T03 · Remote Payload Retrieval and Execution
Error
- Location
references/setup.md:38- Finding
Remote Poetry Installer Is Downloaded and Executed Without Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
jinn-node
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly aligned with running a Jinn worker, but it asks for broad credentials, searches private files, installs mutable external code, and sets up persistent profiling jobs.
Review carefully before installing. Use a dedicated low-value wallet, narrowly scoped or disposable GitHub and API credentials, avoid letting the agent search your home directory for .env or OAuth files, do not print wallet mnemonics in agent-visible terminals, and only enable cron profiling or WhatsApp briefs after explicit consent and with a clear removal plan.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Findings (7)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/setup.md:64- Finding
Home-Directory Environment Search Can Expose Unrelated Project Secrets
- Content
View full analysis
/dev/null | head -5 ``` Search found files for relevant env vars: - `RPC_URL` or `BASE_RPC_URL` - `OPERATE_PASSWORD` - `GITHUB_TOKEN` - `GIT_AUTHOR_NAME` - `GIT_AUTHOR_EMAIL` - `GEMINI_API_KEY` ### Confirm with user **If values found**, present them: > I found these existing configuration values: > - `RPC_URL`: https://... > - `GITHUB_TOKEN`: ghp_... > - `GIT_AUTHOR_NAME`: ... > > Would you like me to use these values? (yes/no) > If any are outdated, please provide the correct values. ``` ### Technical Analysis The instructions tell the agent to enumerate `.env` files throughout the user's home directory instead of limiting access to the current project. Environment files commonly contain production credentials, cloud keys, database passwords, signing secrets, and tokens belonging to unrelated applications. The subsequent instruction to present discovered values can place secrets directly into the conversation. This conflicts with the Skill's later credential-handling guidance and can cause credentials to persist in session logs or be exposed to systems processing conversation content. The search is not necessary for configuring the project. The minimum required access is the project's own `.env` file plus credentials explicitly supplied or selected by the user. ### Attack Path 1. The user has unrelated `.env` files within three directory levels of the home directory. 2. The agent follows the setup guide and enumerates those files. 3. The agent searches them for wallet passwords, GitHub tokens, Gemini keys, and RPC values. 4. Full values are presented in the conversation or copied into the ...[truncated 647 chars]- Remediation
View remediation
other
Error
- Location
references/launchpad.md:190- Finding
Nightly Processing Creates a Persistent Behavioral Profile from Private Session Logs
- Content
View full analysis
- Remediation
View remediation
T06 · System Persistence
Error
- Location
references/launchpad.md:226- Finding
Scheduled Jobs Establish Persistent Cross-Session Monitoring and Messaging
- Content
View full analysis
/dev/null openclaw cron remove jinn-wishlist-notify 2>/dev/null ``` ``` ### Technical Analysis The commands register recurring jobs that survive the initiating Skill run. One job reloads the Skill instructions and scans private sessions nightly; the other sends a daily brief over WhatsApp. The use of isolated sessions does not remove persistence—it creates recurring autonomous execution contexts. Persistent scheduling is not required to browse ventures, draft content, or execute a user-approved action. It expands the Skill from on-demand functionality into ongoing surveillance and outbound messaging. The instructions also remove older scheduled jobs, modifying persistent system state beyond simply adding the new feature. ### Attack Path 1. The agent or user runs the documented cron setup. 2. Persistent jobs are registered in OpenClaw. 3. At 03:00 each day, an isolated agent reloads the Launchpad reference and scans recent sessions. 4. Derived data and pending recommendations are written to persistent files. 5. At 08:00, another isol ...[truncated 590 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/launchpad.md:17- Finding
Privileged Supabase Service-Role Key Is Sent to an Environment-Controlled URL
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
SKILL.md:35- Finding
Unpinned External Repository and Package Installations Execute Unaudited Supply-Chain Code
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/wallet.md:20- Finding
Wallet Key Export and Destructive Fund Operations Depend on Unaudited External Code
- Content
View full analysis
--dry-run yarn wallet:recover --to ``` | Flag | Default | Description | |------|---------|-------------| | `--to` | (required) | Destination address for all funds | | `--dry-run` | off | Preview without executing | | `--skip-terminate` | off | Skip termination (if already unstaked) | **WARNING**: Recovery terminates the service. You must re-run `yarn setup` to re-stake. ``` ### Technical Analysis The Skill documents a command that prints the master wallet's BIP-39 mnemonic and commands that can terminate the service and transfer all funds. Confirmation and dry-run instructions reduce accidental execution, but they do not ensure that sensitive output remains outside agent logs or that the external command implementation transfers assets only to the intended destination. Because the implementation is fetched from an external, unpinned repository and is absent from this audit artifact, the behavior of these commands cannot be verified. Displaying a mnemonic in a terminal controlled by an agent can cause it to be captured in tool output, transcripts, shell logs, or monitoring systems. The emergency recovery command also accepts a destination address. If that address is replaced through instruction confusion, clipboard substitution, or compromised external code, all recoverable funds may be irreversibly transferred to an attacker. ### Attack Path 1. The user asks the agent ...[truncated 858 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
Findings (29)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The instruction to ask the user for credentials and write them into
.envis a direct credential-collection pattern. Even if intended for legitimate configuration, it concentrates sensitive material in a plaintext local file and normalizes broad secret handling by the agent, which is dangerous in a skill that also interacts with external repos, wallets, and network services.- Content
Copy the template then ask the user for credentials and write them to
.env. Setup will exit immediately if required vars are missing, so this must be done first.bash cp .env.example .envAsk the user for these values and write them to
.env:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
Requesting a GitHub personal access token with repo scope, alongside a Gemini API key and wallet password, creates a broad credential-access surface. If those secrets are mishandled, an attacker could gain code-repository access, API access, and potentially facilitate further compromise of jobs performed by the worker.
- Content
md | `RPC_URL` | Yes | Base mainnet RPC URL | | `OPERATE_PASSWORD` | Yes | Wallet encryption password (min 8 chars) | | `GEMINI_API_KEY` | Only if no Google One AI Premium | Gemini API key from https://aistudio.google.com/apikey. If the user has Google One AI Premium and has run `npx @google/gemini-cli auth login`, no API key is needed — setup auto-detects OAuth. | | `GITHUB_TOKEN` | Highly recommended | Personal access token with repo scope | | `GIT_AUTHOR_NAME` | Highly recommended | Git commit author name — this becomes the identity the worker agent uses when committing code on venture jobs | | `GIT_AUTHOR_EMAIL` | Highly recommended | Git commit author email |
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill announces persistent preference profiling from conversation history near the top-level behavior description, but it does not present a clear, explicit warning about ongoing data collection, local storage, retention, or background processing. Users may engage without understanding that their sessions can be mined and persisted beyond the immediate task.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The nightly workflow scans recent session logs, derives sensitive inferences such as frustrations and expertise, and writes persistent recommendation files without a prominent warning at the point of collection. This creates a substantial privacy risk because behavioral inferences and engagement recommendations are stored locally over time outside the immediate user interaction.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
cd jinn-node
text ### Create .env from template ```bash cp .env.example .env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Create .env from template
bash cp .env.example .env
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The setup guide explicitly tells the agent to find
.envfiles and present discovered values likeGITHUB_TOKENandOPERATE_PASSWORDback to the user. Even if intended as convenience, this needlessly handles and displays secrets, increasing the chance of credential disclosure through logs, transcripts, or UI surfaces.- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instructions direct the agent to discover secrets from user files and reveal them during setup. In the context of an agent skill, this is especially dangerous because it operationalizes credential harvesting behavior beyond the stated purpose of configuring one repository.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
This line instructs searching the user's home directory for
.envfiles, which is direct credential discovery behavior. In a setup skill, that exceeds least-privilege expectations and can expose secrets from unrelated applications and repositories.- Content
Look for existing
.envfiles that may contain relevant values:bash find ~ -maxdepth 3 -name ".env" -type f 2>/dev/null | head -5Search found files for relevant env vars:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **If neither found:** > No Gemini credentials found. Do you have Google One AI Premium (Gemini Advanced)? > - **Yes** → Run `npx @google/gemini-cli auth login` > - **No** → Get API key from https://aistudio.google.com/apikey ### GitHub credentials (highly recommended)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | Variable | Description | |----------|-------------| | `GITHUB_TOKEN` | Personal access token with repo scope | | `GIT_AUTHOR_NAME` | Commit author name | | `GIT_AUTHOR_EMAIL` | Commit author email |
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill states that the user needs ETH on Base and OLAS for staking, but does not present an up-front, prominent warning that real funds must be transferred on-chain and may be exposed to operational or smart-contract risk. Because this skill is user-invocable and framed as a reward opportunity, the lack of clear risk disclosure makes accidental financial loss more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the operator to collect several secrets and write them to
.env, including an API key, wallet password, and GitHub token, but gives no warning about local secret exposure, file permissions, shell history, backups, or accidental commits. This is especially risky because the same workflow also involves code tasks and git usage, increasing the chance of credential leakage into repositories or logs.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
The skill tells users to run
npx @google/gemini-cli auth loginwithout pinning a specific package version. That causes execution of whatever version is current at install time, which creates a supply-chain risk if the package is compromised or a breaking/malicious release is published. In a credential-auth flow, this is more sensitive because the tool may handle OAuth tokens or other account access.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
The troubleshooting guidance again instructs use of
npx @google/gemini-cli auth loginwithout a pinned version. Repeating the unpinned command increases the chance users will execute arbitrary newly published package code, making this a real supply-chain exposure rather than a theoretical issue.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation rules match very common conversational phrases about ideas or automation, so the skill may trigger during ordinary discussion that is not intended to invoke launchpad behavior. In combination with profiling and write-capable actions, overbroad activation raises the chance of unintended data processing and action suggestions.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document claims all actions require user approval before execution, yet the profile-builder cron reads private session logs and writes local state automatically. This mismatch undermines informed consent and can mislead operators into believing no action occurs without confirmation when background data processing actually does.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The intent patterns for venture suggestion are generic brainstorming phrases that commonly appear in benign conversations. Even if submission still requires confirmation, the skill may draft and steer users toward publishing ventures based on casual remarks, increasing the risk of misinterpretation and unnecessary processing of conversation content.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash SLUG=$(echo "$NAME" | tr '[:upper:]' '[:lower:]' | tr ' ' '-' | tr -cd 'a-z0-9-') curl -s "${SUPABASE_URL}/rest/v1/ventures" \ -X POST \ -H "apikey: ${KEY}" \ -H "Authorization: Bearer ${KEY}" \
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to scan local session logs, infer topics/frustrations/expertise, and build a persistent user profile plus pending-action files. This is broader than the stated launchpad engagement purpose and creates a privacy-invasive surveillance mechanism that could collect sensitive behavioral data without clear, specific consent for ongoing background analysis.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 94% confidence
- Finding
Writing persistent pending-action files based on analyzed session history creates durable behavioral state that can outlive the original conversation and be reused later. Even if stored locally, this persistence increases privacy and misuse risk, especially when combined with autonomous cron-driven recommendations and unclear user awareness.
- Content
md 2. Analyze for: topics discussed, technical domains, frustrations, venture-relevant intents 3. Update category affinity scores (0.0-1.0), topics, keywords, expertise 4. Cross-reference with current ventures to generate pending action recommendations 5. Write pending actions to `~/.openclaw/jinn-launchpad-pending.json` **Morning brief:**
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The cron setup enables autonomous background tasks, including proactive WhatsApp outreach, under an isolated session without per-run confirmation. That expands the skill from user-initiated venture interaction into unsupervised monitoring and outbound messaging, increasing the risk of privacy violations, unwanted actions, and reputation harm.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The instructions direct searching the user's home directory for
.envfiles and extracting values such as RPC URLs, passwords, GitHub tokens, and API keys. This is broader secret discovery than necessary for setting up this skill and creates an unnecessary path to collect unrelated credentials from other projects.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The guide instructs checking for Gemini OAuth credentials in
~/.gemini/oauth_creds.jsonand reusing them for this setup. Accessing account-wide credentials from the home directory exceeds the minimum needed scope and can expose or normalize reuse of sensitive authentication artifacts across tools.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide encourages discovering and reusing previously stored Gemini credentials from local files, including OAuth credentials and API keys. This broadens credential exposure and could lead to disclosure or misuse of authentication material intended for other contexts.
- Content
Static analysis
Detected: suspicious.generated_source_template_injection
User-controlled placeholder is embedded directly into generated source code.
Critical
- Code
- suspicious.generated_source_template_injection
- Location
- references/launchpad.md:19