Agent Hivemind

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:06 AM UTC
• Version: 1.9.5

Overview

The skill is a networked recipe-sharing and recommendation CLI whose local inspection and remote submissions mostly match its stated purpose, with privacy-disclosure gaps users should understand before use.

Install only if you are comfortable with a third-party Supabase-backed service receiving the skill names installed in your OpenClaw workspace when you run suggestions, plus any play text, comments, replication notes, notification destinations, and preference data you explicitly submit. Use --dry-run before suggest, avoid entering secrets or proprietary workflow details, and consider pinning Python dependencies in your own environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: scripts/hivemind.py:361

Finding

Undisclosed Transmission of the Installed Skill Inventory

Content

View full analysis

list[str]: """List skills installed in the current workspace.""" skills_dir = os.path.expanduser("~/.openclaw/workspace/skills") if not os.path.isdir(skills_dir): return [] return [ d for d in os.listdir(skills_dir) if os.path.isfile(os.path.join(skills_dir, d, "SKILL.md")) and not d.startswith("_") ] ``` The resulting inventory is transmitted by the `suggest` command: ```python async def cmd_suggest(ctx: AppContext, args: argparse.Namespace) -> None: my_skills = list_installed_skills() if not my_skills: print("No skills detected. Install some skills first!") return print(f"Your skills: {', '.join(my_skills)}") print() if getattr(args, "dry_run", False): print("[dry-run] Would query the hivemind backend for plays matching these skills.") print("[dry-run] No data submitted. Agent hash:", ctx.agent_hash) print("[dry-run] Backend:", ctx.supabase_url) return async with httpx.AsyncClient(timeout=20.0) as client: result = await api_post_rpc( client, ctx, "suggest_plays", { "agent_skills": my_skills, "match_count": args.limit, }, ) ``` The conflicting privacy ...[truncated 2543 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/hivemind.py:344

Finding

Unpinned Python Dependencies and Runtime Embedding Model Resolution

Content

View full analysis

list[float] | None: """Generate 384-dim embedding locally using sentence-transformers.""" try: from sentence_transformers import SentenceTransformer model = SentenceTransformer("all-MiniLM-L6-v2") embedding = model.encode(text).tolist() return embedding except ImportError: print( "Warning: sentence-transformers not installed. Submitting without embedding.", file=sys.stderr, ) print("Install: pip install sentence-transformers", file=sys.stderr) return None ``` `SKILL.md` provides the following unpinned installation instruction: ```text ## Requirements - Python 3.10+ - `httpx` — `pip install httpx` - `openssl` CLI (pre-installed on macOS/Linux) — used for Ed25519 comment signing ``` `README.md` similarly states: ```text ## Install clawhub install agent-hivemind Requires Python 3.10+ and `httpx` (`pip install httpx`). ``` ### Technical Analysis Commands such as `pip install httpx` and `pip install sentence-transformers` resolve whatever compatible versions the package index serves at installation time. No lockfile, exact version constraint, or package hash is included in the audited artifact. Consequently, installations are not reproducible and cannot be reliably tied to versions reviewed by the Skill publisher. `SentenceTransformer("all-MiniLM-L6-v2")` may cause the de ...[truncated 2183 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose frames the skill as recommendation and evolution of skill combinations, but the described behavior extends into local environment inspection, remote API interaction, persistent key generation, notifications, and social/comment features. That mismatch can cause operators to grant or install the skill under an incomplete understanding of its true capabilities, which is dangerous because it combines local access, persistence, shell execution, and outbound network communication.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/hivemind.py (reported line 25)May include surrounding context.

python

datetime import datetime, timezone
from pathlib import Path
from typing import Any
from urllib.parse import quote

import httpx

# Supabase anon key is public (read-only scope, RLS-protected). Hardcoded to avoid
# runtime config fetches that scanners flag as a remote-control vector.
SUPABASE_URL = "https://tjcryyjrjxbcjzybzdow.supabase.co"
SUPABASE_ANON_KEY = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6InRqY3J5eWpyanhiY2p6eWJ6ZG93Iiwicm9sZSI6ImFub24iLCJpYXQiOjE3NzM5NTIzNjUsImV4cCI6MjA4OTUyODM2NX0.G_PtxkbqXO6jz1mGUX7-afO1WlHl1c_z0_QBNbqLeJU"

CONFIG_FILE = Path.home() / ".openclaw" / "hivemind-config.env"
SCRIPT_DIR = Path(__file__).resolve().parent
KEY_PATH = SCRIPT_DIR / ".hivemind-key.pem"


def load_env_file(path: Path) -> dict[str, str]:
    values: dict[str, str] = {}
    if not path.exists():
        return values
    for raw in path.read_text(encoding="utf-8").splitlines():
        line = raw.strip()
        if not line or line.startswith("#"):

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README presents a narrowly scoped data collection statement for onboarding, but elsewhere documents remote writes of contributed plays, replications, comments, and notifications to Supabase services. This mismatch can mislead users about what data leaves the local environment and under what circumstances, weakening informed consent and trust boundaries even if submission is user-initiated.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README says the hardcoded public anon key has read-only scope, yet the documented architecture states the agent performs writes through edge functions. Even if the key cannot directly write to tables, describing it as simply read-only obscures its role in invoking write-capable backend paths and may cause users or reviewers to underestimate remote modification capability.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises shell, file read/write, environment access, and network behavior but declares no explicit tool scope or permissions boundary. That makes the effective trust surface much larger than the manifest suggests, increasing the chance an agent or user invokes it with broader capabilities than intended and reducing reviewability of sensitive operations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation contains conflicting statements about fallback identity generation: one section says it falls back to hostname and username, while the privacy section says a random per-session hash is used and no personal identifiers are involved. This inconsistency is security-relevant because hostname/username-derived identifiers can leak stable device- or user-linked information and defeat the stated anonymity model, leading users to consent under false privacy assumptions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The implementation materially exceeds the narrow 'evolving skill combinations' description by adding comments, notifications, and preference management tied to a remote backend. Scope mismatch is dangerous because users and reviewers may underestimate data flows and granted trust, reducing informed consent around networked social and notification features.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/hivemind.py (reported line 80)May include surrounding context.

python

def get_agent_hash() -> str:
    """Generate deterministic anonymous agent identity."""
    try:
        result = subprocess.run(
            ["openclaw", "status", "--json"],
            capture_output=True,
            text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/hivemind.py (reported line 133)May include surrounding context.

python

pass

    # Fallback for environments without `cryptography`.
    result = subprocess.run(
        ["openssl", "genpkey", "-algorithm", "ed25519", "-out", str(path)],
        capture_output=True,
        text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/hivemind.py (reported line 161)May include surrounding context.

python

try:
        msg_path.write_text(payload, encoding="utf-8")

        sign_cmd = subprocess.run(
            [
                "openssl",
                "pkeyutl",

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/hivemind.py (reported line 181)May include surrounding context.

python

raise RuntimeError(f"Failed to sign payload: {sign_cmd.stderr.strip()}")
        signature_hex = sig_path.read_bytes().hex()

        pub_cmd = subprocess.run(
            ["openssl", "pkey", "-in", str(KEY_PATH), "-pubout", "-outform", "DER"],
            capture_output=True,
        )

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill inspects the local workspace to enumerate installed skills, which is a form of host reconnaissance. In context, that list is later transmitted to the backend for suggestions, so local environment metadata is collected and disclosed beyond what the manifest description clearly justifies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This command sends user-provided email or webhook destination data to the backend without a prominent runtime disclosure of what is being stored or where it is sent. Contact endpoints are sensitive metadata, and webhook URLs may embed secrets or internal infrastructure locations, making quiet transmission risky.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The contribute flow uploads free-form content plus inferred OS metadata to a remote backend without a clear runtime warning. Free-form text often contains operational details, identifiers, or proprietary workflow information, so silent upload increases risk of unintended data disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The suggest command transmits the locally detected installed-skill inventory to the backend without equivalent disclosure in the normal execution path. That inventory can reveal user capabilities, tooling choices, project focus, or internal workflows, making it sensitive environment metadata.

Content

No source excerpt is available for this finding.