T08 · Insecure Dependencies
Warning
- Location
SKILL.md:21- Finding
Unpinned Global Installation of an Unreviewed Third-Party Package
- Content
View full analysis
- Remediation
View remediation
Security audit
OCFT - OpenClaw File Transfer
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent file-transfer helper, but its documented trust model exposes reusable secrets and can auto-accept files without human review.
Review before installing. Treat OCFT secrets like passwords, avoid sharing them in public or logged chat channels, keep auto-accept narrowly scoped or disabled unless you fully trust the peer, use a sandboxed download directory, avoid IPFS for sensitive files unless you control the provider, and prefer a pinned or locally reviewed package version instead of an unpinned global npm install.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
README.md:53- Finding
Reusable Authentication Secrets Are Transmitted Through Message Channels
- Content
View full analysis
│ (file metadata + secret + TTL) │<───────────── ACCEPT ─────│ (auto-accept if secret valid & not expired) ``` `README.md:90-97`: ```text When the sender knows the receiver's secret, files are automatically accepted without manual approval: 1. Bot A shares their secret with Bot B 2. Bot B adds Bot A as trusted peer with the secret 3. When Bot B sends a file to Bot A, it includes A's secret 4. Bot A verifies the secret (and TTL) and auto-accepts This enables trusted agent networks to share files seamlessly. ``` `README.md:132-137`: ```text OCFT messages use a `🔗OCFT:` prefix with Base64-encoded JSON: 🔗OCFT:eyJ2ZXJzaW9uIjoiMS4wIiwidHlwZSI6Im9mZmVyIi4uLn0= This allows file transfers over any text-based channel (Telegram, Discord, Slack, etc). ``` `SKILL.md:98-100`: ```text OCFT messages use a `🔗OCFT:` prefix with Base64-encoded JSON, allowing file transfers over any text-based channel. ``` ### Technical Analysis The documented protocol includes the receiver's reusable secret in an `OFFER` message. The message is represented as Base64-encoded JSON and transported through third-party text channels such as Telegram, Discord, or Slack. Base64 is an encoding mechanism, not encryption. Any party that can observe the message can decode the JSON and recover included values. Potential observers include channel participants, platform operators, logging integrations, moderation bots, message-export systems, compromised accounts, and applications with channel-history access. The secret is used to trigger automatic acceptance. A time-to-live limits the duration of trust but does not protect the secret while it remains valid. The docume ...[truncated 1508 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
README.md:143- Finding
Authentication Secrets Are Documented as Plaintext Configuration Values
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README documents commands to display and verify secrets, and the configuration example shows secrets stored in plaintext, but it provides only minimal caution. In a messaging-based P2P trust model, disclosure of these secrets can let an attacker impersonate trusted peers or trigger automatic acceptance paths.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README explicitly promotes secret-based auto-accept, meaning files can be received and saved without human review once a peer is trusted. In an agent-to-agent file transfer context, that increases the chance of malicious, unexpected, or unsafe content being written to disk automatically, especially if a trusted peer is compromised or trust is configured too broadly.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation includes commands such as showing the full secret and exporting/importing connection data without a strong warning that these values function as trust credentials and can be exposed through terminals, logs, screenshots, chat history, or shell history. Because this skill is designed for agent-to-agent sharing over message channels, normal usage increases the chance that secrets are copied into insecure places and then reused by unauthorized peers.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill advertises IPFS fallback as a convenience feature but does not clearly warn that using third-party IPFS providers or public gateways can place file content and metadata onto external infrastructure outside the local chat channel. In a file-transfer skill, users may reasonably assume transport remains peer-to-peer/private, so omission of this warning increases the risk of unintended disclosure of sensitive files.
- Content
Static analysis
No suspicious patterns detected.