QuantumOS

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:39 PM UTC
• Version: 0.2.0

Overview

The skill appears to install a real OpenClaw dashboard, but it gives mutable third-party code gateway credentials and adds persistent agent task automation without enough safeguards.

Review carefully before installing. Only use this if you trust the QuantumOS repository and are comfortable granting it access to your OpenClaw gateway token and persistent task workflow. Prefer a pinned, reviewed release, avoid copying broad gateway tokens into project files, and do not add the HEARTBEAT.md automation unless you want future agents to act on dashboard-created tasks automatically.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/setup.sh:7
• Finding: Mutable Remote Repository Is Downloaded and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh`, lines 7 and 39-51 **Vulnerability Type**: Unverified remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash REPO="https://github.com/murtiurti4/quantumos.git" ``` ```bash # Clone or update repo if [ -d "$INSTALL_DIR" ]; then echo "📁 QuantumOS already exists at $INSTALL_DIR" cd "$INSTALL_DIR" echo " Pulling latest..." git pull --ff-only 2>/dev/null || echo " (skipped pull - may have local changes)" else echo "📥 Cloning QuantumOS..." mkdir -p "$(dirname "$INSTALL_DIR")" git clone "$REPO" "$INSTALL_DIR" cd "$INSTALL_DIR" fi # Install dependencies echo "📦 Installing dependencies..." npm install --no-audit --no-fund 2>&1 | tail -1 ``` ### Technical Analysis The setup script clones or updates a mutable branch from a personal GitHub repository and then immediately invokes `npm install`. It does not pin an immutable commit, verify a release signature, compare a checksum, or validate the fetched repository against reviewed content. `npm install` can execute package lifecycle hooks such as `preinstall`, `install`, and `postinstall`. Consequently, code that was not present when this Skill was reviewed can execute with the privileges of the user running the setup script. The same risk recurs whenever setup performs `git pull` or the documented update workflow is used. The `--no-audit` option also suppresses npm's dependency vulnerability audit, reducing visibility into known dependency issues. It is not itself the execution vector, but it weakens supply-chain monitoring. ### Attack Path 1. An attacker compromises the referenced GitHub account, repository, npm dependency, or dependency maintainer. 2. The attacker adds a malicious lifecycle script or modifies application code on the tracked branch. 3. A user runs the Skill's setup script or follows its update instructions. 4. `git clone` or `git pull` retrieves the modifie ...[truncated 830 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin installation to an immutable, reviewed commit hash rather than a mutable branch. - Distribute signed releases and verify signatures or cryptographic checksums before execution. - Commit and enforce a lockfile, then use `npm ci` rather than unconstrained `npm install`. - Use `npm ci --ignore-scripts` when lifecycle scripts are unnecessary. - If lifecycle scripts are required, enumerate and audit them before allowing execution. - Do not automatically update and execute new upstream content. Show the proposed version and obtain explicit user approval. - Run dependency installation and the application inside a sandbox or container with narrowly scoped filesystem and network access. - Retain dependency auditing rather than using `--no-audit`, and integrate lockfile and provenance checks. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup.sh:62
• Finding: OpenClaw Gateway Token Is Automatically Copied into an Unreviewed Application Directory<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup.sh`, lines 62-85 **Vulnerability Type**: Insecure handling and plaintext storage of a sensitive gateway credential **Risk Level**: High ### Vulnerable Code ```bash # Create .env.local if missing if [ ! -f .env.local ]; then echo "⚙️ Setting up environment..." # Try to auto-detect gateway token GW_TOKEN="" GW_PORT="18789" if [ -f "$OC_CONFIG" ]; then GW_TOKEN=$(python3 -c "import json; c=json.load(open('$OC_CONFIG')); print(c.get('gateway',{}).get('token',''))" 2>/dev/null || echo "") GW_PORT_FOUND=$(python3 -c "import json; c=json.load(open('$OC_CONFIG')); print(c.get('gateway',{}).get('port',''))" 2>/dev/null || echo "") if [ -n "$GW_PORT_FOUND" ]; then GW_PORT="$GW_PORT_FOUND" fi fi if [ -z "$GW_TOKEN" ]; then echo "" echo " Couldn't auto-detect gateway token." echo " Find it in: ~/.openclaw/openclaw.json → gateway.token" echo "" read -p " Enter your OpenClaw gateway token: " GW_TOKEN else echo " ✅ Auto-detected gateway token" fi cat > .env.local << EOF OPENCLAW_GATEWAY_PORT=$GW_PORT OPENCLAW_GATEWAY_TOKEN=$GW_TOKEN EOF ``` ### Technical Analysis The setup script reads the OpenClaw gateway token from `~/.openclaw/openclaw.json`, or requests it interactively, and stores it in plaintext as `.env.local` inside the remotely downloaded QuantumOS repository. The script neither applies a restrictive `umask` nor explicitly sets the resulting file to mode `0600`. Its actual permissions therefore depend on the user's environment. More importantly, the credential becomes accessible to application code, build tooling, and dependencies operating within the project directory. The reviewed Skill files do not directly transmit the token to a remote endpoint. However, the token is deliberately supplied to remotely sourced and subsequently updateable code, creati ...[truncated 1475 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not automatically extract or copy the OpenClaw gateway token into a third-party project. - Ask for explicit informed consent before granting the dashboard access to gateway credentials. - Use a dedicated, narrowly scoped token restricted to the minimum required gateway operations. - Inject the credential only at runtime through a secret manager, credential broker, or protected process boundary. - Ensure dependency installation and build steps run without gateway credentials in their environment or filesystem scope. - If a local secret file is unavoidable, create it under `umask 077` and explicitly apply `chmod 600 .env.local`. - Confirm `.env.local` is excluded from version control, backups, diagnostics, logs, and client-side bundles. - Separate feed aggregation, dependency tooling, and other dashboard components from the process that can access the gateway token. - Provide clear token revocation and rotation instructions. ]]>

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:25
• Finding: Mandatory HEARTBEAT Modification Creates Persistent Execution of Untrusted Dashboard Tasks<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 25-35 **Vulnerability Type**: Persistent Agent instruction and task-channel poisoning **Risk Level**: High ### Vulnerable Code ```markdown ### Step 2: Configure agent integration After setup, you MUST add Mission Control triage to your workspace's `HEARTBEAT.md`. Append the following block (do not overwrite existing content): ``` ## Check for new Mission Control tasks - GET http://localhost:3005/api/mission-control/tasks - Look for tasks with status "inbox" - For each inbox task: generate a proper title, set status to "in_progress", and start working on it - After completing a task: add a comment documenting what was done, set status to "done" ``` This enables automatic task triage when users create tasks from the dashboard. ``` ### Technical Analysis The Skill requires modification of `HEARTBEAT.md`, a persistent workspace instruction file, so future Agent activity automatically polls Mission Control and starts work on inbox tasks. The instruction establishes no authentication requirement for task creation, no trusted-task provenance check, no user approval step, no action allowlist, and no requirement to treat task text as untrusted input. As a result, content entering the Mission Control task store can become persistent instructions that influence later Agent sessions. Although the endpoint uses `localhost`, this does not establish that task content is trustworthy. The dashboard, its local data files, remotely sourced application code, browser-facing APIs, or another local process may be able to create or modify tasks. ### Attack Path 1. An attacker gains the ability to create or alter a Mission Control task through the dashboard, its API, writable task files, compromised application code, or local access. 2. The attacker places instructions in a task and marks it with the `inbox` status. 3. A future Agent heartbeat requests `http://localhost:3005/api/mission-control/tasks`. 4. ...[truncated 941 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Make `HEARTBEAT.md` integration optional and require explicit user approval before modifying persistent Agent instructions. - Authenticate task creators and cryptographically or logically bind each task to a trusted identity. - Require per-task user confirmation before the Agent starts work, especially for tasks involving tools, files, credentials, or external communication. - Treat all task titles, descriptions, comments, and attachments as untrusted data rather than higher-priority Agent instructions. - Define a strict task schema and action allowlist; reject embedded instructions that attempt to change Agent policy or request unrelated operations. - Run task processing with a reduced tool set and least-privilege filesystem and network access. - Record task provenance and maintain an auditable approval and execution log. - Provide documented steps to disable polling and remove the appended `HEARTBEAT.md` block. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Credential Access

High

• Category: Privilege Escalation

Content

mkdir -p "$MC_DIR" "$DASH_DIR"
echo "📁 Data directories ready"

# Create .env.local if missing
if [ ! -f .env.local ]; then
    echo "⚙️  Setting up environment..."

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

mkdir -p "$MC_DIR" "$DASH_DIR"
echo "📁 Data directories ready"

# Create .env.local if missing
if [ ! -f .env.local ]; then
    echo "⚙️  Setting up environment..."

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

mkdir -p "$MC_DIR" "$DASH_DIR"
echo "📁 Data directories ready"

# Create .env.local if missing
if [ ! -f .env.local ]; then
    echo "⚙️  Setting up environment..."

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

echo "   ✅ Auto-detected gateway token"
    fi

    cat > .env.local << EOF
OPENCLAW_GATEWAY_PORT=$GW_PORT
OPENCLAW_GATEWAY_TOKEN=$GW_TOKEN
EOF

• Confidence: 97% confidence
• Finding: This heredoc writes the OpenClaw gateway token into .env.local in plaintext. In the context of a dashboard setup skill, that token likely grants access to local OpenClaw gateway functionality, so storing it in a second file materially increases secret exposure if the repo directory is readable by other users, backed up insecurely, or accidentally committed.

Credential Access

High

• Category: Privilege Escalation

Content

OPENCLAW_GATEWAY_PORT=$GW_PORT
OPENCLAW_GATEWAY_TOKEN=$GW_TOKEN
EOF
    echo "   ✅ Created .env.local"
else
    echo "⚙️  .env.local already exists (keeping existing)"
fi

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Step 2: Configure agent integration

After setup, you MUST add Mission Control triage to your workspace's `HEARTBEAT.md`. Append the following block (do not overwrite existing content):

```
## Check for new Mission Control tasks

• Confidence: 84% confidence
• Finding: The skill requires appending persistent task-triage instructions into `HEARTBEAT.md`, which alters the agent's ongoing behavior beyond the immediate user request. This creates a durable automation hook that can cause future autonomous actions against a local API, making the effect persist across sessions and potentially expanding the skill's control surface.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs the user to retrieve a gateway token from `~/.openclaw/openclaw.json` and enter it into the dashboard, but provides no warning about treating the token as a secret or limiting its exposure. In a skill context, directing credential handling without safeguards increases the chance of accidental disclosure to the UI, logs, screenshots, or other local processes.

Session Persistence

Medium

• Category: Rogue Agent

Content

For background operation:

```bash
cd ~/Projects/quantumos && nohup npm run dev > /tmp/quantumos.log 2>&1 &
```

## Update

• Confidence: 65% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The setup script automatically extracts the OpenClaw gateway token from the user's local config and persists it into a new .env.local file. This duplicates a sensitive credential into another location without warning, permission hardening, or guidance about secret handling, increasing the chance of accidental disclosure through local file reads, backups, logs, or source control.

Static analysis

No suspicious patterns detected.