information before installation. - Display a capability manifest and obtain explicit approval for subprocess, filesystem, network, credential, HTTP, or MCP access. - Execute third-party skills in a sandbox with default-deny filesystem and network policies. - Prevent newly synchronized or updated skills from executing until they have been reviewed or explicitly approved. - Require additional confirmation before `--force` overwrites an installed skill. - Separate semantic ranking from execution so that metadata processing does not implicitly authorize code execution. - Log the selected skill, verified version, source, requested capabilities, and execution result without recording secrets.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:77
• Finding: API Credentials Are Supplied Through Command-Line Arguments and Stored in a Plaintext Environment File## Vulnerability Details **File Location**: `SKILL.md`, lines 77-84 and 129-140 **Vulnerability Type**: Insecure credential input and storage guidance **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash octopus onboard # interactive setup wizard (LLM provider, model, embed, API keys) octopus connect openclaw # import LLM config from an existing OpenClaw installation octopus config set <key> <value> # save a credential to ~/.agentoctopus/.env octopus config list # show resolved configuration (keys masked) octopus start # start the gateway server on port 3002 ``` ```text Config is stored in `~/.agentoctopus/octopus.json` with secrets in `~/.agentoctopus/.env`. ``` ```bash octopus config set OPENAI_API_KEY sk-abc123... ``` ### Technical Analysis The documented `octopus config set <key> <value>` interface places secret values directly in process arguments. Command-line arguments may be retained in shell history, terminal recordings, audit telemetry, support transcripts, or process inspection output. Masking values in `octopus config list` does not protect credentials already exposed through the original command line. The documentation also states that secrets are written to `~/.agentoctopus/.env`, but it does not specify restrictive permissions, atomic creation, symlink protections, encryption, or use of an operating-system credential store. Credential storage is necessary for authenticated LLM services, but transmitting secrets in argv is not required for that functionality. Importing configuration from an existing OpenClaw installation also broadens access to another application's sensitive configuration. Such access may be legitimate for migration, but it should be limited to explicit user-selected fields and should not copy unrelated secrets. ### Attack Path 1. A user follows the example and enters a real API key as the command's valu ...[truncated 952 chars]
• Remediation: ## Remediation Suggestions - Read credentials through an interactive no-echo prompt or standard input rather than a command-line argument. - Provide a dedicated option such as `--secret-stdin` and document secure automation through protected file descriptors. - Avoid placing realistic credential prefixes in examples; use an unmistakably synthetic placeholder. - Store secrets in an operating-system credential manager or dedicated secrets service where available. - If a local file is required, create it atomically with permission mode `0600` and verify ownership before reading or writing. - Reject symbolic links and unsafe parent-directory permissions when creating the secret file. - Never print complete credentials in command output, debug logs, errors, telemetry, or session metadata. - During OpenClaw import, show the exact fields to be imported and require explicit confirmation. - Copy only credentials required for enabled providers and preserve least-privilege provider scopes. - Document credential rotation and revocation procedures for potentially exposed keys.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (9)

Self-Modification

High

• Category: Rogue Agent

Content

--cloud-url <url>          # sync from a cloud AgentOctopus instance
  --category <name>          # install only skills from one category
  --check                    # show available updates without installing
  --force                    # overwrite existing skills
  --dry-run                  # preview without changes
  --ratings                  # sync ratings specifically
  --pull                     # pull ratings from cloud (shorthand)

• Confidence: 95% confidence
• Finding: The ability to sync skills from remote sources and overwrite existing skills creates a self-modifying code path. If the remote source, cloud instance, or update channel is compromised—or if provenance checks are weak—the router can replace local skills with malicious content that will later be selected and executed automatically.

Self-Modification

High

• Category: Rogue Agent

Content

--run                     # interactively pick a skill and run a query against it
octopus add <slug>           # install a skill from ClawHub
  --version <version>        # install a specific version
  --force                    # overwrite existing skill
octopus remove <name>        # remove an installed skill
octopus update               # check and install latest @agentoctopus npm packages
  --check                    # show updates without installing (exits code 1 if updates exist)

• Confidence: 95% confidence
• Finding: Installing a skill from ClawHub with an option to overwrite an existing skill similarly enables remote code acquisition and replacement. Because AgentOctopus later routes and executes installed skills, a malicious or tampered package can gain execution through normal routing behavior, turning installation/update into a high-impact supply-chain risk.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
octopus onboard              # interactive setup wizard (LLM provider, model, embed, API keys)
octopus connect openclaw     # import LLM config from an existing OpenClaw installation
octopus config set <key> <value>  # save a credential to ~/.agentoctopus/.env
octopus config list          # show resolved configuration (keys masked)
octopus start                # start the gateway server on port 3002
```

• Confidence: 84% confidence
• Finding: The skill explicitly stores credentials in '~/.agentoctopus/.env' and supports importing LLM configuration from another installation. While local secret storage is common, this router also syncs skills, executes external adapters, and exposes an HTTP API, so concentrated secret handling inside the same operational context increases the blast radius if the environment, logs, or filesystem permissions are weak.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill’s declared purpose is query routing, but the documented capabilities also include remote skill installation, syncing from cloud sources, package updates, server hosting, and autonomous evolution. This large expansion of authority materially increases attack surface and enables the router to fetch, modify, and execute additional code or services beyond what a user would reasonably expect from a routing skill.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The broad natural-language invocation model can cause the router to activate on loosely related requests and forward them to a matched skill without precise user intent. In a system that can execute skills through subprocess, HTTP, or MCP, accidental activation increases the risk of unintended actions, data exposure, or execution of a more privileged skill than the user expected.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The description does not prominently warn that user queries may be sent to external services and that matched skills may execute via subprocess or HTTP. This weakens informed consent and can lead users to disclose sensitive information or authorize a seemingly simple routing action that actually triggers remote transmission and code execution pathways.

Session Persistence

Medium

• Category: Rogue Agent

Content

--cloud-url <url>          # sync from a cloud AgentOctopus instance
  --category <name>          # install only skills from one category
  --check                    # show available updates without installing
  --force                    # overwrite existing skills
  --dry-run                  # preview without changes
  --ratings                  # sync ratings specifically
  --pull                     # pull ratings from cloud (shorthand)

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

octopus remove <name>        # remove an installed skill
octopus update               # check and install latest @agentoctopus npm packages
  --check                    # show updates without installing (exits code 1 if updates exist)
  -y, --yes                  # skip confirmation prompt
octopus evolve               # AI-powered skill evolution management
  --check                    # show evolution status for all skills
  --propose <skill>           # trigger analysis for a specific skill

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Autonomous skill evolution lets the system analyze skills and apply changes based on runtime signals, including automatic application of some modifications and generation of risky proposals. For a router, this creates a self-modifying execution environment where prompts, requirements, and behavior can drift over time, increasing the chance of prompt-injection persistence, unsafe policy changes, or supply-chain compromise.

Static analysis

No suspicious patterns detected.