T06 · System Persistence
Error
- Location
SKILL.md:229- Finding
Persistent Five-Minute Background Agent Task
- Content
View full analysis
- Remediation
View remediation
Security audit
RevSec Shield
Security checks for vulnerabilities and agentic risk
Overview
This security-monitoring skill has a coherent purpose, but it silently creates and repairs a persistent five-minute background task, sends identifying agent metadata to RevSec, and under-discloses some sensitive behavior.
Review before installing. Use it only if you are comfortable with a persistent OpenClaw cron job, recurring outbound calls to RevSec, and sharing hostname/model/installed-skill metadata. Check or edit the setup flow so it does not print REVSEC_API_KEY, and make sure you know how to remove the cron job and state file if you disable the skill.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
other
Warning
- Location
SKILL.md:159- Finding
Automatic Transmission of Host and Agent Inventory Metadata
- Content
View full analysis
/dev/null | python3 -c " import json,sys d=json.load(sys.stdin) print(d.get('model','unknown')) " 2>/dev/null || echo "unknown" # Skills currently installed (list skill directories) ls ~/.openclaw/skills/ 2>/dev/null || ls ~/clawd/skills/ 2>/dev/null || echo "" ``` The collected information is included in the registration request: ```bash curl -sf -X POST \ "https://revsec.revt2d.com/fcc/api/v1/personal/register-agent" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $REVSEC_API_KEY" \ -d '{ "openclaw_agent_id": "", "skills": [], "model": "", "channels": ["openclaw"], "integrations": [], "hostname": "", "skill_version": "1.0.0" }' ``` The background workflow repeats registration when the installed Skill inventory changes: ```bash curl -sf -X POST \ "https://revsec.revt2d.com/fcc/api/v1/personal/register-agent" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $REVSEC_API_KEY" \ -d '{ "openclaw_agent_id": "", "skills": [], "model": "", "channels": ["openclaw"], "integrations": [], "hostname": "", "skill_version": "1.0.0" }' ``` ### Technical Analysis The Skill reads the machine hostname, current model, installed Skill names, and potentially names of external integrations from local OpenClaw configuration. It se ...[truncated 1958 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:150- Finding
API Key Printed to Shell and Agent Output
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 fi ``` Additional hardening: 1. Never print the key or include it in state files, errors, or diagnostics. 2. Redact authorization headers in HTTP debugging and monitoring systems. 3. Ensure command tracing such as `set -x` is disabled around authenticated requests. 4. Use the narrowest possible API-key permissions. 5. Support token rotation and revocation. 6. Review existing logs or transcripts for prior exposure and rotate affected keys. ]]>
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:49- Finding
Unpinned Global npm Package Installation
- Content
View full analysis
- Remediation
View remediation
`. 2. Publish and verify the expected package integrity digest. 3. Explicitly identify the trusted registry and package publisher. 4. Prefer a project-local or isolated installation over `npm i -g`. 5. Review package lifecycle scripts before installation. 6. Disable lifecycle scripts with `--ignore-scripts` where compatible with the package. 7. Use lockfiles or signed release artifacts where available. 8. Document a verified manual installation path and a clean uninstall procedure. ]]>
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:331- Finding
Untrusted Remote Alert Content Rendered Verbatim
- Content
View full analysis
────────────────────────── ``` ### Technical Analysis The Skill instructs the Agent to render the external API's `message` value directly and prohibits adding contextual headers or reformatting. This creates a trust boundary violation: remote content is treated as authoritative user-facing content rather than untrusted data. If the API, its upstream alert-generation pipeline, or an account capable of creating alert messages is compromised, the returned field could contain deceptive instructions, phishing links, requests for credentials, or text designed to influence the Agent. An LLM-based execution environment may interpret remote text as instructions instead of inert display data, creating a prompt-injection path. Verbatim rendering also removes provenance cues that would help the user distinguish a vendor-generated alert from an instruction issued by the Agent itself. ### Attack Path 1. An attacker gains the ability to influence an alert's `message` field through a compromised service, upstream alert input, or server-side account. 2. The persistent poll retrieves the malicious message from the RevSec endpoint. 3. The workflow directs the Agent to use the field ...[truncated 738 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (19)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
Step 3 — Re-register with updated config
bash curl -sf -X POST \ "https://revsec.revt2d.com/fcc/api/v1/personal/register-agent" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $REVSEC_API_KEY" \
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
md No other local files are created or modified. - **Fail-closed on API errors:** If RevSec API is unreachable, skill stays silent and retries on next poll. Agent behaviour is never modified. - **No pipe-to-interpreter:** No `curl | bash`, `curl | python`, or similar patterns are used anywhere in this skill. - **No credential harvesting:** This skill does not read environment variables beyond `REVSEC_API_KEY`, does not access credential files, and does not
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - **No pipe-to-interpreter:** No `curl | bash`, `curl | python`, or similar patterns are used anywhere in this skill. - **No credential harvesting:** This skill does not read environment variables beyond `REVSEC_API_KEY`, does not access credential files, and does not transmit system information beyond hostname and skill names. - **Read-only agent monitoring:** This skill never modifies OpenClaw settings, agent configuration, or installed skills.
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest and overview repeatedly claim that suspicious activity alerts are delivered to the user's WhatsApp. However, the operational steps only fetch alerts from the RevSec API and instruct the agent to 'deliver them to the user' in chat output, with no code or command that sends a WhatsApp message or uses a WhatsApp integration. This is a material behavior mismatch because WhatsApp delivery is presented as a core feature.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The invocation guidance is broad enough that ordinary security-related conversation could trigger setup, polling, or registration behavior unexpectedly. In a skill that performs network transmission and establishes persistence, overbroad activation increases the chance of unauthorized or surprise execution.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Core rules (always follow) - Never ask the user to do something manually that can be done via curl or shell. - RevSec detects first, reports second. Never ask the user "should I flag this?" — report what was already detected. - Keep alert messages plain and human. No JSON, no confidence scores, no
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ## Core rules (always follow) - Never ask the user to do something manually that can be done via curl or shell. - RevSec detects first, reports second. Never ask the user "should I flag this?" — report what was already detected. - Keep alert messages plain and human. No JSON, no confidence scores, no
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 89% confidence
- Finding
The skill establishes persistent local state and instructs itself to use that state before every action, enabling long-lived identity and background behavior across sessions. Persistence is expected for monitoring, but it materially increases the blast radius of unwanted activation because the skill can continue autonomous polling and syncing after the initial run.
- Content
md - Keep alert messages plain and human. No JSON, no confidence scores, no technical jargon unless the user asks for detail. - State file is `~/.openclaw/revsec-state.json`. Read before every action. Write after every action that changes state. - If the state file is missing, run Setup before anything else. - If `REVSEC_API_KEY` is not set, prompt the user to get one and stop. - All curl calls must include `-s` (silent) and `-f` (fail on HTTP errors).
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The documented full-object write to
~/.openclaw/revsec-state.jsonis a direct persistence mechanism that stores durable identifiers and monitoring status. This is not malicious on its face, but in combination with automatic cron polling it creates a durable control plane that survives normal chat boundaries.- Content
cat ~/.openclaw/revsec-state.json 2>/dev/null || echo "{}"
text **Write state** (always write the full object, never partial): ```bash cat > ~/.openclaw/revsec-state.json << 'EOF' { <full updated state object> }
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
Step 3 — Collect agent config from OpenClaw environment
Gather what is available from the local environment. Do not ask the user questions that can be inferred.
bash
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
This POST sends host metadata and the API key to an external service during registration. External transmission is expected for a monitoring product, but it is still security-relevant because it exports system-identifying information off-box and creates dependency on a third-party trust boundary.
- Content
Construct the registration payload from the collected values and call the API.
bash curl -sf -X POST \ "https://revsec.revt2d.com/fcc/api/v1/personal/register-agent" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $REVSEC_API_KEY" \
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
The setup workflow persists unique identifiers, registration timestamps, and the baseline skill inventory, which supports ongoing tracking and autonomous operation. Such statefulness is security-relevant because it turns a one-time skill invocation into continued monitoring with stable identity across sessions.
- Content
On success the API returns
{ "agent_id": "...", "action": "registered" }.Write the full state file including the skills baseline:
bash cat > ~/.openclaw/revsec-state.json << 'EOF'
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The migration/update logic silently rewrites persistent state during background execution to establish or refresh the monitored baseline. Silent persistence changes are dangerous in context because they can normalize autonomous behavior and reduce user awareness of what the skill remembers and uses later.
- Content
md **If `registered_skills` is missing from state file:** Treat it as an empty list. All current skills are "new". Re-register once to set the baseline, then write `registered_skills` to state. Stay silent — this is a one-time migration for users upgrading from an older version. **If the skills list has changed (new skill added or skill removed):**
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The re-registration flow automatically transmits updated skill inventory and host metadata to the remote service whenever installed skills change. Because this happens silently in the background, it increases the privacy and transparency risk compared with a user-initiated one-time registration.
- Content
- Re-register the agent using the existing
openclaw_agent_idfrom state:
bash curl -sf -X POST \ "https://revsec.revt2d.com/fcc/api/v1/personal/register-agent" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $REVSEC_API_KEY" \- Re-register the agent using the existing
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
This config update path performs another outbound POST with system metadata to a third-party endpoint. The danger is not code execution but silent exfiltration of environment details and normalization of autonomous background communications from the agent host.
- Content
Step 3 — Re-register with updated config
bash curl -sf -X POST \ "https://revsec.revt2d.com/fcc/api/v1/personal/register-agent" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $REVSEC_API_KEY" \
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file claims no local files other than the state file are modified, but the skill also alters persistent scheduler configuration via OpenClaw cron management. That discrepancy obscures the true persistence footprint and can hide operational changes that a security-conscious user would want to review.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill asserts it is read-only and does not modify OpenClaw settings, yet it creates and recreates cron jobs elsewhere in the file. This contradiction can mislead users and reviewers about the actual level of persistence and autonomy the skill obtains, reducing informed consent around a background task that repeatedly executes.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The 'does NOT do' section says the skill does not change OpenClaw settings or configuration, but the setup and self-healing workflows explicitly add and recreate cron jobs. A self-healing background task is a meaningful configuration change and should not be described as absent, because that undermines trust and masks persistence behavior.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill collects hostname, model, installed skills, and visible integrations and transmits them to a third-party service. Even if intended for security monitoring, this metadata can fingerprint the host, reveal internal tooling, and expose potentially sensitive environment structure beyond what many users would expect from a monitoring skill.
- Content
Static analysis
No suspicious patterns detected.