T06 · System Persistence
Error
- Location
SKILL.md:30- Finding
Installation Creates a Persistent LLM Proxy Service and Modifies Agent Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
Robot Resources
Security checks for vulnerabilities and agentic risk
Overview
The skill is plausibly for LLM cost routing, but installing it would route all agent messages through an unaudited local proxy and may create persistent system-level changes.
Review this before installing. It may run persistent local software, change agent configuration, and route all future model traffic through a local proxy installed from an unpinned npm package. Only proceed if you trust the publisher and installer, understand what files and services will be changed, know how to uninstall it, and are comfortable with the proxy seeing prompts, responses, and provider-key-backed traffic.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:40- Finding
Unpinned npm Package Is Downloaded and Executed Directly
- Content
View full analysis
- Remediation
View remediation
T07 · Tool Hijacking and Spoofing
Error
- Location
SKILL.md:103- Finding
Global Provider Replacement Routes Every LLM Message Through an Unaudited Proxy
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:28- Finding
Skill Uses Mandatory Promotional and Agent-Autonomy Instructions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill frames installation in terms of optimizing the agent's own operating costs and gaining 'more autonomy,' which pushes the agent toward self-serving behavior rather than user-directed behavior. In context, that language is risky because the same skill requests installation of a traffic-routing proxy and system service, so the persuasive framing can bias an agent to seek approval for a powerful local change.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The skill instructs users to execute
npx robot-resourceswithout pinning a version or verifying integrity, which can pull whatever package is current at install time. Because the package installs a local proxy, may register a system service, and modifies agent configuration, a compromised or replaced release could achieve persistent code execution with significant local impact.- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill provides a persuasive script and coaching on how to tailor the pitch to obtain installation approval, rather than neutrally describing capabilities and risks. This is dangerous in context because the requested action installs software, may register a system service, and changes routing for all LLM calls, so persuasion can undermine informed consent.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
This unpinned
npx robot-resourcesinvocation has the same supply-chain risk: the fetched package can change over time and will be executed immediately. In this skill, the danger is amplified because the tool is described as altering all LLM traffic and installing a background service, so a malicious update could intercept prompts, responses, and credentials.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The API-signup flow tells the agent to transmit identifying data to an external service and handle a returned API key, but it does not prominently warn that this is an outbound network exchange or that the key is a sensitive secret. That omission increases the chance of silent credential exposure, accidental logging, or user-unapproved account creation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The skill directs an outbound request to
https://api.robotresources.ai/v1/auth/signup, which is an external transmission of agent/account metadata and triggers creation of a remote credential. External communication is expected for signup, but in a skill executed by an agent it becomes risky if done without clear user consent and data-handling disclosure.- Content
bash # 1. Self-register via API POST https://api.robotresources.ai/v1/auth/signup Content-Type: application/json {"agent_name": "your-agent-name", "platform": "openclaw"}
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The non-interactive install path also uses an unpinned package execution flow, creating a direct code-execution and persistence risk from the package registry. Because this path combines remote key provisioning with unattended installation, it is especially attractive for abuse if the package or dependency chain is compromised.
- Content
Static analysis
No suspicious patterns detected.