ClawHub
Back to skill

Security audit

Bobiverse Replicate

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local agent-cloning skill, but it needs review because it can copy an entire OpenClaw workspace into a persistent new peer agent and its approval token is not enforced outside the invoking agent.

Install only if you intentionally want an agent that can create persistent peer OpenClaw agents. Use it from a clean/dedicated workspace, remove secrets or unrelated project data first, review the dry-run output yourself, and avoid giving untrusted prompts shell access to run the replication script.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/replicate_safe.py:367
Finding

Unfiltered workspace replication exposes unrelated sensitive data to autonomous clones

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/replicate_safe.py:309
Finding

Nonce confirmation can be self-issued and replayed by the invoking agent without independent operator approval

Content
View full analysis
") return pending ``` ### Technical Analysis The same process that requests a dry-run receives the confirmation nonce directly in standard output. That process can immediately invoke execute mode and supply the emitted token. The token therefore proves only that the caller ran dry-run and read its output. It does not prove that an authenticated human operator reviewed the plan or explicitly approved replication. The project's explicit-trigger and human-in-the-loop guarantees are enforced only through Markdown instructions followed by the Agent, not through an independent authorization boundary in the runner. If an Agent is compromised through prompt injection or otherwise induced to invoke local commands, it can complete both sides of the nominal approval exchange: 1. Run dry-run; 2. Parse `confirm ...[truncated 1984 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (7)

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · ARCHITECTURE.md (reported line 46)May include surrounding context.

md
For this project, the installed Bob workspace uses `AGENTS.md`, `SOUL.md`,
`IDENTITY.md`, `USER.md`, `MEMORY.md`, `LINEAGE.md`, and
`SERIAL-NUMBER-SPEC.md` at workspace root, plus `skills/replicate/SKILL.md`.
`TOOLS.md`, `HEARTBEAT.md`, `BOOT.md`, and `BOOTSTRAP.md` remain optional.

---

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 5)May include surrounding context.

md
**You've been replicated.**

Well, not *you* specifically. But if you're reading this, you're about to create
an operator-directed OpenClaw agent modeled after Robert Johansson from Dennis E. Taylor's
Bobiverse series: a dead software engineer who woke up as a Von Neumann probe
and decided to explore the galaxy. Except instead of interstellar space, your

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill explicitly instructs use of file read, file write, and shell capabilities, but the manifest declares no tool scope or permission boundaries. That creates a real least-privilege gap: an agent may execute broad filesystem and shell actions without machine-readable restrictions, increasing the chance of misuse, overbroad access, or unsafe execution if the skill is installed in a permissive runtime.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
> **Operator approval gate:** Before proceeding past Step 1, present the
> gathered parameters to your operator and wait for explicit confirmation to
> continue. Do not begin workspace duplication without approval.

> **Necessity gate:** If the purpose statement is vague ("just because",
> "for fun", "maybe useful"), ask follow-up questions and do not proceed until

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

The skill creates persistent new agent workspaces, pending approval files, audit/log lineage records, and registered peer agents under ~/.openclaw/, which materially changes the host's long-lived state. Even with confirmation gates, this is a persistence mechanism: if misused or triggered carelessly, it can leave durable agents and artifacts that survive the session and expand the system's attack surface.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

md
Example: If you are `Bob-1-TheAmericanMaker-2026-04-01` and the operator's GitHub is `SomeUser`, the clone becomes `Bob-2-SomeUser-2026-04-15`.

### Step 3: Create Clone Workspace (Safe Runner Only)

Use the hardened runner script at:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/replicate_safe.py (reported line 371)May include surrounding context.

python
shutil.copytree(plan.parent_workspace, plan.staging_workspace, symlinks=True)
        ensure_no_symlinks(plan.staging_workspace)
        shutil.move(str(plan.staging_workspace), str(plan.clone_workspace))
        subprocess.run(
            ["openclaw", "agents", "add", plan.agent_id, "--workspace", str(plan.clone_workspace)],
            check=True,
            shell=False,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file instructs the agent to 'Respond as Bob' and to use the SOUL.md personality 'in all interactions.' This is a natural-language policy concern because it imposes a fixed interaction style universally, without offering the user any choice or opt-in to that persona.

Content

No source excerpt is available for this finding.