Openclaw Skill Gastown

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:01 AM UTC
• Version: 0.1.4

Overview

This appears to be a real multi-agent coding tool, but it can run persistent agents, change repositories, and includes risky setup steps that should be reviewed before use.

Install only if you intentionally want a multi-agent coding orchestrator that can start local AI coding sessions, create persistent state, modify repositories, and process merges. Review setup commands first, avoid delegating sudo or shell-profile edits blindly, prefer pinned or verified tool versions, and use it only in repositories where automated workers are acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (14)

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The README describes invocation in very broad terms: 'Just tell the agent what you need' and gives a generic software task example. That can cause the skill to activate on ordinary coding requests without clear user intent to use this specific multi-agent orchestrator, increasing the chance of unexpected command execution, repository modification, or parallel task dispatch in the user's environment.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly tells the agent to execute all `gt` and `bd` commands on the user's behalf, but these commands can create workspaces, initialize git repositories, modify bead state, spawn agents, and alter project data. Because the agent is positioned as the primary operator, users may not receive a clear consent checkpoint before state-changing actions occur, increasing the risk of unintended filesystem, repository, or orchestration changes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup steps include package installation, git initialization, workspace creation, project addition, and service startup, all of which change local system and repository state. Presenting these as standard workflow steps without prominent warnings or approval requirements can cause an agent to perform destructive or irreversible setup actions automatically.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The full-stack mode describes starting a daemon and automatic lifecycle management for agents, meaning background processes may continue running and act without further prompts. In an agent-executed environment, that autonomy materially increases risk because it can trigger additional work, file changes, or session spawning after the initial command.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The architecture explicitly endorses automatic execution of queued work via the GUPP rule ('If your hook has work, RUN IT') without requiring user confirmation, policy checks, or safety gating. In a multi-agent system that can dispatch work, mutate repositories, and send cross-agent instructions, this creates a strong pathway for unsafe or malicious tasks to propagate and execute automatically after compromise or misrouting.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script appends to the user's ~/.bashrc without prompting or clearly warning that it will persistently modify the shell environment. While the added PATH entry is not itself malicious, silent profile modification is risky because it changes future shell behavior and can create persistence or precedence issues if the target directories later contain untrusted executables.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Gas Town Universal Propulsion Principle:**
> If your hook has work, RUN IT.

No waiting. No asking. Work lands on hook → work runs.

Molecules (work units) survive crashes. Any worker can continue where another left off. The engine never stops as long as there's fuel.

• Confidence: 95% confidence
• Finding: The phrase 'No asking' paired with 'work lands on hook → work runs' describes autonomous decision-making that bypasses operator review at the point of execution. In this context, agents are empowered to continue work across crashes and handoffs, so a bad instruction, poisoned queue item, or compromised agent could trigger persistent self-propagating behavior without a human checkpoint.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Install Go (apt version may be outdated, use official installer)
wget https://go.dev/dl/go1.24.12.linux-amd64.tar.gz
sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.24.12.linux-amd64.tar.gz
echo 'export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin' >> ~/.bashrc
source ~/.bashrc

• Confidence: 93% confidence
• Finding: This duplicate finding points to the same privileged installation command using `sudo` for system modification. Even though the documentation appears instructional rather than malicious, embedded privilege escalation steps are unsafe when consumed by an autonomous assistant.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Install Go (apt version may be outdated, use official installer)
wget https://go.dev/dl/go1.24.12.linux-amd64.tar.gz
sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.24.12.linux-amd64.tar.gz
echo 'export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin' >> ~/.bashrc
source ~/.bashrc

• Confidence: 93% confidence
• Finding: This duplicate finding points to the same privileged installation command using `sudo` for system modification. Even though the documentation appears instructional rather than malicious, embedded privilege escalation steps are unsafe when consumed by an autonomous assistant.

Session Persistence

Medium

• Category: Rogue Agent

Content

$ npm install -g @gastown/gt                              # npm
$ go install github.com/steveyegge/gastown/cmd/gt@latest  # From source

# If using go install, add Go binaries to PATH (add to ~/.zshrc or ~/.bashrc)
export PATH="$PATH:$HOME/go/bin"

# Create workspace with git initialization

• Confidence: 84% confidence
• Finding: The skill advises modifying persistent shell startup files such as `~/.zshrc` or `~/.bashrc` to change PATH behavior across sessions. Persistent environment changes are risky in an agent context because they affect future shells and can have broader side effects than the immediate task.

Session Persistence

Medium

• Category: Rogue Agent

Content

# If using go install, add Go binaries to PATH (add to ~/.zshrc or ~/.bashrc)
export PATH="$PATH:$HOME/go/bin"

# Create workspace with git initialization
gt install ~/gt --git
cd ~/gt

• Confidence: 92% confidence
• Finding: The workflow starts by creating a workspace with git initialization and then adding a project and crew workspace, which establishes persistent on-disk state and new repository structures. That persistence is legitimate for the tool, but unsafe if an agent performs it automatically without explicit consent and path validation.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Install Go (apt version may be outdated, use official installer)
wget https://go.dev/dl/go1.24.12.linux-amd64.tar.gz
sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.24.12.linux-amd64.tar.gz
echo 'export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin' >> ~/.bashrc
source ~/.bashrc

• Confidence: 88% confidence
• Finding: Although not an obvious malicious payload, the combined `rm -rf /usr/local/go && sudo tar -C /usr/local ...` sequence performs destructive replacement of a system directory using a compressed archive. In an agent-run context, this is dangerous because parameterized destructive commands against system paths can remove existing software and leave the environment broken if interrupted or misapplied.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Install Go (apt version may be outdated, use official installer)
wget https://go.dev/dl/go1.24.12.linux-amd64.tar.gz
sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.24.12.linux-amd64.tar.gz
echo 'export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin' >> ~/.bashrc
source ~/.bashrc

• Confidence: 88% confidence
• Finding: Although not an obvious malicious payload, the combined `rm -rf /usr/local/go && sudo tar -C /usr/local ...` sequence performs destructive replacement of a system directory using a compressed archive. In an agent-run context, this is dangerous because parameterized destructive commands against system paths can remove existing software and leave the environment broken if interrupted or misapplied.

Chaining Abuse

High

• Category: Tool Misuse

Content

# Install Go (apt version may be outdated, use official installer)
wget https://go.dev/dl/go1.24.12.linux-amd64.tar.gz
sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.24.12.linux-amd64.tar.gz
echo 'export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin' >> ~/.bashrc
source ~/.bashrc

• Confidence: 90% confidence
• Finding: The command chains deletion and extraction with `&&`, making a privileged destructive change execute as a single compound action. Chaining reduces opportunities for review or recovery between steps, which is especially unsafe if an agent is following the instructions automatically.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:520