ClawHub
Back to skill

Security audit

Corust Agent Configure

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Corust Agent setup guide, but it recommends broad persistent permissions that could let untrusted Discord users trigger a powerful coding agent.

Review before installing. Prefer a narrow Discord allowlist for specific trusted servers, channels, roles, or users, avoid approve-all unless you fully trust the environment, verify the downloaded Corust release, and back up OpenClaw/ACPX config so the changes can be reverted.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs the user to run `openclaw config set channels.discord.allowFrom '["*"]'`, which effectively permits messages from any Discord source/DM context without explaining the privacy or abuse implications. In the context of an ACP-capable coding agent, broad inbound access can expose the agent to untrusted prompts, unwanted session spawning, and possible leakage of workspace or agent outputs to arbitrary users.

Static analysis

No suspicious patterns detected.