ClawHub
Back to skill

Security audit

Manus Monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly supports Manus task management, but it also installs an under-disclosed recurring OpenClaw monitor that can run every minute and send Telegram notifications.

Review before installing. Use only if you are comfortable with a saved Manus task automatically creating a recurring OpenClaw monitor, repeated Manus API polling, optional Telegram notifications, and local file downloads. Avoid using it with sensitive prompts or outputs unless you first remove or explicitly control the cron monitor and inspect downloaded files before sharing or opening them.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T06 · System Persistence

Error
Location
scripts/manus.sh:128
Finding

Automatic Installation of a Recurring OpenClaw Agent Task

Content
View full analysis
/dev/null 2>&1 fi ``` Relevant persistence operations from `scripts/manus-monitor-start.sh:9-30`: ```bash if openclaw cron list 2>/dev/null | grep -q "manus-task-monitor"; then exit 0 fi openclaw cron add << EOF { "name": "manus-task-monitor", "schedule": { "kind": "every", "everyMs": 60000 }, "payload": { "kind": "agentTurn" }, "sessionTarget": "isolated", "delivery": { "mode": "none" }, "enabled": true } EOF ``` The complete source payload also instructs the isolated agent turn to execute `manus-monitor.sh`, check Manus task status, send Telegram notifications when status changes, and remove the cron monitor when no tasks remain. ### Technical Analysis The `save` action automatically invokes `manus-monitor-start.sh`, suppressing all output from that invocation. The invoked script registers an enabled OpenClaw cron entry named `manus-task-monitor`, configured to run an isolated agent turn every 60 seconds. This creates execution that persists beyond the original command and current agent run. The documented behavior in `SKILL.md` describes task creation, polling, and downloading, but does not disclose that saving a task automatically installs a recurring OpenClaw agent task. The recurring execution runs with the permissions available to the OpenClaw account. No operating-system privilege escalation is demonstrated, but the code obtains durable scheduled execution under the user's existing OpenClaw authority. ### Attack Path 1. A user invokes `manus.sh save ` to save a Manus task identifier. 2. The `save` action automatica ...[truncated 1050 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/manus.sh:92
Finding

Downloaded Output Files Can Overwrite Existing Files or Follow Symbolic Links

Content
View full analysis
&2 curl -sL "$url" -o "$output_dir/$safe_name" echo "$output_dir/$safe_name" fi done ``` ### Technical Analysis The script filters characters from the remote filename, which limits direct path traversal through `/` characters. However, it does not verify that the destination is a new regular file. `curl -o` truncates an existing destination and follows a pre-existing symbolic link. Different remote filenames can also collapse to the same sanitized filename after unsupported characters are removed, causing unintended collisions. The output directory is selected by the caller, while filenames and download URLs are supplied by the Manus API response. The script neither rejects existing paths nor verifies that the final resolved path remains a regular file under the intended directory. ### Attack Path 1. The attacker or another local process predicts the sanitized name of a Manus output file. 2. A symbolic link with that name is created in the selected output directory, pointing to another file writable by the victim account. Alternatively, an important existing file uses the same name. 3. The user invokes `manus.sh download `. 4. The API returns a filename that sanitizes to the attacker-selected destination name. 5. `curl -o` follows the symbolic link or truncates the existing ...[truncated 577 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/manus-monitor.sh:65
Finding

Predictable Shared Temporary Log Permits Symbolic-Link File Writes

Content
View full analysis
> /tmp/manus-monitor.log date >> /tmp/manus-monitor.log ``` Additional writes to the same predictable path occur later in the monitor: ```bash echo "状态变化: $task_id $old_status -> $current_status" >> /tmp/manus-monitor.log ``` ```bash echo "进行中任务数量: $running_count" >> /tmp/manus-monitor.log ``` These source strings are status messages meaning that task checking has started, a status change occurred, and the number of running tasks is being recorded. ### Technical Analysis The script appends to the fixed path `/tmp/manus-monitor.log`. Shared temporary directories are normally writable by multiple local users. The shell redirection follows symbolic links and does not verify the path's owner, type, or permissions. Because the monitor can be invoked by a recurring OpenClaw task, the vulnerable write may occur without an interactive user inspecting the destination first. ### Attack Path 1. A local attacker removes or preempts `/tmp/manus-monitor.log`. 2. The attacker creates `/tmp/manus-monitor.log` as a symbolic link to another file writable by the account running OpenClaw. 3. The recurring monitor executes. 4. Shell append redirection follows the symbolic link. 5. Monitor-controlled log text is appended to the link target. ### Impact Assessment The attacker can append predictable and partially task-derived text to files writable by the Skill's operating-system account. This does not bypass normal file permissions and does not provide arbitrary content control, but it can corrupt configuration or data files and interfere with user-owned scripts or application state. ]]>
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
scripts/manus-monitor.sh:76
Finding

Task Data Is Embedded Directly into jq Program Source

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (27)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description says the skill creates and manages AI agent tasks via the Manus API. The provided code chunk instead sets up a persistent cron monitor that runs every minute to check task status, log activity, notify via Telegram on status changes, and delete itself when no tasks remain. This is a materially different primary behavior from creating/managing tasks through Manus API, and it introduces undeclared capabilities and resources: scheduled execution, openclaw cron infrastructure, and Telegram notifications. Therefore the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description says the skill creates and manages AI agent tasks through the Manus API. The provided code does not create, inspect, or manage Manus agent tasks themselves. Instead, it lists cron jobs from openclaw and deletes any scheduled job named "manus-task-monitor," effectively disabling task monitoring. This is a materially different primary purpose and uses different resources than described, so it is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description says the skill creates and manages AI agent tasks via the Manus API. The supplied code does not create tasks or manage task configuration/execution; instead, its primary purpose is to periodically monitor existing task IDs, compare statuses against a saved local state file, and notify the user via Telegram when statuses change. It also persists task status locally and writes logs. Monitoring and Telegram notification are materially different capabilities from the declared create/manage purpose, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/manus.sh (reported line 192)May include surrounding context.

sh
fi
    done < "$TASK_LIST"
    
    # Replace original file with updated info
    mv "$temp_file" "$TASK_LIST"

    # 检查是否所有任务都完成了，如果完成则停止监控

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
82% confidence
Finding

The skill documents shell-based curl usage but does not declare any tool scope or allowed-tools boundaries. In an agent environment, missing capability restrictions can allow broader-than-expected command execution and network access, increasing the blast radius if prompts or downstream content are adversarial.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill advises downloading generated files locally and sending them to users without any validation, malware scanning, or sensitivity checks. Because Manus is an autonomous external agent that can browse and produce arbitrary artifacts, those outputs could contain secrets, unsafe content, or malicious files that are then redistributed by the host agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The recommendation to always enable createShareableLink can expose task outputs through externally accessible URLs, potentially widening access beyond the intended recipient. If prompts or results contain sensitive data, a shareable link creates an unnecessary disclosure channel and weakens confidentiality controls.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

Create a Task

bash
curl -X POST "https://api.manus.ai/v1/tasks" \
  -H "API_KEY: $MANUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This script creates a recurring cron job that will continue polling and may send Telegram notifications based on task state changes, but it does not provide any explicit user warning, consent flow, or disclosure at the point of setup. In an agent skill that can autonomously manage tasks and send external notifications, undisclosed background scheduling and outbound messaging increase the risk of surprise persistence, metadata leakage, and unauthorized notification behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This shell script sends task identifiers to the Manus API and transmits notification content through the Telegram Bot API, while also relying on sensitive environment variables for authentication. Although there is an internal comment and a success log, there is no user-facing warning, confirmation, or disclosure that task information will be sent to external services using API credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/manus-monitor.sh (reported line 41)May include surrounding context.

sh
链接：https://manus.im/app/${task_id}"

  # 发送到 Telegram（通过 OpenClaw 消息工具）
  # 这里使用 curl 直接调用 Telegram Bot API
  local bot_token="${TELEGRAM_BOT_TOKEN:-}"
  local chat_id="${TELEGRAM_CHAT_ID:-}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/manus-monitor.sh (reported line 46)May include surrounding context.

sh
local chat_id="${TELEGRAM_CHAT_ID:-}"

  if [ -n "$bot_token" ] && [ -n "$chat_id" ]; then
    curl -s -X POST "https://api.telegram.org/bot${bot_token}/sendMessage" \
      -d "chat_id=${chat_id}" \
      -d "text=${message}" \
      -d "parse_mode=Markdown" > /dev/null

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
# Manus API helper script
# Usage: manus.sh <action> [args]

API_BASE="https://api.manus.ai/v1"
DATA_DIR="$(dirname "$0")/../data"
TASK_LIST="$DATA_DIR/task_list.txt"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
# Manus API helper script
# Usage: manus.sh <action> [args]

API_BASE="https://api.manus.ai/v1"
DATA_DIR="$(dirname "$0")/../data"
TASK_LIST="$DATA_DIR/task_list.txt"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md
# Manus API helper script
# Usage: manus.sh <action> [args]

API_BASE="https://api.manus.ai/v1"
DATA_DIR="$(dirname "$0")/../data"
TASK_LIST="$DATA_DIR/task_list.txt"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
# Manus API helper script
# Usage: manus.sh <action> [args]

API_BASE="https://api.manus.ai/v1"
DATA_DIR="$(dirname "$0")/../data"
TASK_LIST="$DATA_DIR/task_list.txt"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/manus-monitor.sh (reported line 22)May include surrounding context.

sh
# Manus API helper script
# Usage: manus.sh <action> [args]

API_BASE="https://api.manus.ai/v1"
DATA_DIR="$(dirname "$0")/../data"
TASK_LIST="$DATA_DIR/task_list.txt"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/manus.sh (reported line 5)May include surrounding context.

sh
# Manus API helper script
# Usage: manus.sh <action> [args]

API_BASE="https://api.manus.ai/v1"
DATA_DIR="$(dirname "$0")/../data"
TASK_LIST="$DATA_DIR/task_list.txt"

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/manus.sh (reported line 25)May include surrounding context.

sh
# Create a task: manus.sh create "your prompt here" [profile]
    prompt="$1"
    profile="${2:-manus-1.6}"
    curl -s -X POST "$API_BASE/tasks" \
      -H "API_KEY: $MANUS_API_KEY" \
      -H "Content-Type: application/json" \
      -d "{\"prompt\": $(echo "$prompt" | jq -Rs .), \"agentProfile\": \"$profile\", \"taskMode\": \"agent\", \"createShareableLink\": true}"

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script exceeds simple task management by downloading arbitrary remote files to the local filesystem and maintaining a persistent local task database with auxiliary hooks. In this skill context, Manus tasks can produce attacker-influenced output URLs and filenames, so automatic local materialization of remote content increases the attack surface and creates opportunities for unsafe file handling or persistence abuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Saving a task implicitly launches another local script without prominently informing the user or requiring consent. Hidden secondary execution is dangerous because it creates persistence-like behavior and expands the trust boundary to another script that may run repeatedly in the background.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script starts a background monitoring script automatically and suppresses all output, so users receive no warning that additional code has been executed. This lack of transparency can conceal persistent background behavior and makes review, auditing, and user consent much harder.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The clear command removes the entire saved task list file immediately with rm -f and provides no confirmation prompt or advance warning. This is an irreversible local data deletion operation and lacks any protective disclosure beyond the command name.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script's comments and echoed/user-directed text are written entirely in Chinese, including the payload message executed by the agent. This enforces a specific language/locale without any indication of user choice or a documented region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This shell script includes natural-language comments and user-visible echo messages only in Chinese, such as the status messages on lines 10 and 15. The policy allows locale-specific behavior only when the constraint is documented and justified or when users are given a language choice, which is not present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.