Security audit

Anytype

Security checks for vulnerabilities and agentic risk

Overview

This Anytype skill is mostly purpose-aligned, but it ships private instance setup details and encourages high-impact data changes that require careful review before installation.

Install only after removing SETUP.md or replacing it with placeholders, rotating or revoking the exposed Anytype invite/hash if they are real, and deciding whether the bot account's Anytype permissions are narrowly scoped. Store the API key in a safer secret store or a locked-down file outside shared workspace content, and require explicit user confirmation plus a recoverable backup before any delete or delete-and-recreate update.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SETUP.md:3
Finding: Instance-Specific Sharing Material Included in the Distributed Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:45
Finding: API Bearer Credential Stored in a Shared Plaintext Environment File
Content: View full analysis
" >> ~/.openclaw/workspace/.env ``` The corresponding credential-loading behavior appears in `scripts/anytype_api.py`, lines 13-24: ```python def load_api_key(): """Read only ANYTYPE_API_KEY from the workspace .env — nothing else.""" if "ANYTYPE_API_KEY" in os.environ: return os.environ["ANYTYPE_API_KEY"] env_path = os.path.expanduser("~/.openclaw/workspace/.env") if os.path.exists(env_path): with open(env_path) as f: for line in f: line = line.strip() if line.startswith("ANYTYPE_API_KEY="): return line.split("=", 1)[1].strip() return "" ``` ### Technical Analysis The setup instructions append a bearer credential to a shared workspace `.env` file using the process’s ambient `umask`. The command does not create the file with restrictive permissions, verify existing ownership or permissions, or protect against symbolic-link redirection. Appending also permits multiple `ANYTYPE_API_KEY` entries to accumulate. Because the loader returns the first matching entry, key rotation may not work as intended if an obsolete value precedes the new value. Entering a real key directly into the displayed shell command can additionally expose it through shell history, terminal logs, session recording, or process instrumentation. A workspace-level `.env` may also be visible to unrelated tools or agents operating in the same workspace. Reading `ANYTYPE_API_KEY` is necessary for the declared authenticated API functionality, and the implementation only selects that variable. The risk therefore arises from the storage method and shared location, not from the need to access a credential. ### Attack Path 1. A user follows the documented setup c ...[truncated 1279 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:103
Finding: Delete-Before-Recreate Update Workflow Can Cause Irrecoverable Data and Reference Loss
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The skill instructs storing an API key in a plaintext .env file under a workspace path, which creates a durable credential exposure point. If the workspace is readable by other tools, users, logs, backups, or accidental commits, the key can be stolen and used to access or modify Anytype data.
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
anytype auth apikey create my-key

5. Store the key

echo "ANYTYPE_API_KEY=" >> ~/.openclaw/workspace/.env

text
## API Usage

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The code reads a bearer token directly from a workspace .env file, expanding the set of components and prompts that can access the credential. In agent environments, broad file-read capability can make plaintext token retrieval a practical credential theft path.
Content: Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.
md
def load_api_key(): if "ANYTYPE_API_KEY" in os.environ: return os.environ["ANYTYPE_API_KEY"] env_path = os.path.expanduser("~/.openclaw/workspace/.env") if os.path.exists(env_path): for line in open(env_path): if line.strip().startswith("ANYTYPE_API_KEY="):

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/anytype_api.py (reported line 14)May include surrounding context.
python
BASE = "http://127.0.0.1:31012" def load_api_key(): """Read only ANYTYPE_API_KEY from the workspace .env — nothing else.""" if "ANYTYPE_API_KEY" in os.environ: return os.environ["ANYTYPE_API_KEY"] env_path = os.path.expanduser("~/.openclaw/workspace/.env")

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/anytype_api.py (reported line 17)May include surrounding context.
python
"""Read only ANYTYPE_API_KEY from the workspace .env — nothing else.""" if "ANYTYPE_API_KEY" in os.environ: return os.environ["ANYTYPE_API_KEY"] env_path = os.path.expanduser("~/.openclaw/workspace/.env") if os.path.exists(env_path): with open(env_path) as f: for line in f:

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/anytype_api.py (reported line 30)May include surrounding context.
python
"""Read only ANYTYPE_API_KEY from the workspace .env — nothing else.""" if "ANYTYPE_API_KEY" in os.environ: return os.environ["ANYTYPE_API_KEY"] env_path = os.path.expanduser("~/.openclaw/workspace/.env") if os.path.exists(env_path): with open(env_path) as f: for line in f:

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill performs sensitive operations involving environment variables and HTTP requests, but it does not declare any explicit tool scope or permission boundaries. That increases the risk that an agent may invoke network and credential-handling behaviors without clear user visibility or policy enforcement.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
Setup (one-time)

bash
# 1. Create a dedicated bot account (generates a key, NOT mnemonic-based) anytype auth create my-bot # 2. Install and start as a user service

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
md
requests.delete(f"{BASE}/v1/spaces/{space_id}/objects/{old_id}", headers=headers) # Step 2: create new object with full updated content resp = requests.post(f"{BASE}/v1/spaces/{space_id}/objects", json={"name": name, "type_key": "page", "body": new_content}, headers=headers) new_id = resp.json()["object"]["id"]

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The file documents bearer authentication and an endpoint that returns an API key, but does not include any caution about treating the key as sensitive credential material. For markdown files, omitting privacy or security warnings around credential-handling behavior is a reportable missing warning.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file lists create, update, and delete operations for spaces, including DELETE /v1/spaces/{space_id}, but does not warn that these actions can modify or permanently remove user data. Under the markdown-specific warning criterion, descriptions of behaviours affecting user data or system integrity should disclose those risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The Objects section includes create, update, and delete endpoints for user content, but provides no warning that these operations can alter or remove stored objects. Because this is a markdown description of data-affecting behavior, the omission leaves safety-relevant consequences undisclosed.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The instructions say to default to page for all content and frame note as a narrow exception, which imposes a fixed content-organization policy rather than offering a user choice. This is a natural-language constraint on user workflow/preferences and is not justified as a region- or compliance-specific requirement.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Credential Access

5. Store the key

Credential Access

Credential Access

Credential Access

Credential Access

Undeclared Tool Scope

Session Persistence

Setup (one-time)

External Transmission

Missing User Warnings

Missing User Warnings

Missing User Warnings

Natural-Language Policy Violations

Static analysis