Idle Ping — Proactive Outreach System

• Outcome: Review
• Latest audit: Aug 29, 2026 · 4:02 PM UTC
• Version: 1.0.1

Overview

This skill appears purpose-built for proactive outreach, but it installs persistent automation that reads local session/persona context and sends Telegram messages, with enough control and validation gaps to require Review before installation.

Install only if you intentionally want recurring background OpenClaw jobs that monitor idle time, crawl external sources, store local queue/state/history, and send Telegram messages. Use dry-run or --no-cron first, set a daily cap and quiet hours, keep TELEGRAM_ID and workspace path simple and trusted, and plan how you will disable or remove the cron jobs later.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (35)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if link:
                cmd += ["--link", link]
            try:
                subprocess.run(cmd, capture_output=True, text=True, timeout=30)
                stored += 1
            except Exception as e:
                print(f"[auto] {chan} 入倉失敗: {e}")

• Confidence: 91% confidence
• Finding: This subprocess call passes LLM-derived/category-derived content and remotely fetched titles/links into another local script as command-line arguments. While shell injection is mitigated by argv usage, this is still an unvalidated output-to-action bridge: untrusted external content can cause unintended queue entries, poison downstream automation, or exploit unsafe argument handling inside share-queue.py.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if link:
                cmd += ["--link", link]
            try:
                subprocess.run(cmd, capture_output=True, text=True, timeout=30)
                stored += 1
            except Exception as e:
                print(f"[rotation] {chan} 入倉失敗: {e}")

• Confidence: 91% confidence
• Finding: This queue-insertion subprocess consumes untrusted data aggregated from news, arXiv, and Reddit plus LLM summarization output. In a proactive agent skill, that creates a dangerous autonomous pipeline where external content can influence local actions and stored artifacts without human review.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if link:
                cmd += ["--link", link]
            try:
                subprocess.run(cmd, capture_output=True, text=True, timeout=30)
                stored += 1
            except Exception as e:
                print(f"[rotation] 入倉失敗: {e}")

• Confidence: 91% confidence
• Finding: This is the same output-handling issue in rotation mode: topic-driven, multi-source external data is summarized and immediately converted into a subprocess action. The vulnerability is the autonomous execution of downstream actions based on untrusted network and model output, not classic shell metacharacter injection.

Tainted flow: 'cmd' from os.environ.get (line 911, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

if link:
                cmd += ["--link", link]
            try:
                subprocess.run(cmd, capture_output=True, text=True, timeout=30)
                stored += 1
            except Exception as e:
                print(f"[auto] {chan} 入倉失敗: {e}")

• Confidence: 89% confidence
• Finding: The command vector includes values ultimately derived from external feeds and LLM output, then executes a downstream program. Even without shell=True, this is a real tainted-data-to-execution boundary because the callee may perform privileged or unsafe operations based on those attacker-influenced arguments.

Tainted flow: 'cmd' from os.environ.get (line 911, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

if link:
                cmd += ["--link", link]
            try:
                subprocess.run(cmd, capture_output=True, text=True, timeout=30)
                stored += 1
            except Exception as e:
                print(f"[rotation] {chan} 入倉失敗: {e}")

• Confidence: 89% confidence
• Finding: This is the same tainted-flow issue in bonus-channel queue insertion. The script autonomously converts untrusted network/model output into program arguments for another script, creating a downstream execution and persistence risk.

Tainted flow: 'cmd' from os.environ.get (line 911, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

if link:
                cmd += ["--link", link]
            try:
                subprocess.run(cmd, capture_output=True, text=True, timeout=30)
                stored += 1
            except Exception as e:
                print(f"[rotation] 入倉失敗: {e}")

• Confidence: 89% confidence
• Finding: Rotation mode amplifies the risk by harvesting multiple sources on a schedule and feeding results directly into a subprocess. This increases the chance of persistent content poisoning or triggering unsafe behavior in the downstream queue handler.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises installation behavior and clearly requires shell, environment variables, filesystem writes, and network access, but it does not declare permissions explicitly. This reduces informed consent and makes it easier for a user or host system to underestimate the scope of background automation and outbound communication the skill will perform.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared purpose understates the operational scope: this skill sets up recurring cron jobs, performs broad external crawling, sends outbound messages via Telegram, stores persistent state, and may contact local or external monitoring endpoints. That mismatch is dangerous because users may consent to a simple 'idle ping' feature without realizing they are authorizing continuous background execution, data collection, and external communications.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The README makes a strong privacy and context-isolation claim ('never enter the main conversation context') while elsewhere documenting the send job as an announcing chat delivery. That mismatch can mislead operators and users about where proactive content appears and whether it may contaminate the main chat thread, undermining informed consent and safe deployment.

Intent-Code Divergence

Low

• Confidence: 88% confidence
• Finding: The README states auto-pause occurs after 3 unanswered shipments, but the documented default configuration uses 2. This is a policy/documentation integrity issue that can cause operators to deploy a system with different outbound-contact frequency and persistence than expected.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The installer goes beyond simple idle-time outreach and provisions additional autonomous content-generation jobs such as crawler, topic-factory, and deep-explore. That materially expands the system's behavior and attack surface, creating more unsupervised execution paths and outbound content generation than the stated skill scope suggests.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The script requires a Telegram destination when cron setup is enabled, thereby provisioning an external announcement channel as part of installation. Because this creates an outbound path for generated content and metadata, it introduces privacy and exfiltration risk beyond local idle scheduling alone.

Context-Inappropriate Capability

Medium

• Confidence: 81% confidence
• Finding: The script can send periodic GET requests to an arbitrary external URL from a cron context via IDLE_PING_HEARTBEAT_URL. In a skill advertised for proactive outreach, this introduces undisclosed outbound network communication and potential beaconing or metadata leakage to third parties, especially if the URL is attacker-controlled or silently preconfigured.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The script does more than passive idle detection or candidate generation: in auto mode it autonomously crawls, summarizes, and inserts items into a share queue. In an agent skill, that hidden scope expansion is dangerous because it creates unattended side effects and broadens the attack surface for content poisoning and user-manipulation workflows.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: Rotation mode performs scheduled multi-source harvesting and queue insertion using generated topics, which is a materially broader autonomous behavior than simple proactive outreach assistance. This matters because broader autonomy reduces oversight and increases the impact of poisoned sources or bad model output.

Context-Inappropriate Capability

Medium

• Confidence: 80% confidence
• Finding: The script emits instructions telling the agent to use an external X search tool, effectively expanding capabilities beyond the local crawler itself. In a skill ecosystem, cross-tool prompting like this can bypass expected boundaries and cause the agent to perform network actions the user did not directly request.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The help text and design notes say the queue uses soft-delete semantics and preserves history, but `clear()` actually runs `DELETE FROM share_queue WHERE status='pending'`, permanently removing pending records. In a proactive outreach system, this can destroy auditability and operator expectations, making accidental or unauthorized queue clearing harder to investigate or recover from.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The prompt instructs the agent to execute local shell and Python commands, read and mutate workspace files, and invoke multiple scripts as part of normal outreach flow. That expands the skill from content generation into code execution and stateful automation, creating a meaningful attack surface if workspace data, script arguments, or referenced files are tampered with.

Description-Behavior Mismatch

Low

• Confidence: 84% confidence
• Finding: The skill is presented as proactive outreach, but it also updates state.json, writes memory files, and emits system logs. This hidden operational bookkeeping increases the blast radius of the skill because a messaging workflow now has persistent side effects that can alter future behavior, leak activity metadata, or corrupt local state if misused.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The tests explicitly validate that the skill can send heartbeat pings to an external monitoring service, which indicates outbound network behavior not captured by the outreach-focused description. Hidden or undocumented egress is security-relevant because operators may install the skill expecting only local idle/outreach logic, while it can also beacon to third-party infrastructure.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The watchdog test confirms that on failure the skill signals a remote '/fail' endpoint, expanding the skill from proactive outreach into external status reporting. Even if only availability metadata is sent, this creates undisclosed telemetry and an external communication path that could leak operational state or be misused in restricted environments.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill is expressly designed to send unsolicited proactive messages during user idle periods, yet the README does not foreground an upfront warning or explicit opt-in requirement before outbound contact begins. In a messaging context, that increases the risk of unwanted contact, surprise notifications, and deployment without meaningful user consent.

Vague Triggers

Medium

• Confidence: 74% confidence
• Finding: The trigger phrases are broad enough that ordinary conversation about being proactive or not waiting for instructions could invoke the skill unintentionally. In this context, accidental activation is meaningful because the skill installs persistent scheduled jobs and unsolicited outbound messaging behavior, not just a one-shot response.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill description does not clearly warn that it will perform automated background activity and send unsolicited outbound messages after periods of user idleness. Because the core function is proactive contact, this omission directly affects user consent, privacy expectations, and the risk of surprise messaging to a Telegram target.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The send job is configured with Telegram announcements and generated message delivery, but the installer does not present a clear warning about transmitting content to an external service. In a proactive autonomous system, this is dangerous because messages may include user-derived context, topics, or behavioral metadata without informed consent.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.