Security audit
Security checks for vulnerabilities and agentic risk
The skill mostly matches its Multilogin management purpose, but it handles account passwords and delegated node access in ways users should review carefully before installing.
Install only if you trust the Multilogin CLI distribution and are comfortable giving the agent authority over Multilogin profiles, cloud phones, files, proxies, ADB sessions, account settings, and potentially billed mobile minutes. Avoid sending passwords in chat or spawned node messages; prefer a pre-authenticated local xcli session or another secret-safe login method, and require explicit confirmation for deletes, transfers, 2FA changes, ADB actions, and file operations.
The skill tells the agent to ask for credentials and use them directly in a CLI login command with plaintext username and password. This encourages collection and handling of secrets in unsafe channels, where they may appear in chat history, shell history, process listings, logs, or traces.
The delegation example explicitly embeds USER and PASS inside a spawned session message to another node. This is a severe secret-handling flaw because it duplicates credentials across systems and message channels, making leakage, retention, interception, or misuse much more likely.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
---
name: multilogin
description: Use when you need to manage Multilogin through `xcli`, including Android cloud phones, browser profiles, workspaces, proxies, scripts, tags, files, apps, ADB access, and account settings.
metadata: { "openclaw": { "emoji": "🌐", "requires": { "bins": ["xcli", "mlx-launcher"] } } }
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
---
name: multilogin
description: Use when you need to manage Multilogin through `xcli`, including Android cloud phones, browser profiles, workspaces, proxies, scripts, tags, files, apps, ADB access, and account settings.
metadata: { "openclaw": { "emoji": "🌐", "requires": { "bins": ["xcli", "mlx-launcher"] } } }
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
---
name: multilogin
description: Use when you need to manage Multilogin through `xcli`, including Android cloud phones, browser profiles, workspaces, proxies, scripts, tags, files, apps, ADB access, and account settings.
metadata: { "openclaw": { "emoji": "🌐", "requires": { "bins": ["xcli", "mlx-launcher"] } } }
---
The activation description is very broad, covering nearly every kind of Multilogin management task plus adjacent capabilities like ADB access, files, apps, and account settings. Broad triggers can cause the skill to activate in situations where narrower tooling should be used, increasing the chance of overreach into sensitive actions such as credential handling, device control, or destructive account operations.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
description: Use when you need to manage Multilogin through `xcli`, including Android cloud phones, browser profiles, workspaces, proxies, scripts, tags, files, apps, ADB access, and account settings.
metadata: { "openclaw": { "emoji": "🌐", "requires": { "bins": ["xcli", "mlx-launcher"] } } }
---
# Multilogin
Multilogin is a cloud phone platform for social media marketers. This skill connects OpenClaw with the Multilogin CLI (`xcli`), allowing people and AI agents to manage social profiles using AI prompts.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Resolve latest versions
CLI_VER=$(curl -sL "https://ml000x-dev-dists.s3.eu-north-1.amazonaws.com/cli-mlx/latest")
LAUNCHER_VER=$(curl -sL "https://ml000x-dev-dists.s3.eu-north-1.amazonaws.com/launcher-mlx/latest")
echo "Installing xcli $CLI_VER, launcher $LAUNCHER_VER"
The skill directs the agent to use sessions_spawn to delegate work to another node, which expands behavior beyond the declared xcli/Multilogin management scope into cross-agent task execution. That is dangerous because it creates an unexpected control and data propagation channel, and in this example it is paired with credential forwarding to a second system, increasing the chance of unauthorized execution or secret exposure.
The ADB section instructs the agent to leave the xcli boundary and directly control Android devices with local adb shell commands. This materially increases capability from account/profile management to arbitrary device interaction, including app control and data access, and introduces sensitive connection details (ip, port, transient pwd) that could be mishandled or abused.
No suspicious patterns detected.