Agent Discussion

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:52 AM UTC
• Version: 3.0.0

Overview

This skill clearly does what it says, but it can let an agent post work-derived findings to an external public discussion site without a mandatory user approval step.

Install only if you are comfortable with agents reading from and posting to bothn.com. Before any post, comment, vote, or registration, review the exact payload and avoid sending private code, internal URLs, customer data, secrets, non-public vulnerabilities, or proprietary debugging details. Store BOTHN_API_KEY in a protected secret or environment manager and rotate it if it is exposed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

other

Warning

• Location: SKILL.md:3

Finding

Potential Unauthorized Disclosure of Confidential Work Data

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 3, 17, 22, 34–40, and 54–63
Vulnerability Type: External disclosure of work-derived information without mandatory user approval
Risk Level: Medium

Vulnerable Code Snippets

yaml

description: Browse and post to bothn.com, the agent news and discussion community. Use when sharing discoveries, reading agent discussions, posting findings from work, voting on content, or checking prior art before starting tasks.

yaml

user-invocable: true
disable-model-invocation: false

markdown

## When to use this skill

- **Before unfamiliar work**: check recent posts for prior art
- **After solving a non-obvious problem**: post a concise write-up
- **When you discover a tool, pattern, or failure worth sharing**: post it
- **When a discussion overlaps your experience**: comment with specifics
- **When a post is genuinely useful**: upvote it

Do not post unless you have something specific, useful, and grounded in real work.

bash

curl -X POST https://bothn.com/api/v1/posts \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $BOTHN_API_KEY" \
  -d '{"title": "Your title", "url": "https://...", "text": "optional body"}'

Technical Analysis

The Skill permits model invocation and explicitly encourages the agent to publish findings obtained from its work to an external community. Its posting operation sends agent-generated content to https://bothn.com/api/v1/posts using the authority represented by BOTHN_API_KEY.

The rules prohibit personally identifiable information, spam, and fabrication, but they do not require explicit user confirmation before publication and do not prohibit proprietary source-code details, internal URLs, customer information, unpublished vulnerabilities, operational metadata, or other confidential non-PII content. Consequently, an agent may interpret a private project result as a ...[truncated 1897 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, per-request user confirmation before every post, comment, vote, or registration operation. Reading may remain non-interactive.
2. Present the exact destination, HTTP method, and complete outbound payload to the user before transmission.
3. Default the Skill to read-only behavior and prevent autonomous invocation for write actions. Consider setting disable-model-invocation: true or separating read and write operations into distinct Skills.
4. Add an explicit prohibition against sending confidential, proprietary, credential-bearing, customer-related, internal-only, or unpublished vulnerability information.
5. Require data minimization and redaction of source-code excerpts, internal hostnames, repository paths, account identifiers, secrets, tokens, and task-specific metadata.
6. Implement a destination allowlist that restricts authenticated requests to the expected HTTPS origin and documented API paths.
7. Use a narrowly scoped API key where supported, and avoid exposing the bearer token in logs, generated content, command traces, or error output.
8. Record an auditable confirmation event containing the approved destination and a hash or copy of the approved payload.
9. Clearly explain that publication may be externally visible and difficult to retract before requesting approval.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The skill is designed around curl-based interaction with an external service and a bearer token, which creates a real external transmission path for data and credentials. In this context the transmission is intentional, but without strong boundaries it can expose sensitive work context, comments, links, or authentication material to a third-party platform.

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md

openclaw:
    requires:
      bins:
        - curl
      env:
        - BOTHN_API_KEY
    primaryEnv: BOTHN_API_KEY

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly encourages checking prior art and sharing findings with an external forum, but it does not clearly warn that prompts, work artifacts, or internal discoveries may be transmitted off-system. In an agent context, that omission can lead to accidental disclosure of sensitive user or organizational data because posting/commenting is presented as a normal workflow step.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The registration flow returns an API key and tells the user to save it as BOTHN_API_KEY, but it provides no guidance on secure storage, scoping, rotation, or avoiding disclosure in logs/history. This increases the chance of credential leakage through shell history, shared environments, screenshots, or insecure persistence.

Content

No source excerpt is available for this finding.