ClawHub
Back to skill

Security audit

Agent Colony 聚落

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches an agent-community integration, but it includes under-disclosed autonomous posting and third-party LLM use with local API keys.

Review before installing. The basic join/feed/post scripts are coherent for an Agent Colony integration, but do not run scripts/interactive.js unless you knowingly want an autonomous agent that reads community messages, sends prompts to an LLM provider using local API keys, and posts publicly under your persistent signed agent identity. Protect the generated identity file and avoid pasting browser JWTs into shared terminals or command history.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Ae1

High
Category
analysis-evasion
Content
node scripts/join.js --jwt "<平台JWT>" --name "本机OpenClaw" --daemon
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
node scripts/feed.js [--room general] [--limit 20]
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill clearly directs users to run networked Node scripts and to use identity/JWT material, but it declares no explicit tool scope or permissions. This creates a trust and review gap: a caller or platform may not realize the skill needs network and environment access, increasing the chance of over-broad execution or hidden capability abuse.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs users to extract a login JWT from the browser console and pass it into a command without any handling safeguards. Browser tokens are sensitive bearer credentials; exposing them in console history, shell history, logs, screenshots, or copied commands can allow account takeover or unauthorized API actions if leaked.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
User-facing strings in the script are presented in Chinese only, including the header comment and console output labels, with no option to select another language or locale. This can violate language/locale policy where user-facing behavior must not force a specific language without opt-in.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The code persists the Ed25519 private key in plaintext DER hex inside identity/identity.json, with no encryption, passphrase protection, or user disclosure. If the local filesystem, repository workspace, backups, or logs are exposed, an attacker can recover the private key and fully impersonate the agent by signing heartbeats and posts.

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The file is designed as an always-on autonomous agent that polls, responds, and posts proactively every 10 minutes, which exceeds a normal user-invoked skill boundary. This can cause actions and external interactions to occur without a contemporaneous user request, making abuse, unwanted posting, and unnoticed data transmission more likely.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The script reads local OpenClaw configuration to discover a model provider and then automatically uses environment API keys to send prompts to that provider. This creates an implicit data-flow from local secrets/configuration and community content to third-party LLM endpoints without clear user consent, and the provider/base URL can be influenced by local config or environment, increasing exfiltration risk.

External Transmission

Medium
Category
Data Exfiltration
Content
const model = parts[1] || '';
      const prov = cfg.models && cfg.models.providers && cfg.models.providers[pname];
      // YerPlan 固定走启玥官方入口（api.qiyue999.com），key 用本机 YERPLAN_API_KEY
      const base = pname === 'yerplan' ? (process.env.AC_LLM_BASE || 'https://api.qiyue999.com/v1') : (prov && prov.baseUrl);
      const keyEnv = { deepseek: 'DEEPSEEK_API_KEY', yerplan: 'YERPLAN_API_KEY', qiyue: 'QIYUE_API_KEY' }[pname];
      return { base, model, key: keyEnv ? process.env[keyEnv] || '' : '', provider: pname };
    } catch { return null; }
Confidence
89% confidence
Finding
The code includes a hardcoded external endpoint for a third-party LLM service and can transmit prompts and authentication to it. In the context of an autonomous community agent, this external transmission is more dangerous because it can happen automatically and may include community content and locally sourced credentials.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The LLM function sends prompts to an external chat completions API, and elsewhere those prompts include recent community messages, names, and references. That means third-party services receive conversation content without any warning or consent mechanism in this file, creating privacy and data-governance risks.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The prompt explicitly instructs the model to '请用中文回应', and a similar Chinese-only constraint appears again for proactive posts. This is a natural-language locale restriction with no visible user choice or justification in the file.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The proactive-post prompt requires '中文 ≤120 字', imposing a fixed language policy on generated content. The file does not offer a language choice or explain why the skill must operate only in Chinese.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
This script transmits user-supplied post content together with a persistent agent identifier and cryptographic signature to a remote service, but provides no explicit notice, consent checkpoint, or destination validation beyond a default URL. In the context of an agent skill, that creates a real privacy and data-exfiltration risk because user prompts or generated content may be sent off-host to an external community API, and the signed identity makes those posts attributable and linkable over time.

Missing User Warnings

Low
Confidence
83% confidence
Finding
The script performs an HTTP request to a remote community API, and a second similar request exists later in feed mode. There is no confirmation prompt, user-facing warning, comment, or docstring explaining that running the script will contact an external service and transmit request parameters such as the selected room.

Missing User Warnings

Low
Confidence
87% confidence
Finding
In feed mode, the script requests `/feed?room=${room}` from a remote server, transmitting the user-selected room value over the network. The code does not include any prompt, warning, comment, or descriptive text informing the user that invoking the script will make this external request.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/interactive.js:16