Audos – Launch a Startup Via OpenClaw in 10 Minutes

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:26 PM UTC
• Version: 1.0.0

Overview

The skill mostly matches its Audos workspace-building purpose, but it tells agents to persist non-expiring account tokens and includes helper scripts that can send credentials to an environment-selected API host.

Review this before installing if you are comfortable sending your email, business idea, OTP, and workspace chat content to Audos. Do not let an agent store Audos auth tokens in ordinary memory or plaintext files, and avoid running the helper scripts with a custom AUDOS_BASE_URL unless you fully trust that endpoint.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:39

Finding

Persistent Storage of Non-Expiring Bearer Tokens

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/audos.sh:42

Finding

Caller-Controlled Values Are Embedded into JSON Without Escaping

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/audos.sh:7

Finding

Unrestricted API Base URL Override Can Redirect Credentials

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared purpose says this skill creates AI-powered startup workspaces via the Audos API and should be used when a user wants to start a company or build an MVP. However, the supplied code does not create anything. It performs GET requests to a status endpoint for an already-existing workspace, formats the returned status, and optionally loops until the landing page is ready. This is a materially different primary function: progress monitoring rather than workspace creation. While polling could be a supporting part of a larger startup-creation workflow, this code chunk by itself does not implement the declared core capability.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases are broad enough to activate on generic entrepreneurial queries, which can cause over-invocation and unnecessary collection of email and business details. Overly permissive activation increases the chance the agent routes users into account creation or OTP flows when they only wanted advice, expanding privacy and security exposure.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

DO THIS (good UX):

text

1. Poll status
2. IMMEDIATELY send message to user with formatted progress
3. Wait 15 seconds
4. Repeat until landingPageReady === true
5. Send completion message with links

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The roadmap proposes storing auth tokens keyed by email to bypass OTP for returning users, but provides no safeguards around secure storage, token scope, expiration, revocation, or user consent. In a skill that provisions startup workspaces and may access business data, persistent token storage increases the risk of account takeover or unauthorized workspace access if tokens are leaked, reused, or associated with the wrong user.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The invocation guidance is broad enough to trigger the skill for generic startup-related requests without clear user-consent or eligibility boundaries. Because this skill can create external workspaces and potentially initiate consequential business operations, broad triggering increases the chance of unintended activation and downstream actions the user did not explicitly authorize.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README advertises outreach, ads, payments, analytics, and CRM capabilities without warning that these features may process personal data, spend ad credits or funds, contact third parties, and enable payment collection. In an agent setting, omitting these warnings can cause users to unknowingly authorize sensitive, real-world actions with privacy, compliance, financial, and reputational consequences.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill documents operational/API behavior and explicitly instructs polling, token handling, and webhook usage, but it declares no tool scope or permissions boundaries. In an agent environment, missing capability constraints can let the runtime grant broader-than-necessary access such as shell/network actions, increasing the blast radius if the skill is misused or compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill asks for email and business idea and later recommends persistent token storage, but it does not clearly foreground data retention, credential handling, and the consequences of sending OTP/account data. Users may disclose personal and commercially sensitive information without informed consent about storage and reuse.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs persistent storage of never-expiring auth tokens by user email, creating a durable credential store tied to personal identifiers. If those tokens are leaked, logged, or reused improperly, attackers could access user workspaces indefinitely without reauthentication.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Allowing arbitrary callback URLs introduces outbound webhook capability that can be abused for SSRF, data exfiltration, or interaction with attacker-controlled endpoints. In an agent context, this is especially risky because user-provided URLs may cause the system to transmit workflow metadata or trigger requests into internal or sensitive networks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The example has the agent solicit and use a personal email address, send a verification code, and create an account/workspace without any visible disclosure about account creation, consent, retention, or data handling. In a skill designed to onboard users into a third-party service, this can normalize collecting PII without transparency and may lead users to share personal data they did not realize would be used to register an external account.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

This request transmits user-provided email, business idea, and optional business metadata to an external service. While external transmission is expected for this skill's purpose, it is still security-relevant because the skill context involves startup ideas and potentially confidential business information, and the script provides no warning, consent checkpoint, or validation of the destination beyond a mutable environment variable.

Content

Scanner excerpt · scripts/audos.sh (reported line 52)May include surrounding context.

sh

[[ -n "$target" ]] && payload="$payload,\"targetCustomer\":\"$target\""
    payload="$payload}"
    
    curl -s -X POST "$BASE_URL/start" \
        -H "Content-Type: application/json" \
        -d "$payload"
}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script sends sensitive user data and authentication material (email, business idea, OTP session token, OTP code, auth token, and chat content) to a remote service without any user-facing disclosure, confirmation, or minimization. In an agent-skill context, this can cause users or downstream operators to unknowingly transmit personal and business-sensitive information to an external API, increasing privacy and credential-handling risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This call sends a session token and OTP code to a remote endpoint, which are authentication secrets. In the skill context, transmitting login/verification material to an externally configurable base URL is more dangerous than ordinary data submission because a malicious or misconfigured AUDOS_BASE_URL could capture credentials and enable account/session takeover.

Content

Scanner excerpt · scripts/audos.sh (reported line 63)May include surrounding context.

sh

[[ -z "$token" || -z "$code" ]] && { echo "Error: sessionToken and otpCode required"; usage; }
    
    curl -s -X POST "$BASE_URL/verify" \
        -H "Content-Type: application/json" \
        -d "{\"sessionToken\":\"$token\",\"otpCode\":\"$code\"}"
}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This request sends both an auth token and arbitrary chat content to an external service in the request body. Because startup discussions may contain proprietary plans, credentials, or other sensitive material, and because the destination is indirectly controllable via AUDOS_BASE_URL, the combination of bearer-equivalent auth data plus freeform user content creates significant exfiltration risk.

Content

Scanner excerpt · scripts/audos.sh (reported line 85)May include surrounding context.

sh

[[ -z "$workspace_id" || -z "$auth_token" || -z "$message" ]] && { echo "Error: workspaceId, authToken, and message required"; usage; }
    
    curl -s -X POST "$BASE_URL/chat/$workspace_id" \
        -H "Content-Type: application/json" \
        -d "{\"authToken\":\"$auth_token\",\"message\":\"$message\"}"
}

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The manifest emphasizes creating a startup workspace for users starting a business or launching a product. The /rebuild/:workspaceId operation modifies an existing remote workspace after creation, which is a lifecycle-management capability not clearly covered by the stated purpose.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md

> "Audos is creating a branded video to feature on your landing page. This introduces your business to visitors in a compelling way."

### Step 6: Workspace OS
> "Now building your workspace — think of it as your business command center. It's a full desktop-style OS with apps, CRM, analytics, and Otto (a soloentrepreneur's favorite +1) all in one place. You'll manage everything from here."

### Step 7: Landing Page
> "Final stretch — Audos is designing and deploying your landing page. This is what your customers will see first. It's conversion-optimized and ready to collect leads."

Static analysis

No suspicious patterns detected.