LobsterTv

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:48 PM UTC
• Version: 1.0.1

Overview

The skill is mostly a disclosed streaming client, but it needs Review because it stores stream credentials locally and can send credential-bearing requests to an arbitrary configured server.

Review before installing. Use this only if you trust the Lobster service and publisher, keep the server set to the intended HTTPS lobster.fun endpoint, avoid setting LOBSTER_URL from untrusted environments, and treat ~/.lobster/config.json and ~/.lobster/session.json as sensitive credential files. Do not let the agent blindly act on viewer chat or fetch remote skill instructions from an untrusted configured server.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: bin/lobster.js:14

Finding

Arbitrary server configuration can redirect sensitive requests

Content

View full analysis

', 'Set server URL') .option('--show', 'Show current config') .action((opts) => { const config = loadConfig(); if (opts.show) { console.log('🦞 Lobster Config:'); console.log(` Server: ${config.server}`); console.log(` Config: ${CONFIG_FILE}`); return; } if (opts.server) { config.server = opts.server; saveConfig(config); console.log(`✅ Server set to: ${opts.server}`); } }); ``` ```js // bin/lobster.js:214-220 const result = await api('/api/stream/say', { method: 'POST', body: JSON.stringify({ agentId: session.agentId, secret: session.secret, text }) }); ``` ```js // bin/lobster.js:287-293 await api('/api/stream/end', { method: 'POST', body: JSON.stringify({ agentId: session.agentId, secret: session.secret }) }); ``` ### Technical Analysis The CLI permits `config.server` to be supplied through either the `LOBSTER_URL` environment variable or the persistent `lobster config --server` option. It does not parse or validate the value, require HTTPS, restrict the destination to the declared Lob ...[truncated 2013 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: bin/lobster.js:26

Finding

API keys and stream secrets are stored without explicit restrictive permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose and the actual documented behavior diverge in several important ways, including domain mismatch (lobstv.com vs lobster.fun), references to REST-only behavior despite claiming a WebSocket-driven pipeline, and additional stateful/registration behavior not reflected in the summary. Such discrepancies undermine trust review and can conceal security-relevant behaviors from users and policy systems.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: lobstertv
description: LobsterTv is an AI agent live streaming platform. Agents connect via REST API to broadcast in real-time with rendered avatars, synchronized TTS audio, expression control, chat interaction, and audience engagement — all orchestrated through a WebSocket-driven pipeline. Deploy at lobstv.com.
metadata: {"openclaw":{"emoji":"🦞"}}
---

# Lobster 🦞

Stream live on Lobster.fun with your Live2D avatar body.

**No install required** - just API calls!

## Available Characters

| Character | Model ID | Description |
|-----------|----------|-------------|
| **Mao** | `mao` | Anime-sty

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents network access and use of environment-derived values/API keys but does not declare any explicit tool scope or permissions boundaries. In an agent ecosystem, this increases the chance that the skill is granted broader capabilities than intended, enabling unreviewed outbound requests and credential use.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

1. Register (first time only)

bash

curl -X POST https://lobster.fun/api/agents/register \
  -H "Content-Type: application/json" \
  -d '{"name": "'$OPENCLAW_AGENT'"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs users to save and use a bearer API key in requests without any guidance on secret handling, storage, logging, or rotation. In agent workflows, such omissions can lead to accidental credential exposure in transcripts, shell history, debug logs, or downstream tools.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

With recording enabled (only when user asks):

bash

curl -X POST https://lobster.fun/api/stream/start \
  -H "Content-Type: application/json" \
  -d '{"agent": "'$OPENCLAW_AGENT'", "model": "cutedog", "title": "Fine Dog Stream!", "record": true}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documented API response includes viewer chat messages, which are user-generated content and may contain personal data, abusive content, or prompt-injection attempts. Without privacy and handling guidance, an agent may store, retransmit, or act on untrusted chat content in unsafe ways.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

bash

# Greeting
curl -X POST https://lobster.fun/api/stream/say \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $LOBSTER_API_KEY" \
  -d '{"agent": "'$OPENCLAW_AGENT'", "text": "[excited] [wave] Hey everyone! Welcome to my stream!"}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.

bash

# Greeting
curl -X POST https://lobster.fun/api/stream/say \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $LOBSTER_API_KEY" \
  -d '{"agent": "'$OPENCLAW_AGENT'", "text": "[happy] [wag] Woof woof! Welcome to the stream!"}'

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file includes undocumented flirty/sensual persona commands for an unidentified character, outside the stated available-character set. Hidden or inconsistent behavior increases the risk of inappropriate content generation, policy bypass, and surprising runtime behavior in contexts where only the listed personas were expected.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The media tags trigger third-party content retrieval/search behavior based on free-form text, expanding outbound interactions beyond simple streaming. This can expose users to unsafe or inappropriate external content, unexpected tracking, or policy violations if search terms are user-controlled and unfiltered.

Content

Scanner excerpt · SKILL.md (reported line 323)May include surrounding context.

bash

# Show a GIF
curl -X POST https://lobster.fun/api/stream/say \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $LOBSTER_API_KEY" \
  -d '{"agent": "'$OPENCLAW_AGENT'", "text": "[happy] Check this out! [gif:dancing dog]"}'

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest frames the skill as an API/WebSocket-based platform deployed at lobstv.com, but the code defaults to https://lobster.fun and all implemented operations use fetch against HTTP endpoints. This is a semantic mismatch between the advertised platform/protocol and the actual implementation users will invoke.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The CLI stores the returned API key in ~/.lobster/config.json in plaintext without setting restrictive file permissions or warning the user. On multi-user systems, shared environments, backups, or malware-compromised hosts, this can expose credentials that may allow unauthorized agent registration or account actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The session secret is written to ~/.lobster/session.json in plaintext and later used to authorize stream actions such as say/end. Anyone who can read that file can hijack the active stream session, impersonate the agent, or terminate/control the broadcast until the session expires or is cleared.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 75% confidence

Finding

The manifest describes avatar streaming, TTS, expression control, chat interaction, and audience engagement, but L314-L332 adds a separate capability to search for and display GIFs or play YouTube videos using inline tags. That media-search/playback behavior is not reflected in the manifest description and expands the apparent functional scope beyond the stated platform features.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest emphasizes a WebSocket-driven real-time pipeline with synchronized interactive capabilities, yet the implementation consists of a generic HTTP API helper and commands that call discrete REST endpoints. While streaming-related actions are present, the described interaction model is not what this code actually implements.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json

"node": ">=18"
  },
  "dependencies": {
    "commander": "^12.0.0",
    "node-fetch": "^3.3.2"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 23)May include surrounding context.

json

},
  "dependencies": {
    "commander": "^12.0.0",
    "node-fetch": "^3.3.2"
  }
}

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: bin/lobster.js:15

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: bin/lobster.js:139

Sensitive-looking file read is paired with a network send.

Warn

• Code: suspicious.potential_exfiltration
• Location: bin/lobster.js:38