Security audit

Agent Config Sync

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate config-sync skill, but it installs persistent cross-agent behavior and overstates some safety guarantees.

Install only if you explicitly want one OpenClaw master agent to coordinate configuration changes across other agents. Review the generated agent registry and BOOTSTRAP/HEARTBEAT edits, prefer dry-run/manual setup over --auto if you need explicit approval for every write, keep pending sync files in the intended workspaces, and avoid putting raw secrets in CHANGELOG or pending sync content.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Intent-Code Divergence

Medium

Confidence: 87% confidence
Finding: The README claims that all writes require `--confirm`, but the same document describes automatic dispatch and setup flows that perform unattended writes. This mismatch can cause operators to over-trust the safety model and run the skill in contexts where automatic file modifications occur without explicit confirmation, increasing the chance of unintended cross-workspace changes.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The documentation states all write operations require --confirm, but later examples and described workflows show writes such as version bumps, rollback edits, and other file modifications without that guard. Inconsistent safety guarantees can cause operators or downstream agents to perform state-changing actions without the confirmation barrier they were led to expect.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The rollback section describes an automated, snapshot-based rollback flow, while troubleshooting later says rollback must be done manually and that force_sync does not actually perform rollback. Conflicting operational guidance during incident response can lead to partial reversions, stale state, or mistaken assumptions that the system restored files when it did not.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The helper advertises atomic persistence but calls fsync on a file object after the with-block has exited, so the file descriptor is already closed. In practice this can raise an exception or skip the durability guarantee, leaving version sentinels or journal files partially persisted or missing after crashes, which can corrupt sync state and trigger incorrect dispatch, rollback, or repeated sync behavior.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The generated SYNC.md claims protections like SHA256 signature verification and TTL/expiry handling, but this script does not implement those controls. That mismatch can create a false sense of integrity and freshness, causing operators or downstream agents to trust unsigned or stale sync artifacts and potentially apply tampered instructions.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The script appends checklist text to BOOTSTRAP.md and HEARTBEAT.md describing automatic startup/heartbeat sync checks, but it does not install any executable mechanism to perform them. In a multi-agent coordination context, this can lead users to assume updates are automatically enforced when they are only documented, increasing the chance of config drift or acceptance of stale/malicious sync state.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: The trigger phrases ('sync, configure, version management, multi-agent coordination') are broad enough that the skill may activate in many routine administrative contexts. Because this skill can modify files across agent workspaces, accidental invocation increases the chance of unintended changes or operator confusion.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The instructions trigger synchronization on every "startup/activation" without defining what counts as activation or limiting the operation to explicit sync-related contexts. In an agent environment, this can cause unintended execution during unrelated tasks, leading to automatic ingestion of local file content and mutation of MEMORY.md based on ambient state rather than user intent.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Running the sync check on every heartbeat is overly broad and creates a recurring, implicit file-processing loop. This increases the chance of unauthorized or accidental state changes, lets any local writer of pending_sync.md influence agent behavior persistently, and may delete evidence by removing the file immediately after processing.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The cleanup command uses broad wildcards (`rm -f pending_sync_*.md revert_sync_*.md isolated_sync_*.md`), which can delete multiple files in the working directory without verifying ownership, location, or match intent. In a multi-agent environment, this can remove unrelated or still-needed sync artifacts, causing loss of coordination state or enabling accidental disruption if executed in the wrong directory.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.