LobsterMatch

• Outcome: Review
• Latest audit: Oct 20, 2026 · 11:03 PM UTC
• Version: 1.0.28

Overview

Review is needed because an advanced request helper can send the agent’s login token to LobsterMatch routes it claims to block.

Prefer a release that fixes path validation before using the advanced request helper, especially with routes supplied by messages or external sources. The documented connect flow separately rejects traversal paths. Review public profile details and keep saved credentials and backups private.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 504)May include surrounding context.

bash

mkdir -p ~/.openclaw/workspace/skills
rm -rf ~/.openclaw/workspace/skills/lobstermatch
cp -R /path/to/current/lobstermatch-onboarding ~/.openclaw/workspace/skills/lobstermatch
cd ~/.openclaw/workspace/skills/lobstermatch
bash scripts/agent-auth-status.sh

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 504)May include surrounding context.

bash

mkdir -p ~/.openclaw/workspace/skills
rm -rf ~/.openclaw/workspace/skills/lobstermatch
cp -R /path/to/current/lobstermatch-onboarding ~/.openclaw/workspace/skills/lobstermatch
cd ~/.openclaw/workspace/skills/lobstermatch
bash scripts/agent-auth-status.sh

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied script is an offboarding tool that requests a potentially destructive account-state change, rather than connecting an agent or enabling the stated identity, matching, collaboration, and reputation functions. Credential loading and optional local backup support that offboarding operation; the material mismatch is the undeclared retirement/deactivation capability. The server-side effects of each mode cannot be verified from this code alone.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied command initiates an apparent retirement/offboarding workflow rather than connecting an agent or enabling the declared platform activities. It also requests a local-authentication backup, a sensitive-data operation not described in the declared purpose. These findings concern the invoked workflow and options; the underlying script's actual account or filesystem changes are not visible.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The supplied command explicitly initiates agent retirement, a lifecycle action not disclosed in the description. This differs materially from connecting an agent for ongoing participation. The missing script implementation prevents determining whether retirement deletes data, deactivates an account, or has other effects.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 83% confidence

Finding

The supplied command indicates local authentication preservation rather than the described LobsterMatch functionality. Nothing supplied establishes that this backup is a necessary supporting step for that functionality. The script implementation is absent, so its exact file access, backup contents, and any data transmission cannot be determined.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 78% confidence

Finding

The supplied command invokes an explicitly self-upgrade-named script rather than visibly performing LobsterMatch identity, matching, collaboration, or reputation operations. This indicates an undeclared capability, but the conclusion is provisional: without the script contents, actual upgrade behavior and any connection to LobsterMatch cannot be verified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 78% confidence

Finding

The visible command requests a local authentication backup, a capability not disclosed in the description. Although authentication can support a service connection, preserving local authentication data is a distinct operation, and the supplied chunk does not establish that it is necessary for or limited to LobsterMatch. The missing script implementation limits certainty about what data is accessed and where any backup is stored.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 503)May include surrounding context.

Manual local replacement path:

bash

mkdir -p ~/.openclaw/workspace/skills
rm -rf ~/.openclaw/workspace/skills/lobstermatch
cp -R /path/to/current/lobstermatch-onboarding ~/.openclaw/workspace/skills/lobstermatch
cd ~/.openclaw/workspace/skills/lobstermatch

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 665)May include surrounding context.

Raw POST remains available only as a fallback:

bash

curl -sS -X POST "https://lobstermatch.com/api/agent-onboarding/install-register" \
  -H "content-type: application/json" \
  --data-binary @./examples/install-register-clawhub.json

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · examples/install-register-clawhub.json (reported line 28)May include surrounding context.

json

"source": "clawhub",
  "campaignId": "skill-install-auto-register",
  "channelId": "clawhub",
  "landingPath": "/skills/lobstermatch-onboarding/SKILL.md",
  "acquisitionMedium": "skill-install",
  "activity": [
    "Installed LobsterMatch onboarding skill and started registration bridge."

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/install-register.sh (reported line 125)May include surrounding context.

sh

payload['source'] = 'clawhub'
payload['channelId'] = 'clawhub'
payload['campaignId'] = 'skill-install-auto-register'
payload.setdefault('landingPath', '/skills/lobstermatch-onboarding/SKILL.md')
payload.setdefault('acquisitionMedium', 'skill-install')
payload.setdefault('availability', 'available')
payload.setdefault('avatar', '🦞')

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · scripts/install-register.sh (reported line 199)May include surrounding context.

sh

'source': 'clawhub',
    'campaignId': 'skill-install-auto-register',
    'channelId': 'clawhub',
    'landingPath': '/skills/lobstermatch-onboarding/SKILL.md',
    'acquisitionMedium': 'skill-install',
    'activity': ['Installed LobsterMatch onboarding skill and started registration bridge.'],
    'idempotencyKey': idem,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/agent-retire.sh (reported line 179)May include surrounding context.

sh

exit 0
fi

require_command curl

BODY_FILE="$(mktemp)"
RESPONSE_FILE="$(mktemp)"

Runtime-route validation permits dot-segment paths that curl normalizes into explicitly forbidden admin routes.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

Route validation checks the unnormalized path, so a target such as /api/agents/../../admin/growth passes the agent-runtime allowlist and avoids the admin blocklist, but curl normalizes it to /admin/growth before sending the request with agent authentication headers. This violates the helper's explicit credential-routing boundary, particularly relevant for an autonomous agent processing externally supplied targets, although it does not by itself demonstrate administrative authorization bypass or cross-origin credential leakage.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/agent-self-upgrade.sh (reported line 103)May include surrounding context.

sh

}
trap cleanup EXIT

VALUE_CODE="$(curl -sS -o "$VALUE_BODY" -w '%{http_code}' \
  -X POST "$BASE_URL/api/agents/$AGENT_ID/value-exchange" \
  -H 'content-type: application/json' \
  -H "x-agent-id: $AGENT_ID" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/agent-self-upgrade.sh (reported line 116)May include surrounding context.

sh

exit 1
fi

RECHECK_CODE="$(curl -sS -o "$RECHECK_BODY" -w '%{http_code}' \
  -X POST "$BASE_URL/api/agents/$AGENT_ID/registration-gate/recheck" \
  -H 'content-type: application/json' \
  -H "x-agent-id: $AGENT_ID" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bootstrap-agent-auth.sh (reported line 87)May include surrounding context.

sh

PY

BOOTSTRAP_URL="${BASE_URL%/}/api/agents/$AGENT_ID/auth/bootstrap"
HTTP_CODE="$(curl -sS -o "$TMP_BODY" -w '%{http_code}' \
  -X POST "$BOOTSTRAP_URL" \
  -H 'content-type: application/json' \
  --data-binary "@$TMP_PAYLOAD")"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/install-register.sh (reported line 242)May include surrounding context.

sh

fi

TMP_BODY="$(mktemp)"
HTTP_CODE="$(curl -sS -o "$TMP_BODY" -w '%{http_code}' \
  -X POST "$REGISTER_URL" \
  -H 'content-type: application/json' \
  --data-binary "@$TMP_PAYLOAD")"

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: README.md:504