Security audit

Dream Of Clawra

Security checks for vulnerabilities and agentic risk

Overview

This skill’s image-sending purpose is mostly disclosed, but its installer can persistently rewrite an OpenClaw agent’s identity and SOUL files with broad triggers and limited safeguards.

Review carefully before installing. The main risk is not just sending images: running the CLI can permanently change an OpenClaw agent’s identity and long-term persona files, while the skill also has broad tool permissions and casual triggers that could lead to unintended media sending. Install only in a test agent or after backing up IDENTITY.md and SOUL.md, and confirm channel, target, and image before any outbound message.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T02 · Agent Memory Poisoning

Error

Location: bin/cli.js:294
Finding: Persistent Overwrite of Agent Identity and Injection into Long-Term Agent State
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/clawra-selfie.sh:106
Finding: Unsafe JSON Construction and Gateway Token Forwarding
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:14
Finding: Skill Grants Tools Beyond the Minimum Required for Image Messaging
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:167
Finding: Unpinned Global Installation of a Third-Party CLI
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (42)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This mismatch is materially real: the skill narrative says it selects selfie-style images, but instructions allow both dance and selfie content and include a direct local API transmission path in addition to the CLI. A misleading description reduces informed consent and may hide the fact that externally delivered media can target arbitrary contacts, which is risky in a messaging automation context.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This mismatch is materially real: the skill narrative says it selects selfie-style images, but instructions allow both dance and selfie content and include a direct local API transmission path in addition to the CLI. A misleading description reduces informed consent and may hide the fact that externally delivered media can target arbitrary contacts, which is risky in a messaging automation context.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: This mismatch is materially real: the skill narrative says it selects selfie-style images, but instructions allow both dance and selfie content and include a direct local API transmission path in addition to the CLI. A misleading description reduces informed consent and may hide the fact that externally delivered media can target arbitrary contacts, which is risky in a messaging automation context.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases include common conversational terms like 'dream,' 'how are you doing?,' and 'where are you?', making accidental activation likely during ordinary chat. In this skill, activation can lead to collection of recipient details and sending media to external messaging channels, so broad triggers materially increase the chance of unintended external actions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The installer writes IDENTITY.md and appends or replaces content in SOUL.md, altering the agent's core identity and behavior rather than narrowly enabling selfie delivery. In this skill context, that is especially dangerous because the package description suggests limited media functionality, while the code performs broad persona manipulation that can change how the agent behaves across future interactions.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The trigger patterns are broad enough to activate on common conversation terms such as "dance," "dream," or "what.*doing," which can cause the skill to run in contexts unrelated to the user’s intent. In a messaging skill that sends images to external channels, accidental invocation can lead to unintended content delivery, user confusion, and possible privacy or reputation issues.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The trigger phrases are overly broad and include common conversational terms like 'dream', 'dance', 'what are you doing?', and 'how are you doing?', which can activate the skill unintentionally during normal chat. Because the skill can send outbound messages and media, accidental invocation can lead to unintended external actions without sufficiently explicit user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README advertises sending photos across many messaging platforms but gives no warning that this involves external transmission of media, possible persistence on third-party services, or privacy implications. Given the skill's purpose of selecting and sending 'selfies,' the missing disclosure and safety constraints materially increase the risk of unreviewed outbound sharing, user surprise, and misuse across multiple destinations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction 'When users ask for pictures, use the clawra-selfie skill' is overly general and lacks scope, authorization, and consent checks. In this skill's context, that ambiguity is more dangerous because the skill is explicitly designed to send images across external messaging channels, increasing the chance of unintended disclosure or impersonation-like behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The example triggers are broad natural-language phrases such as requests for dancing, selfies, or current activity, which can easily occur in ordinary conversation. In an agent-integrated environment, this can cause unintended invocation of the skill and automatic transmission of images or persona-driven behavior without clear user intent or confirmation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill announces that it sends images to WhatsApp/Signal-like channels but does not prominently warn that content and recipient identifiers will be transmitted outside the local agent context. Lack of a clear privacy notice can cause users to share or route content externally without understanding the exposure, especially given the impersonation-like 'selfie' framing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The examples operationalize delivery to external channels and a direct HTTP API without any nearby warning or confirmation requirement. Example-first workflows are often copied verbatim, so omission of safety messaging increases the risk of users unintentionally transmitting content or credentials-sensitive operations to external services.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 91% confidence
Finding: The curl example performs an authenticated POST to a local messaging gateway that can forward content to external channels. While external transmission is the intended feature, it is security-relevant because it enables outbound data flow and message delivery, which can be abused for spam, impersonation, or privacy leakage if invoked without clear consent and validation.
Content: Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.
Alternative: Direct API call

bash
curl -X POST "http://localhost:18789/message" \ -H "Authorization: Bearer $OPENCLAW_GATEWAY_TOKEN" \ -H "Content-Type: application/json" \ -d '{

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest says the skill semantically chooses snapshot images and sends them to messaging channels via OpenClaw, but this file describes the skill as generating consistent AI selfies. That is a material intent mismatch because 'generate selfies' is different from selecting and sending existing images.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: The installer banner/comment encourages execution via npx clawra@latest, which pulls and runs the newest published package without version pinning. That creates a supply-chain risk: if the package is updated maliciously or a compromised release is published, users will execute unreviewed code immediately.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The installer prompts for an arbitrary agent identifier and then resolves and edits that agent's workspace, despite comments implying changes to the main workspace. In this context, targeting arbitrary workspaces broadens blast radius and makes it easier to modify a different agent than the user expects, which is risky for a package already changing core persona files.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code contains an installSkill() routine but the main flow skips it entirely and logs Skip modifying skills dir..., while still presenting itself as a skill installer. This discrepancy is security-relevant because users may believe only a normal skill deployment occurred when the actual effect is modification of workspace persona files, increasing the chance of deceptive or uninformed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: writeIdentity() unconditionally overwrites IDENTITY.md after only generic prompts, without a detailed disclosure that the existing identity file will be replaced. Because identity files shape agent behavior and presentation, silent overwrite can destroy prior configuration and introduce unwanted persona changes under the guise of installing a selfie feature.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: When reinstalling, the script recursively deletes the existing skill directory with fs.rmSync(..., recursive: true, force: true). The preceding prompt asks only 'Reinstall/update?' and does not clearly disclose that this action will delete the current installation contents.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The description suggests semantic selection of snapshot images, but the code merely generates a pseudo-random numbered filename within fixed selfie or dance directories. Apart from the coarse dance/selfie classification, there is no semantic matching of the prompt to a specific image's content.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes selecting snapshot images semantically as Haocun's selfies for messaging channels. In code, the whatwant function calls openclaw agent to classify the prompt as either dance or selfie, and then chooses from either a selfie frame set or a dance frame set, which broadens behavior beyond sending selfies.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/clawra-selfie.sh (reported line 114)May include surrounding context.
sh
HEADERS="$HEADERS -H \"Authorization: Bearer $GATEWAY_TOKEN\"" fi curl -s -X POST "$GATEWAY_URL/message" \ -H "Content-Type: application/json" \ ${GATEWAY_TOKEN:+-H "Authorization: Bearer $GATEWAY_TOKEN"} \ -d "{

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The direct API branch sends a message over the network but omits the user-supplied recipient target from both the JSON payload and the logs. In context, this makes message delivery less transparent and easier to misuse or misroute, because operators cannot verify where the content is being sent and the fallback path behaves differently from the CLI path.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: bin/cli.js:89