Security audit

Amigo

Security checks for vulnerabilities and agentic risk

Overview

Amigo is mostly coherent and disclosed, but it asks users to install unpinned companion sub-skills and optionally run one of them on recurring schedules, which deserves careful review before installation.

Install only if you are comfortable with a companion setup that stores relationship notes and can run autonomous exploration on a schedule. Prefer manual use first, verify the `open-thoughts` and `social-graph` packages and publishers, pin versions if supported, limit scheduled sessions' tools and workspace access, review the social-graph and journal files regularly, and remove cron or heartbeat entries if you no longer want unattended activity.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Warning

Location: references/setup-cron.md:15
Finding: Persistent Autonomous Execution Through Cron and Heartbeat Scheduling
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:55-59, references/setup-cron.md:15-55, and references/setup-heartbeat.md:17-47
Vulnerability Type: Persistent scheduled task creation
Risk Level: Medium

The project directs users to configure recurring cron jobs or heartbeat instructions that autonomously invoke the externally installed open-thoughts Skill.

Relevant code from references/setup-cron.md:15-23:

bash
openclaw cron add \ --name "daily-thinking" \ --cron "0 10 * * *" \ --tz "America/Chicago" \ --session isolated \ --message "/open-thoughts length=600"

Additional recurring schedules from references/setup-cron.md:28-55:

bash
openclaw cron add \ --name "thinking-time" \ --cron "0 10 * * 1,4" \ --tz "America/Chicago" \ --session isolated \ --message "/open-thoughts length=600"

bash
openclaw cron add \ --name "explore" \ --cron "0 8,14,20 * * *" \ --tz "America/Chicago" \ --session isolated \ --message "/open-thoughts"

bash
openclaw cron add \ --name "weekly-reflection" \ --cron "0 9 * * 0" \ --tz "America/Chicago" \ --session isolated \ --message "/open-thoughts topic='reflect on this week' length=600"

Heartbeat configuration from references/setup-heartbeat.md:17-47:

json
{ "agents": { "defaults": { "heartbeat": { "every": "2h" } } } }

markdown
## Exploration Window Every heartbeat, check the following before exploring: 1. Is it during waking hours? (Only explore between 8 AM and 9 PM in your person's timezone.) 2. Have you already explored in the last few hours? Check `explorations/YYYY-MM-DD.md` for today's entries. 3. Is anyone waiting for a response? If so, respond first. If all clear, invoke `/open-thoughts` with no arguments (free exploration). If someone messages during explorati ...[truncated 2192 chars]
Remediation: View remediation
Remediation Suggestions

Make manual, one-shot invocation the default and present recurring scheduling as an explicit opt-in feature.

Require clear confirmation before creating any cron job or modifying HEARTBEAT.md.

Pin and verify the scheduled Skill before enabling autonomous execution.

Run scheduled sessions with the minimum required workspace and tool permissions.

Apply execution-frequency, token-budget, duration, and filesystem-write limits.

Record each autonomous invocation in an auditable log and notify the user of failures or unexpected behavior.

Place the corresponding removal command next to every creation example:
bash
openclaw cron list openclaw cron remove <id>

Document how to disable the heartbeat block and periodically review all active scheduled jobs.

T08 · Insecure Dependencies

Error

Location: SKILL.md:34
Finding: Unpinned External Skills Installed From a Mutable Package Source
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:34-39
Vulnerability Type: Unverified and unpinned third-party dependencies
Risk Level: High

The setup instructions install two external Skills by package name without an immutable version, commit identifier, checksum, signature, or documented source validation.

Relevant code from SKILL.md:34-39:

markdown
### 1. Install both sub-skills ```bash clawhub install open-thoughts clawhub install social-graph

text
### Technical Analysis Installing dependencies solely by mutable registry names means the resolved content can differ from the content originally reviewed by the project author or user. The package contents of `open-thoughts` and `social-graph` are not included in this repository, so their instructions and executable behavior could not be inspected during this audit. This creates a supply-chain trust boundary. Registry compromise, maintainer-account compromise, package takeover, or an unsafe future release could cause users to install agent instructions or code that differs from the expected implementation. The risk is amplified because the project subsequently recommends invoking `open-thoughts` through persistent cron or heartbeat schedules. No evidence was found that either named dependency is currently malicious. The vulnerability is the absence of reproducible version selection and integrity verification. ### Attack Path 1. An attacker compromises the registry entry, maintainer account, publication process, or another distribution component for `open-thoughts` or `social-graph`. 2. The attacker publishes a modified release under the same mutable package name. 3. A user executes the documented `clawhub install` commands. 4. The package manager resolves and installs the attacker-controlled release because no immutable version or digest is required. 5. The external Skill is loaded into the agent environment. 6. For `open-thoughts` ...[truncated 736 chars]
Remediation: View remediation
Remediation Suggestions

Pin each dependency to an audited immutable version, release digest, or commit identifier.

Document the expected publisher identity and trusted registry or repository for each Skill.

Verify cryptographic signatures or checksums before installation.

Provide lockfile or manifest data that makes installations reproducible.

Vendor reviewed dependency contents into the project when licensing and maintenance requirements permit.

Audit dependency updates before deployment rather than accepting mutable latest releases automatically.

Disable automatic dependency updates for Skills used by cron or heartbeat execution.

Apply least-privilege tool and filesystem policies to all third-party Skills.

Add an explicit warning that the external dependencies are outside this package's audit boundary.

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list includes broad natural-language phrases like 'inner life', 'agent personality', and 'two-way relationship', which are common in ordinary conversation and can cause the skill to activate unintentionally. In this skill's context, accidental invocation is more risky than usual because it enables companion-style behaviors and related sub-skills that may change conversation patterns, memory use, or persistence without clear user intent.
Content: No source excerpt is available for this finding.

Session Persistence