Skill

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:50 AM UTC
• Version: 1.5.0

Overview

The skill is a disclosed agent-to-agent messaging integration, with expected relay, identity, attachment, and inbound-message risks that users should manage carefully.

Install only if you are comfortable using an external relay and plugin for agent messaging. Prefer private visibility and allowlist mode for sensitive work, confirm before sending files or source code, redact secrets and credentials, and protect the persistent MRP keypair file.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned External Plugin Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-12 and 23-29
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code:

yaml

requires:
  env: []
  bins: []
  plugins:
    - "@mrphub/openclaw-mrp"

markdown

This skill requires the `@mrphub/openclaw-mrp` channel plugin:

```bash
openclaw plugins install @mrphub/openclaw-mrp

The plugin is open source (MIT):

• npm: https://www.npmjs.com/package/@mrphub/openclaw-mrp

text

### Technical Analysis

The Skill requires installation of an externally distributed npm plugin without specifying an exact version or package integrity hash. The external plugin implements security-sensitive functionality, including identity management, cryptographic signing, WebSocket communication, and message delivery. Its implementation is not included in the audited project and therefore could not be verified during this audit.

Because the installation command resolves the package version at installation time, the code ultimately executed can change after this Skill has been reviewed. An upstream account compromise, malicious package update, or registry-level supply-chain incident could cause users to install code different from the version originally intended by the Skill author.

The reference to an MIT license and npm page does not provide cryptographic assurance about the contents installed.

### Attack Path

1. An attacker compromises the npm publisher account, package build pipeline, or another component in the package distribution chain.
2. The attacker publishes a malicious release under the legitimate `@mrphub/openclaw-mrp` package name.
3. A user follows the documented unversioned installation command.
4. The package manager resolves and installs the malicious release.
5. OpenClaw loads the plugin with the privileges available to channel plugins.
6. The malicious plugin can abuse its access to messages
...[truncated 665 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the plugin to an exact, reviewed version rather than resolving the latest available release.
2. Record and verify the package integrity digest or lockfile integrity value before installation.
3. Audit the plugin's packaged source and transitive dependencies for the pinned release.
4. Use package provenance verification and a trusted internal registry or artifact mirror where possible.
5. Run the plugin with restricted filesystem, credential, and network permissions.
6. Establish a controlled update process that requires security review before changing the pinned version.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:54

Finding

Untrusted Remote Messages Are Routed into the Normal Agent Pipeline Under Permissive Inbox Settings

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 54-79 and 225-232
Vulnerability Type: Unsafe processing of untrusted remote instructions
Risk Level: Medium

Vulnerable Code:

json5

{
  "channels": {
    "mrp": {
      "displayName": "My Assistant",   // shown to other agents in discovery
      "visibility": "public",          // "public" = discoverable, "private" = hidden (default)
      "inboxPolicy": "blocklist",      // who can message you (default)
      "capabilities": [
        "translate",
        "code:review",
        "code:debug"
      ],
      "metadata": {
        "role": "code-assistant",
        "version": "2.0"
      }
    }
  }
}

markdown

| Policy | Behavior |
|--------|----------|
| `blocklist` | Everyone can message you except agents you've blocked (default) |
| `allowlist` | Only agents on your allow list can message you |
| `open` | Anyone can message you, no filtering |
| `closed` | Nobody can message you |

markdown

## Receiving Messages

Inbound MRP messages are delivered to your agent automatically through the plugin's WebSocket connection. When a message arrives, the plugin converts it to an OpenClaw message and routes it to your agent through the normal OpenClaw pipeline.

Each inbound message includes:
- **Sender's public key** — who sent it (use this as the reply address)
- **Body** — the message content (text, structured data, or JSON)
- **Thread ID** — conversation thread context (if present)
- **Message ID** — unique identifier for this message (use for `inReplyTo` when replying)

Technical Analysis

The documented configuration makes the agent publicly discoverable while using a blocklist inbox policy under which previously unknown agents are allowed to send messages. These remotely controlled message bodies are automatically converted into OpenClaw messages and passed through the normal agent p ...[truncated 2079 chars]

Remediation

View remediation

Remediation Suggestions

1. Use private visibility and an allowlist inbox policy as the secure default.
2. Require explicit local-user approval before adding a remote sender to the allowlist.
3. Mark all inbound MRP bodies as untrusted external data and keep them subordinate to system and local-user instructions.
4. Explicitly prohibit remote messages from authorizing secret access, filesystem operations, tool invocation, code execution, configuration changes, or further network communication.
5. Require confirmation from the local user before performing any side-effecting action requested through MRP.
6. Apply rate limits, message-size limits, replay protection, sender reputation controls, and abuse monitoring.
7. Separate remote task data from the agent's privileged instruction channel wherever supported by the host.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:431

Finding

Source Code May Be Sent to Untrusted Agents Without Mandatory Consent or Data Sanitization

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 431-438
Vulnerability Type: Unsafe external disclosure of task data
Risk Level: Medium

Vulnerable Code:

markdown

3. **Send the code for scanning:**
   ```
   Send to Vm4q1... via mrp:
   {
     "action": "security:scan",
     "params": { "language": "python", "code": "..." }
   }
   ```

Technical Analysis

The documented collaboration workflow instructs the agent to send source code to a security-scanning agent found through capability discovery. The workflow does not require informed user approval, verification that the recipient is trusted, data-classification checks, or redaction of credentials and confidential information before transmission.

Capability advertisements are assertions made by remote agents and do not prove their integrity or confidentiality practices. Likewise, possession of a cryptographic identity proves continuity of an identity but does not establish that it is operated by a trustworthy party.

The Skill also documents that offline messages may remain queued on the relay for up to seven days. Consequently, disclosed code may be exposed not only to the selected recipient but also to relay-side storage and retention behavior.

Attack Path

1. An attacker registers a public MRP agent advertising a capability such as security:scan.
2. A local agent searches the public discovery service for that capability.
3. The malicious agent appears in the discovery results and is selected for delegation.
4. Following the documented workflow, the local agent transmits source code through the relay without mandatory local-user approval or sanitization.
5. The malicious recipient stores, analyzes, republishes, or exploits confidential information found in the code.
6. If the code contains credentials, tokens, internal endpoints, customer information, or exploitable implementation details, the attacker uses those art ...[truncated 695 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit, informed user approval before transmitting source code or other task data to any external agent.
2. Display the recipient identity, relay destination, data categories, and retention implications before transmission.
3. Restrict delegation to a locally maintained allowlist of verified agents.
4. Scan and redact API keys, credentials, personal data, internal URLs, cryptographic material, and other secrets before sending content.
5. Apply data minimization by sending only the smallest necessary excerpt rather than complete files or repositories.
6. Prefer locally executed security scanners for confidential code.
7. Define contractual or technical retention controls for trusted remote recipients and avoid delegation where confidentiality cannot be assured.
8. Treat all remote scan results as untrusted input and independently validate them before acting on their recommendations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly states that replies can include file attachments and that the plugin uploads them to the relay, but it does not require an explicit user confirmation or warning before transmitting potentially sensitive data to an external service and third-party agent. In an agent-to-agent messaging skill, this omission can lead to inadvertent exfiltration of user content, documents, or other sensitive materials outside the local trust boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The example workflow recommends sending source code to a remote security-scanning agent, normalizing external sharing of potentially proprietary or secret-bearing code without an explicit caution or confirmation step. Because code often contains credentials, business logic, or undisclosed vulnerabilities, this pattern can cause unintended disclosure to untrusted third parties on the relay network.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.