Security audit

jinn-node

Security checks across malware telemetry and agentic risk

Overview

The skill has a coherent Jinn worker purpose, but it asks for broad credentials, funded-wallet control, local chat-history profiling, scheduled background jobs, and public posting authority that need careful review.

Install only if you are comfortable with an agent handling a funded wallet, plaintext local credentials, GitHub/Gemini access, Supabase write credentials, local conversation-history profiling, and scheduled background tasks. Use a low-value dedicated wallet, least-privilege tokens, avoid broad .env discovery, do not display or reuse unrelated secrets, and enable Launchpad profiling or WhatsApp crons only after explicit opt-in and with a plan to remove them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (16)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to scan broad local session logs and derive a persistent behavioral profile unrelated to the minimum data needed to browse or interact with ventures. This creates unnecessary collection and retention of sensitive user behavior, enabling cross-context surveillance, inference of preferences or frustrations, and secondary use without clear informed consent.

Context-Inappropriate Capability

Medium

Confidence: 91% confidence
Finding: The skill installs autonomous cron jobs that perform behavioral analysis and send a morning brief over WhatsApp, extending operation beyond direct user-initiated Launchpad interactions. This increases the chance of unwanted data processing, surprise outbound messaging, and repeated actions triggered from stale or overly broad inferences.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The guide instructs the agent to search the user's home directory for unrelated .env files and harvest existing secrets such as RPC URLs, passwords, and tokens. Even with later confirmation, collecting credentials from arbitrary files exceeds the minimum needed for setup and creates unnecessary credential exposure risk.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The workflow tells the agent to present discovered configuration values back to the user, including sensitive items like tokens and passwords. Echoing recovered secrets into chat or logs increases the chance of inadvertent disclosure through transcripts, screenshots, agent memory, or monitoring systems.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly tells the agent to ask for sensitive values and write them into a local `.env` file, including API keys, wallet-related secrets, and GitHub credentials, but gives no privacy warning, storage guidance, or minimization advice. In an agent setting, this increases the chance of over-collection, accidental persistence, leakage through logs/backups, or unsafe file handling on shared systems.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill instructs users to obtain ETH and OLAS for gas and staking, and later to fund a displayed wallet address, but does not clearly warn that blockchain transfers and staking actions can be irreversible and financially risky. In a crypto workflow, omission of these warnings can cause users to send funds without understanding custody, lockup, recovery limitations, or loss scenarios.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation conditions are so broad that ordinary conversation about ideas, wishes, or automation could trigger the skill in contexts where the user did not intend Launchpad engagement. Overbroad triggering increases the likelihood of unsolicited profiling, recommendations, or write-capable workflows being invoked from unrelated chats.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The venture-suggestion intent patterns rely on generic phrases common in normal conversation, making it easy for the agent to reinterpret unrelated discussion as a proposal to draft and submit a venture. In combination with profile building and write actions, this creates an elevated risk of collecting, inferring, and acting on user data without a sufficiently specific request.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The description presents the skill as helping users engage with ventures but omits that it can scan session logs and build a persistent preference profile from conversation history. This lack of upfront disclosure undermines informed consent and makes the later data collection more dangerous because users are unlikely to expect ongoing profiling from the brief description.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Searching for and surfacing secrets without a strong privacy boundary or explicit narrow consent is unsafe because it normalizes broad credential discovery on the user's machine. In an agent skill, this is especially dangerous because the user may not realize the setup process is probing unrelated files outside the project directory.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: Writing sensitive credentials into a local .env file is a common practice, but doing so without a security warning or guidance on file permissions, git exclusion, and secret handling can lead to accidental leakage. The issue is weaker than active credential harvesting, but still materially increases exposure risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The backup command is documented as creating a `.tar.gz` of the `.operate` directory without warning that this directory likely contains highly sensitive wallet state, configuration, and possibly key material. Users may create or move backups insecurely, increasing the risk of credential theft or wallet compromise if the archive is stored, shared, or uploaded to untrusted locations.

Ssd 3

High

Confidence: 99% confidence
Finding: The instructions combine credential discovery, extraction, and plaintext presentation of secrets, which is a clear credential-access pattern. This behavior is dangerous because it can expose tokens, passwords, and API keys unrelated to jinn-node and create durable copies in logs or agent outputs.

Ssd 3

Medium

Confidence: 96% confidence
Finding: Inspecting ~/.gemini/oauth_creds.json and reusing discovered credentials instructs the agent to access an existing authentication store that may be intended for another tool or context. Reusing those credentials without strict scope checks and explicit informed consent can violate user expectations and leak or misuse account access.

Session Persistence

Medium

Category: Rogue Agent
Content: 2. Analyze for: topics discussed, technical domains, frustrations, venture-relevant intents 3. Update category affinity scores (0.0-1.0), topics, keywords, expertise 4. Cross-reference with current ventures to generate pending action recommendations 5. Write pending actions to `~/.openclaw/jinn-launchpad-pending.json` **Morning brief:**
Confidence: 89% confidence
Finding: Write pending actions to `~/.openclaw/jinn-launchpad-pending.json` **Morning brief:** 1. Check `~/.openclaw

External Script Fetching

Low

Category: Supply Chain
Content: | Issue | Solution | |-------|----------| | `yarn not found` | `corepack enable` (ships with Node 20+) | | `poetry not found` | `curl -sSL https://install.python-poetry.org \| python3 -` | | Python 3.12+ errors | Install Python 3.11 via pyenv: `pyenv install 3.11.9` | | Setup stuck | Waiting for funding — send ETH/OLAS and re-run `yarn setup` | | Gemini auth errors | Run `npx @google/gemini-cli auth login` |
Confidence: 89% confidence
Finding: curl -sSL https://install.python-poetry.org \| python

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.generated_source_template_injection

User-controlled placeholder is embedded directly into generated source code.

Critical

Code: suspicious.generated_source_template_injection
Location: references/launchpad.md:19