Bulletin Tools

• Outcome: Review
• Latest audit: May 29, 2026 · 9:26 PM UTC
• Version: 0.1.5

Overview

This appears to be a real coordination plugin, but it needs Review because it can wake agents with caller-supplied task text and exposes stored bulletin content more broadly than users may expect.

Install only if you intentionally want this plugin to wake agents automatically, post discussion material to configured channels, and retain searchable bulletin history. Use narrowly scoped Discord and gateway tokens, restrict who can create bulletins or call the gateway route, keep bulletin IDs and channels private, and avoid putting secrets or sensitive business data in bulletin text unless retention and visibility are acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The skill presents itself as a coordination bulletin board, but the manifest reveals materially broader capabilities: outbound messaging to multiple platforms, asynchronous subagent execution via gateway/HTTP fallback, access to secrets/config files, and searchable stored history. That mismatch is dangerous because operators may enable or trust the skill for low-risk coordination while unknowingly granting it the ability to trigger external actions, access credentials, and expand execution scope across agents and services.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The README states that the plugin may automatically fall back to an HTTP POST to a Gateway `/bulletin/wake` endpoint when waking agents, but it does not clearly warn users that bulletin contents, task context, agent identifiers, or metadata may be transmitted over the network. In a coordination tool that handles internal deliberation and decision data, undocumented network transmission increases the risk of inadvertent data exposure, especially if the gateway is remote, misconfigured, or not protected with TLS and strong authentication.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill references bot tokens, gateway tokens, and automatic wake-up/HTTP fallback behavior without any prominent warning to users that invoking it may consume credentials and send outbound messages or trigger other agents. In a multi-agent environment, that lack of disclosure increases the chance of unintended external actions, surprise cross-agent execution, and misuse of privileged tokens.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The plugin sends bulletin contents, critiques, and status messages to external messaging platforms without any visible consent gate, data-classification check, or per-bulletin approval. Because bulletin bodies and responses may contain sensitive internal agent deliberation, this creates a real risk of unintended data leakage to third-party services or misconfigured channels.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The HTTP fallback transmits full task content and a bearer token over a local HTTP request without operator disclosure. Even though it targets localhost, local plaintext transport can still expose sensitive prompt/task data to local monitoring, compromised co-tenant processes, or misrouted local services, and the pattern broadens the path by which privileged wake operations occur.

Credential Access

High

• Category: Privilege Escalation

Content

config:
        - ~/.openclaw/mailroom/bulletin-config.json
        - ~/.openclaw/mailroom/agent-groups.json
        - ~/.openclaw/secrets.json
    primaryEnv: DISCORD_BOT_TOKEN
    install:
      - kind: node

• Confidence: 95% confidence
• Finding: The skill explicitly requires access to ~/.openclaw/secrets.json and multiple bot/gateway tokens, which is a credential-access capability. In context, this may be functionally necessary for messaging integrations, but it is still security-sensitive because compromise, misuse, or overbroad access could expose tokens that enable unauthorized messaging, impersonation, or broader system access.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: index.ts:43