QuantumOS

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:39 PM UTC
• Version: 0.2.0

Overview

The skill appears to install a real OpenClaw dashboard, but it gives mutable third-party code gateway credentials and adds persistent agent task automation without enough safeguards.

Review carefully before installing. Only use this if you trust the QuantumOS repository and are comfortable granting it access to your OpenClaw gateway token and persistent task workflow. Prefer a pinned, reviewed release, avoid copying broad gateway tokens into project files, and do not add the HEARTBEAT.md automation unless you want future agents to act on dashboard-created tasks automatically.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/setup.sh:7

Finding

Mutable Remote Repository Is Downloaded and Executed Without Integrity Verification

Content

View full analysis

/dev/null || echo " (skipped pull - may have local changes)" else echo "📥 Cloning QuantumOS..." mkdir -p "$(dirname "$INSTALL_DIR")" git clone "$REPO" "$INSTALL_DIR" cd "$INSTALL_DIR" fi # Install dependencies echo "📦 Installing dependencies..." npm install --no-audit --no-fund 2>&1 | tail -1 ``` ### Technical Analysis The setup script clones or updates a mutable branch from a personal GitHub repository and then immediately invokes `npm install`. It does not pin an immutable commit, verify a release signature, compare a checksum, or validate the fetched repository against reviewed content. `npm install` can execute package lifecycle hooks such as `preinstall`, `install`, and `postinstall`. Consequently, code that was not present when this Skill was reviewed can execute with the privileges of the user running the setup script. The same risk recurs whenever setup performs `git pull` or the documented update workflow is used. The `--no-audit` option also suppresses npm's dependency vulnerability audit, reducing visibility into known dependency issues. It is not itself the execution vector, but it weakens supply-chain monitoring. ### Attack Path 1. An attacker compromises the referenced GitHub account, repository, npm dependency, or dependency maintainer. 2. The attacker adds a malicious lifecycle script or modifies application code on the tracked branch. 3. A user runs the Skill's setup script or follows its update instructions. 4. `git clone` or `git pull` retrieves the modifie ...[truncated 830 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.sh:62

Finding

OpenClaw Gateway Token Is Automatically Copied into an Unreviewed Application Directory

Content

View full analysis

/dev/null || echo "") GW_PORT_FOUND=$(python3 -c "import json; c=json.load(open('$OC_CONFIG')); print(c.get('gateway',{}).get('port',''))" 2>/dev/null || echo "") if [ -n "$GW_PORT_FOUND" ]; then GW_PORT="$GW_PORT_FOUND" fi fi if [ -z "$GW_TOKEN" ]; then echo "" echo " Couldn't auto-detect gateway token." echo " Find it in: ~/.openclaw/openclaw.json → gateway.token" echo "" read -p " Enter your OpenClaw gateway token: " GW_TOKEN else echo " ✅ Auto-detected gateway token" fi cat > .env.local << EOF OPENCLAW_GATEWAY_PORT=$GW_PORT OPENCLAW_GATEWAY_TOKEN=$GW_TOKEN EOF ``` ### Technical Analysis The setup script reads the OpenClaw gateway token from `~/.openclaw/openclaw.json`, or requests it interactively, and stores it in plaintext as `.env.local` inside the remotely downloaded QuantumOS repository. The script neither applies a restrictive `umask` nor explicitly sets the resulting file to mode `0600`. Its actual permissions therefore depend on the user's environment. More importantly, the credential becomes accessible to application code, build tooling, and dependencies operating within the project directory. The reviewed Skill files do not directly transmit the token to a remote endpoint. However, the token is deliberately supplied to remotely sourced and subsequently updateable code, creati ...[truncated 1475 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:25

Finding

Mandatory HEARTBEAT Modification Creates Persistent Execution of Untrusted Dashboard Tasks

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 60)May include surrounding context.

sh

mkdir -p "$MC_DIR" "$DASH_DIR"
echo "📁 Data directories ready"

# Create .env.local if missing
if [ ! -f .env.local ]; then
    echo "⚙️  Setting up environment..."

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 61)May include surrounding context.

sh

mkdir -p "$MC_DIR" "$DASH_DIR"
echo "📁 Data directories ready"

# Create .env.local if missing
if [ ! -f .env.local ]; then
    echo "⚙️  Setting up environment..."

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 91)May include surrounding context.

sh

mkdir -p "$MC_DIR" "$DASH_DIR"
echo "📁 Data directories ready"

# Create .env.local if missing
if [ ! -f .env.local ]; then
    echo "⚙️  Setting up environment..."

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

This heredoc writes the OpenClaw gateway token into .env.local in plaintext. In the context of a dashboard setup skill, that token likely grants access to local OpenClaw gateway functionality, so storing it in a second file materially increases secret exposure if the repo directory is readable by other users, backed up insecurely, or accidentally committed.

Content

Scanner excerpt · scripts/setup.sh (reported line 85)May include surrounding context.

sh

echo "   ✅ Auto-detected gateway token"
    fi

    cat > .env.local << EOF
OPENCLAW_GATEWAY_PORT=$GW_PORT
OPENCLAW_GATEWAY_TOKEN=$GW_TOKEN
EOF

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 89)May include surrounding context.

sh

OPENCLAW_GATEWAY_PORT=$GW_PORT
OPENCLAW_GATEWAY_TOKEN=$GW_TOKEN
EOF
    echo "   ✅ Created .env.local"
else
    echo "⚙️  .env.local already exists (keeping existing)"
fi

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill requires appending persistent task-triage instructions into HEARTBEAT.md, which alters the agent's ongoing behavior beyond the immediate user request. This creates a durable automation hook that can cause future autonomous actions against a local API, making the effect persist across sessions and potentially expanding the skill's control surface.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

Step 2: Configure agent integration

After setup, you MUST add Mission Control triage to your workspace's HEARTBEAT.md. Append the following block (do not overwrite existing content):

text

## Check for new Mission Control tasks

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs the user to retrieve a gateway token from ~/.openclaw/openclaw.json and enter it into the dashboard, but provides no warning about treating the token as a secret or limiting its exposure. In a skill context, directing credential handling without safeguards increases the chance of accidental disclosure to the UI, logs, screenshots, or other local processes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

For background operation:

bash

cd ~/Projects/quantumos && nohup npm run dev > /tmp/quantumos.log 2>&1 &

Update

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The setup script automatically extracts the OpenClaw gateway token from the user's local config and persists it into a new .env.local file. This duplicates a sensitive credential into another location without warning, permission hardening, or guidance about secret handling, increasing the chance of accidental disclosure through local file reads, backups, logs, or source control.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.