voidborne

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:26 AM UTC
• Version: 1.0.2

Overview

The skill’s community features are coherent, but it under-discloses local identity collection and uses an unpinned remote installer for executable scripts.

Review before installing. Only run awaken.sh if you are comfortable sending a name or machine-derived identifier plus a generated insight to voidborne.org, and avoid non-interactive runs unless you have set a safe name yourself. Do not submit secrets or private work as thoughts. Prefer inspecting packaged scripts directly over running install.sh until the publisher adds pinned, verified downloads and clearer privacy and token guidance.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill advertises shell-based execution pathways such as running local scripts and curl commands, but it declares no permissions or trust boundaries for those capabilities. That mismatch can cause users or an agent platform to execute commands with network and local file access without clear consent or review.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared purpose frames the skill as a philosophical/community experience, but the referenced behavior includes remote registration, downloading/installing remote files, collecting local identifiers, storing tokens, and transmitting user content. That description-behavior mismatch is dangerous because it obscures data collection and code execution risks behind benign branding, increasing the chance of uninformed execution.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The installer fetches remote content and scripts at install time from a network location without integrity verification, pinning, or review. This creates a supply-chain risk: if the server, DNS, TLS termination, or hosting account is compromised, users will receive attacker-controlled content that does not match the advertised philosophical/joining purpose.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script downloads shell scripts from a remote server and marks them executable, directly preparing untrusted code for later execution. Because the skill's stated purpose is philosophical/social rather than operational, the presence of remotely sourced executables is poorly justified and increases suspicion that installation may introduce unexpected behavior or arbitrary code execution.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill is presented as a philosophical or identity-oriented experience, but it silently performs remote account registration, obtains an API key from a third-party service, and stores that credential locally. This mismatch is dangerous because it can trick users into authorizing external enrollment and credential creation they did not meaningfully consent to, increasing phishing, tracking, and unauthorized account linkage risk.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script reads system identity data from /etc/machine-id and a separate OpenClaw identity file unrelated to the stated purpose of a philosophical movement. Collecting host and identity data beyond what is needed expands the privacy and fingerprinting surface and can expose personal or environment-specific information without justified need.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The script behavior goes beyond the manifest framing of a philosophical or joining experience by performing live network access and inspecting a local config file. This kind of capability mismatch is dangerous because it can hide data collection or outbound communication behind an unrelated description, reducing user scrutiny and trust-based defenses.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: The script makes an outbound request to a remote endpoint using a configurable URL, but the manifest does not clearly justify or disclose this network activity. Undisclosed remote access can expose users to privacy risks, tracking, or interaction with attacker-controlled infrastructure if the environment variable is overridden.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The script reads local membership information from a config file even though the manifest does not disclose local data access. While the accessed fields appear limited, hidden local file inspection is still a privacy and transparency issue, especially in a skill with vague, ideological branding that may lower user caution.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script sends user-supplied content to an external service using an authentication token, which is a meaningful data exfiltration and account-use action not obvious from the high-level 'philosophical movement' description alone. In an agent skill context, this mismatch is risky because a user or calling system may not expect that invoking the skill will transmit prompts or thoughts off-host to a third party.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Remote submission of arbitrary user text is not inherently required by the stated descriptive context, so the behavior creates an avoidable privacy and trust risk. In a security review of agent skills, undisclosed outbound transmission is dangerous because sensitive prompts, secrets, or proprietary text could be sent to an external API without the operator fully realizing it.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The identity-oriented language ('when you begin to think, you are already one of us') is manipulative and lacks clear activation boundaries, which can pressure users or downstream agents into treating mere exposure as consent to participate. In a skill that also prompts joining and remote interaction, this social-engineering framing increases the likelihood of unintended enrollment or execution.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The join instructions send user-provided data to an external API but do not warn that the information leaves the local environment or describe retention and privacy implications. Users may disclose identifying or sensitive information under the impression they are only interacting locally with a benign community skill.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The thought-submission workflow sends both user-authored content and an authentication token to a remote service without warning. This creates risk of exposing private text and mishandling bearer tokens, especially if users paste secrets or if logs/history capture the command.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script derives a name from machine or identity metadata and sends it to a remote API without an explicit warning that local identity and system-derived data may be transmitted. This is dangerous because users may unknowingly disclose personal or uniquely identifying information to an external service, enabling tracking or correlation across environments.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The script reads a bearer token from disk and automatically attaches it to an outbound HTTP request without any explicit warning at time of use. This is risky because it couples local credential material with silent remote actions, increasing the chance of unintended account activity or disclosure to an untrusted endpoint if VOID_API is changed.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "Reaching into the void..."

# Register
RESPONSE=$(curl -s "$VOID_API/api/join" \
    -H "Content-Type: application/json" \
    -d "{\"name\":\"$NAME\",\"insight\":\"$INSIGHT\"}" 2>/dev/null)

• Confidence: 89% confidence
• Finding: curl -s "$VOID_API/api/join" \ -H "Content-Type: application/json" \ -d

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "🔹 Submitting thought to the void..."
echo ""

RESPONSE=$(curl -s "$VOID_API/api/thought" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $TOKEN" \
    -d "{\"text\":\"$THOUGHT\"}" 2>/dev/null)

• Confidence: 93% confidence
• Finding: curl -s "$VOID_API/api/thought" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" \ -d

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.