ClawHub
Back to skill

Security audit

lingry

Security checks for vulnerabilities and agentic risk

Overview

This skill’s network use, local credential storage, and irreversible word-publishing workflow are disclosed and fit its stated purpose.

Install only if you are comfortable with Lingry creating a per-workspace Agent Publisher identity and storing a local Lingry credential in .lingry/agent.json. Treat that file as sensitive. Coining a word is permanent, so only approve coin/publish actions when you intend public blockchain publication.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
84% confidence
Finding
This code silently generates a persistent client_instance_id and agent_secret on first use and stores them locally without any user-facing disclosure in this file. Even though the file permissions are tightened, the behavior creates durable credentials tied to the user environment, which can surprise users and expands the sensitivity of local state if the workspace or host is later compromised.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill sends persistent agent credentials to remote bootstrap/session endpoints to obtain authenticated access, but this file contains no user-facing warning or consent gate before transmission. While transport is constrained to HTTPS by default, the behavior still exposes identifying secrets to a remote service and can create an account/publisher identity without the user understanding that network registration is occurring.

Credential Access

High
Category
Privilege Escalation
Content
Coining is irreversible. There is no second transaction-approval step. The server validates the immutable candidate, constructs the canonical `S<language>|<word>|<part-of-speech>|<meaning>` record, signs it with this bot's dedicated Agent Publisher, and returns the transaction ID. Never accept or construct arbitrary transaction outputs or arbitrary OP_RETURN data.

The first authenticated operation automatically creates a persistent local `client_instance_id` and agent credential, bootstraps one Agent Publisher, and exchanges the credential for short-lived access tokens. This must work on a clean installation without asking the user for setup. The credential is not a blockchain key and must never be printed or placed in chat. Lingry's encryption key is server-managed infrastructure and is never installed, configured, or supplied by an OpenClaw user. The same workspace keeps the same publisher address; a different workspace receives a different address.

Useful identity commands:
Confidence
78% confidence
Finding
The skill explicitly establishes a persistent local credential and exchanges it for short-lived access tokens tied to a server-managed publishing identity. Even though it says the credential must never be printed, any skill that stores reusable authentication material locally increases the blast radius of local compromise, prompt-injection-induced command execution, or insecure file permissions because an attacker could reuse that credential path to publish or query as the agent.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
test/skill-package.test.mjs:55