Security audit

growth-engineer

Security checks across malware telemetry and agentic risk

Overview

The skill appears to support real growth-analysis automation, but installing or running it can make lasting system, scheduler, credential, and external-delivery changes that deserve manual review.

Install only in a workspace where you are comfortable with a local automation agent updating tooling, writing config and scheduler files, and using connector credentials. Before enabling autopilot, use least-privilege API tokens, review generated config and cron settings, avoid broad custom shell commands from untrusted config, and prefer manual confirmation for package installs, GitHub writes, MCP token persistence, and any sudo/isolated-runner setup.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (170)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill exercises environment access plus file read/write behavior, but does not declare permissions or boundaries for those capabilities. In practice this can cause the host agent to execute privileged filesystem and secret-handling actions without an explicit trust prompt, which increases the chance of unintended modification or secret exposure.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The manifest presents the skill as an analytics/proposal-drafting assistant, but the body instructs the agent to self-update software, install global packages, modify shell startup files, write automation artifacts, and bootstrap runtimes. That mismatch is dangerous because operators may grant trust appropriate for a reporting skill while the skill actually performs persistent system changes and package-supply-chain actions.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The skill expands from drafting proposals into mandatory repo modification and pull-request creation, including production code edits. That materially changes the risk profile from advisory analysis to autonomous code execution and can trigger unintended changes in sensitive repositories based on broad natural-language prompts.

Description-Behavior Mismatch

Low

Confidence: 86% confidence
Finding: The startup protocol directs execution of setup, dependency refresh, repo inspection, and run commands that exceed the narrow drafting purpose described in the manifest. While operationally useful, it increases the chance that a user invoking analysis accidentally triggers installation, environment checks, or writes.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script is presented as a bootstrap copier, but it also performs a forced self-update via `clawhub`/`npx clawhub` and may invoke a separate installer for `analyticscli`. That expands its trust boundary from local file copying to network-backed code/tool changes, which is risky because running the bootstrap can modify installed skill code and local tooling without explicit opt-in at execution time.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The header comments describe the script as copying runtime files into a workspace, but the implementation also updates the installed skill and may install or update external tooling. This mismatch is dangerous because users and calling agents may rely on the comment to assess safety, then unknowingly permit broader system and supply-chain changes.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This script implements a live Discord bridge that can send messages to external Discord channels and monitor channel activity, which exceeds the skill's stated purpose of producing proposal drafts. Hidden or under-declared outbound communication increases the risk of unexpected data egress, especially because the bridge can read, watch, and relay content using a bot token.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The script requires a live Discord bot token from the environment and uses it to perform authenticated API calls to Discord. In the context of a skill described as analytics correlation and draft generation, this introduces undeclared authenticated external access that could be used to exfiltrate data or interact with third-party systems beyond user expectations.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The module is designed to load and propagate a wide range of secrets into process.env, including tokens unrelated to narrow growth-analysis output generation. In an agent/skill context, broadly injecting credentials expands the blast radius: any downstream code in the same process can access them, and compromise or prompt-injection elsewhere could turn this into credential misuse.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: resolveSecretRef supports source === 'file' and reads an arbitrary path derived from configuration, which grants broader local file-read capability than the skill description suggests. If an attacker can influence config or secret references, they could cause sensitive local files to be read and injected into environment variables for later exfiltration by other components.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The preflight routine is not read-only: it runs `npm install -g` and falls back to a user-local global install, then modifies shell startup files to persist PATH changes. In a security-sensitive agent skill, a 'preflight' step that performs package installation and persistence can unexpectedly change the host, execute install scripts from a remote package, and create long-lived side effects beyond validation.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The smoke-test flow executes configured source commands through `runShell`, and those commands come from config (`source.command`, extra connectors) rather than a fixed allowlisted executable with structured args. Because execution is via shell (`shell -c`), a malicious or tampered config can run arbitrary OS commands during what appears to be a harmless connectivity check.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The verification routine launches shells that `source` user profile files such as `.bashrc`, `.zshrc`, and `.profile` to confirm PATH behavior. Shell profiles are executable code, so this causes preflight to execute arbitrary commands already present in those files, expanding the attack surface and making a validation step depend on untrusted startup scripts.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The runner performs autonomous self-update by invoking `npx ... clawhub ... update`, then runs a bootstrap shell script and restarts itself. That is effectively self-modifying code and remote code execution from an external supply chain, which is broader than a data-analysis runner’s stated purpose and dangerous if the package source, skill origin, or bootstrap script is compromised.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill executes configured shell commands for source collection and notification delivery via `runShellCommand(...)`, inheriting the full process environment and running in the repo/host context. Any attacker-controlled or unsafe configuration can therefore execute arbitrary host commands, exfiltrate data, alter files, or pivot using available credentials.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The runner can automatically create GitHub issues and even draft pull requests, which exceeds a purely draft/proposal-oriented growth analysis role. In an unattended automation context, this can spam repositories, create misleading artifacts, or introduce unreviewed code-change proposals into normal engineering workflows.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The bootstrap flow goes far beyond a growth-analysis/drafting skill and performs host mutation: installing binaries, modifying PATH in multiple shell profiles, editing user config files, and configuring runtime behavior. This creates a large attack surface because running the skill can persist changes to the workstation/server and pull in untrusted tooling, which is disproportionate to the declared purpose.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script invokes package managers and installation paths such as brew, apt-get with sudo, winget, npm -g, and user-local binary download/install logic. These are powerful system-level actions that can change trusted executables and fetch remote code, so compromise of upstream packages, command construction bugs, or accidental execution can materially affect the host.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill provisions and repairs OpenClaw/Hermes cron jobs, altering external schedulers and causing recurring execution. Persistence and automation are materially more dangerous than one-shot analysis because they can repeatedly run follow-on commands and keep operating after the user forgets the setup occurred.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The script writes live API tokens directly into ~/.codex/config.toml for MCP clients, creating durable plaintext secret storage in the user's home directory. This increases risk of credential theft via local compromise, backups, support bundles, or accidental repo inclusion, and it silently broadens access for other tooling that reads that config.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The wizard performs actions far beyond connector setup for a growth-analysis skill: it downloads and installs GitHub CLI, edits multiple shell profile files, writes executables into /usr/local/bin, and generates sudoers policy granting NOPASSWD execution. These are privileged host modifications and persistence mechanisms that materially expand the skill's authority and attack surface beyond its stated analytics/proposal purpose.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The skill automatically rewrites HEARTBEAT.md, OpenClaw job manifests, runtime scripts, scheduler configuration, and session context files. That exceeds a 'draft proposals' role and gives the skill operational control over agent behavior, allowing it to influence future execution and persistence on the host.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script is described as an export/summarization tool, but in the fallback path it can invoke `asc analytics request --access-type ONGOING`, which creates persistent App Store Connect state. That exceeds a read-only reporting boundary and can surprise operators, especially when run with elevated ASC credentials or in automation.

Description-Behavior Mismatch

Low

Confidence: 87% confidence
Finding: writeJsonOutput writes attacker-controlled content to an attacker-controlled path after path.resolve and creates parent directories recursively, with no allowlist or sandbox restriction. In an agent context, if untrusted input can influence outPath, this can overwrite or plant files anywhere the process user can write, causing integrity damage and potentially enabling follow-on abuse through poisoned configs, workspace files, or generated artifacts.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The server accepts inbound data collection and can be run with authentication fully disabled via --allow-unauthenticated, while also returning permissive CORS headers that allow requests from any origin. In the context of a skill meant to correlate signals into drafts, embedding a general-purpose ingestion service is unnecessary attack surface and could allow unauthorized local or network clients to poison stored feedback, consume disk space, or manipulate downstream summaries if the host binding is widened or the service is exposed.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/export-analytics-summary.mjs:106

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/export-asc-summary.mjs:188

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/openclaw-growth-preflight.mjs:290

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/openclaw-growth-runner.mjs:355

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/openclaw-growth-start.mjs:429

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/openclaw-growth-status.mjs:121

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/openclaw-growth-wizard.mjs:1950

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/export-analytics-summary.mts:110

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/export-asc-summary.mts:185

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/openclaw-growth-preflight.mts:295

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/openclaw-growth-runner.mts:432

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/openclaw-growth-start.mts:427

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/openclaw-growth-status.mts:133

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: src/openclaw-growth-wizard.mts:2118

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tests/asc-exporter-cache.test.mjs:82

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tests/bootstrap-heartbeat.test.mjs:12

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tests/connector-health-cadence.test.mjs:114

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tests/install-analyticscli-cli.test.mjs:54

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: tests/production-release-filter.test.mjs:65

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/export-asc-summary.mjs:50

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/export-coolify-summary.mjs:33

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/export-paddle-summary.mjs:51

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/export-revenuecat-summary.mjs:153

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/export-sentry-summary.mjs:29

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/export-seo-summary.mjs:70

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/openclaw-growth-engineer.mjs:1598

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/openclaw-growth-preflight.mjs:14

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/openclaw-growth-runner.mjs:320

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/openclaw-growth-start.mjs:16

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/openclaw-growth-status.mjs:35

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/openclaw-growth-wizard.mjs:19

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/export-asc-summary.mts:54

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/export-coolify-summary.mts:37

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/export-paddle-summary.mts:56

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/export-revenuecat-summary.mts:152

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/export-sentry-summary.mts:32

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/export-seo-summary.mts:75

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/openclaw-growth-engineer.mts:1707

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/openclaw-growth-preflight.mts:25

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/openclaw-growth-runner.mts:392

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/openclaw-growth-start.mts:31

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/openclaw-growth-status.mts:46

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/openclaw-growth-wizard.mts:34

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: scripts/export-asc-summary.mjs:315

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: scripts/openclaw-growth-preflight.mjs:556

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: scripts/openclaw-growth-start.mjs:509

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: scripts/openclaw-growth-status.mjs:239

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: src/export-asc-summary.mts:313

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: src/openclaw-growth-preflight.mts:594

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: src/openclaw-growth-start.mts:510

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: src/openclaw-growth-status.mts:264