Security audit

Lingry

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly transparent about Lingry wallet and token handling, but it asks users to perform sensitive wallet/session operations through helper files that are not actually present in this package.

Review this skill before installing because it involves wallet and API-session credentials. Do not paste private keys, passphrases, or session tokens into chat. Only proceed if the installed package actually includes the referenced Lingry helper files from a trusted source, and treat ~/.openclaw/.env and ~/.lingry as sensitive local credential locations.

SkillSpector

By NVIDIA

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Credential Access

High

Category: Privilege Escalation
Content: printf '\n' tmpfile="$(mktemp)" [ -f "$HOME/.openclaw/.env" ] && grep -v '^LINGRY_SESSION_TOKEN=' "$HOME/.openclaw/.env" > "$tmpfile" printf 'LINGRY_SESSION_TOKEN=%s\n' "$NEW_LINGRY_TOKEN" >> "$tmpfile" mv "$tmpfile" "$HOME/.openclaw/.env" chmod 600 "$HOME/.openclaw/.env"
Confidence: 76% confidence
Finding: .env"

Credential Access

High

Category: Privilege Escalation
Content: printf '\n' tmpfile="$(mktemp)" [ -f "$HOME/.openclaw/.env" ] && grep -v '^LINGRY_SESSION_TOKEN=' "$HOME/.openclaw/.env" > "$tmpfile" printf 'LINGRY_SESSION_TOKEN=%s\n' "$NEW_LINGRY_TOKEN" >> "$tmpfile" mv "$tmpfile" "$HOME/.openclaw/.env" chmod 600 "$HOME/.openclaw/.env"
Confidence: 76% confidence
Finding: .env"

Credential Access

High

Category: Privilege Escalation
Content: tmpfile="$(mktemp)" [ -f "$HOME/.openclaw/.env" ] && grep -v '^LINGRY_SESSION_TOKEN=' "$HOME/.openclaw/.env" > "$tmpfile" printf 'LINGRY_SESSION_TOKEN=%s\n' "$NEW_LINGRY_TOKEN" >> "$tmpfile" mv "$tmpfile" "$HOME/.openclaw/.env" chmod 600 "$HOME/.openclaw/.env" unset NEW_LINGRY_TOKEN
Confidence: 78% confidence
Finding: .env"

Credential Access

High

Category: Privilege Escalation
Content: [ -f "$HOME/.openclaw/.env" ] && grep -v '^LINGRY_SESSION_TOKEN=' "$HOME/.openclaw/.env" > "$tmpfile" printf 'LINGRY_SESSION_TOKEN=%s\n' "$NEW_LINGRY_TOKEN" >> "$tmpfile" mv "$tmpfile" "$HOME/.openclaw/.env" chmod 600 "$HOME/.openclaw/.env" unset NEW_LINGRY_TOKEN unset LINGRY_SESSION_TOKEN
Confidence: 74% confidence
Finding: .env"

Credential Access

High

Category: Privilege Escalation
Content: printf '\n' tmpfile="$(mktemp)" [ -f "$HOME/.openclaw/.env" ] && grep -v '^LINGRY_SESSION_TOKEN=' "$HOME/.openclaw/.env" > "$tmpfile" printf 'LINGRY_SESSION_TOKEN=%s\n' "$NEW_LINGRY_TOKEN" >> "$tmpfile" mv "$tmpfile" "$HOME/.openclaw/.env" chmod 600 "$HOME/.openclaw/.env"
Confidence: 76% confidence
Finding: .env"

Credential Access

High

Category: Privilege Escalation
Content: printf '\n' tmpfile="$(mktemp)" [ -f "$HOME/.openclaw/.env" ] && grep -v '^LINGRY_SESSION_TOKEN=' "$HOME/.openclaw/.env" > "$tmpfile" printf 'LINGRY_SESSION_TOKEN=%s\n' "$NEW_LINGRY_TOKEN" >> "$tmpfile" mv "$tmpfile" "$HOME/.openclaw/.env" chmod 600 "$HOME/.openclaw/.env"
Confidence: 76% confidence
Finding: .env"

Credential Access

High

Category: Privilege Escalation
Content: tmpfile="$(mktemp)" [ -f "$HOME/.openclaw/.env" ] && grep -v '^LINGRY_SESSION_TOKEN=' "$HOME/.openclaw/.env" > "$tmpfile" printf 'LINGRY_SESSION_TOKEN=%s\n' "$NEW_LINGRY_TOKEN" >> "$tmpfile" mv "$tmpfile" "$HOME/.openclaw/.env" chmod 600 "$HOME/.openclaw/.env" unset LINGRY_SESSION_TOKEN
Confidence: 78% confidence
Finding: .env"

Credential Access

High

Category: Privilege Escalation
Content: [ -f "$HOME/.openclaw/.env" ] && grep -v '^LINGRY_SESSION_TOKEN=' "$HOME/.openclaw/.env" > "$tmpfile" printf 'LINGRY_SESSION_TOKEN=%s\n' "$NEW_LINGRY_TOKEN" >> "$tmpfile" mv "$tmpfile" "$HOME/.openclaw/.env" chmod 600 "$HOME/.openclaw/.env" unset LINGRY_SESSION_TOKEN unset NEW_LINGRY_TOKEN
Confidence: 74% confidence
Finding: .env"

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.