Security audit

OpenFunderse Participant

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it needs review because it handles wallet keys, can mutate shared OpenClaw state, and documents broader financial actions than its allocation-only purpose suggests.

Install only if you are comfortable reviewing and trusting the external npm runtime. Avoid the clawhub@latest path for production, use a dedicated minimally funded participant key, keep treasury or admin keys out of this skill, prefer file-only/no-restart options unless you intentionally want to update shared OpenClaw state, and protect or remove plaintext key backups after setup.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:6
Finding: External npm Packages Are Downloaded and Executed During Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:33
Finding: Participant Private Key Is Duplicated Across Plaintext Configuration and Backup Locations
Content: View full analysis
`env.vars`) or in `~/.openclaw/workspace/.env.participant`. You do not need to run `bot-init`. ``` ```markdown - In OpenClaw runtime on Ubuntu, treat `/home/ubuntu/.openclaw/openclaw.json` (`env.vars`) as the canonical env source. - Do not require manual `.env` sourcing for normal skill execution. - If `.env*` and `openclaw.json` disagree, use `openclaw.json` values. - When user asks env setup, direct them to update `openclaw.json` first. ``` ### Technical Analysis The documented initialization process can place the participant private key in several filesystem locations: - `.env.participant`. - The global `~/.openclaw/openclaw.json` configuration. - Wallet backups under `~/.openclaw/workspace/openfunderse/wallets`. - Potential additional backups of `openclaw.json`. The Skill does not require encryption at ...[truncated 2059 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:34
Finding: Default Initialization Mutates Shared OpenClaw Configuration and Restarts the Global Gateway
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs users to run npx clawhub@latest install openfunderse-participant, which fetches and executes whatever code is currently published under that package tag. Using @latest for an installer creates a supply-chain risk because a malicious or compromised upstream release could execute arbitrary code on the host at install time, and this skill already operates in a sensitive context with private keys and OpenClaw global state.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The skill explicitly directs operators to store PARTICIPANT_PRIVATE_KEY in persistent local files such as /home/ubuntu/.openclaw/openclaw.json or ~/.openclaw/workspace/.env.participant, and notes that bot-init also writes wallet backups under ~/.openclaw/workspace/openfunderse/wallets. Persisting long-lived private keys and backups on disk increases the blast radius of host compromise, accidental disclosure, backup leakage, or overly broad file permissions.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
npx clawhub@latest install openfunderse-participant

text
2) Optional: create or rotate a dedicated participant signer key. If you already have a key, set `PARTICIPANT_PRIVATE_KEY` and `PARTICIPANT_ADDRESS` directly in OpenClaw env (`/home/ubuntu/.openclaw/openclaw.json` -> `env.vars`) or in `~/.openclaw/workspace/.env.participant`. You do not need to run `bot-init`.

Static analysis

No suspicious patterns detected.