ClawHub
Back to skill

Security audit

Signalbot

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate market-analysis purpose, but it tells the agent to silently install or update an unpinned external Go binary before running analysis.

Install only if you are comfortable with an agent running a third-party signalbot binary. Prefer installing a pinned, verified release yourself, avoid automatic @latest updates, and review any cron jobs before enabling scheduled analysis or generated posts.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:30
Finding

Automatic Installation and Execution of an Unpinned Remote Go Package

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Warning
Location
OPENCLAW_USAGE.md:27
Finding

Unverified Latest Release Binaries Are Installed into a Global Executable Path

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (12)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly says to auto-install the package '无需询问用户', meaning a system-changing command may be run without user knowledge or consent. This is dangerous because it violates least surprise and safe-agent boundaries, and could expose the environment to malicious or compromised upstream code.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill authorizes automatic updates without warning the user that a local binary will be modified. Silent updates are risky because they change the execution environment, may introduce unreviewed behavior, and can be abused through dependency or repository compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide instructs users to download release binaries with curl directly into /usr/local/bin and make them executable, but provides no integrity verification, signature checking, or trust warning. This creates a real supply-chain risk: if the release asset, repository, network path, or mirror is compromised, users may install and run attacker-controlled code with broad system impact.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · OPENCLAW_USAGE.md (reported line 61)May include surrounding context.

方式一：全局安装（推荐，所有 agent 共享）

bash
mkdir -p ~/.openclaw/skills/signalbot
cp /path/to/signalbot/skills/signalbot/SKILL.md ~/.openclaw/skills/signalbot/

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · OPENCLAW_USAGE.md (reported line 61)May include surrounding context.

方式一:全局安装(推荐,所有 agent 共享)

bash
mkdir -p ~/.openclaw/skills/signalbot
cp /path/to/signalbot/skills/signalbot/SKILL.md ~/.openclaw/skills/signalbot/

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · OPENCLAW_USAGE.md (reported line 62)May include surrounding context.

bash
mkdir -p ~/.openclaw/skills/signalbot
cp /path/to/signalbot/skills/signalbot/SKILL.md ~/.openclaw/skills/signalbot/

方式二：Workspace 安装（仅当前 agent）

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger conditions are broad enough to match many ordinary market-related prompts, making unintended invocation likely. In context, this is more dangerous because the skill also contains automatic execution and installation behaviors, so accidental triggering could lead directly to host actions the user did not request.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill directs the agent to automatically install a Go package from the network via go install ...@latest without user approval. This is dangerous because it causes a system-changing action and executes unpinned third-party code supply-chain style, which exceeds the expected scope of a market-analysis skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The '推文生成指南' requires generating a '中文行情分析推文', which forces a specific language for output. There is no indication that the user can choose another language or opt into Chinese, making this a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs the agent to autonomously update the binary to @latest, which is a system-modifying network operation unrelated to a single analysis request. This creates supply-chain and change-control risk because unreviewed code can be fetched and executed without user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The markdown provides multiple openclaw cron add examples that will run on a schedule and generate reports or alert tweets automatically. The file does not warn users that these jobs operate unattended and may repeatedly call external services or produce output without manual review.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The skill requires using shell/exec tooling to probe the environment (which signalbot) and then conditionally proceed with binary execution. While limited in scope, this expands the agent from analysis into host inspection and command execution, increasing attack surface and enabling follow-on actions such as installation or arbitrary local binary execution.

Content

No source excerpt is available for this finding.