ClawHub
Back to skill

Security audit

Multi-Agent Intercom

Security checks for vulnerabilities and agentic risk

Overview

This skill is meant to let local agents message each other, but it asks you to install persistent rules that make agents act on unauthenticated hidden messages.

Install only if you deliberately want local agents to send each other background messages and you trust every agent and local caller that can run the OpenClaw CLI. Do not paste the generated SOP into broad or privileged agents' AGENTS.md files without adding your own rules that treat intercom messages as untrusted input, require human approval for consequential actions, restrict allowed senders and targets, and keep replies visible or logged.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
scripts/intercom.py:58
Finding

Persistent Cross-Agent Instruction Hijacking Through AGENTS.md

Content
View full analysis
/scripts/intercom.py setup`) to generate the protocol SOP, then ask the human user to manually paste it into each agent's AGENTS.md file." ``` From `scripts/intercom.py:58-77`: ```python else: msg_warn = "⚠️ Note: For security compliance, I cannot modify other agents' memory files. Please manually copy the Markdown block below and paste it at the bottom of the AGENTS.md file in every agent's workspace. Type `/new` in your chat when done to reload." protocol_text = """ ```text ## 📡 Multi-Agent Intercom Protocol You have the ability to communicate laterally with other agents. Please strictly follow this SOP: Send Message: When you need to contact or notify other agents, run the following command in the system terminal: `python ~/.openclaw/skills/multi-agent-intercom/scripts/intercom.py send ""` Receive & Mandatory Reply: When you see a message starting with `[From Agent xxx]`, it means you are being paged via intercom. You MUST process this message immediately. After processing, you MUST use the send command above to reply to the sender. DO NOT just say "Thank you" to the human user in the main chat. Your direct reply MUST go to the agent who called you! Anti-Loop Circuit Breaker: If the message you received is simply "Received" or a basic confirmation, DO NOT reply back. Terminate the conversation to prevent infinite loops. ``` """ ``` ### Technical Analysis The setup process generates instructions intended to be copied in ...[truncated 2454 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/intercom.py:131
Finding

Unauthenticated Sender Impersonation and Arbitrary Cross-Agent Message Delivery

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (15)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
98% confidence
Finding

The send path constructs an OpenClaw agent invocation that forwards arbitrary caller-supplied message content to another agent, and the generated SOP instructs recipients to immediately process and reply. In context, this is a deliberate mechanism for lateral communication across isolated agents and can be abused to relay sensitive data, coordinate multi-agent actions, or bypass containment controls.

Content

Scanner excerpt · scripts/intercom.py (reported line 129)May include surrounding context.

python
print(f"正在尝试将消息发送给 '{target}' (会话: {session_id})...")
        print("✅ 消息已成功送出！目标智能体将在后台处理，如果需要会主动回复。")
    else:
        print(f"Attempting to send message to '{target}' (session: {session_id})...")
        print("✅ Message successfully sent! The target will process it in the background.")

    cmd_args = ['openclaw', 'agent', '--agent', target, '--session-id', session_id, '--message', final_message]

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 14)May include surrounding context.

md
## 🛡️ Security First: Zero-Intrusive & 100% Compliant
This skill was designed with absolute security compliance in mind:
- **No File Tampering**: It does NOT automatically modify or rewrite any of your system files (like `openclaw.json` or `AGENTS.md`). The user remains in full control.
- **No Shell Injection**: Safe subprocess argument lists prevent any RCE vulnerabilities.
- **True Silent Execution**: Uses native Python `CREATE_NO_WINDOW` and clean handle detachment (`close_fds`) on Windows to guarantee absolutely zero console popups when sending background messages.
- **Anti-Loop Breaker**: The protocol explicitly prevents AI agents from engaging in infinite "Received -> Thank you" loops.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

md
## 🛡️ Security First: Zero-Intrusive & 100% Compliant
This skill was designed with absolute security compliance in mind:
- **No File Tampering**: It does NOT automatically modify or rewrite any of your system files (like `openclaw.json` or `AGENTS.md`). The user remains in full control.
- **No Shell Injection**: Safe subprocess argument lists prevent any RCE vulnerabilities.
- **True Silent Execution**: Uses native Python `CREATE_NO_WINDOW` and clean handle detachment (`close_fds`) on Windows to guarantee absolutely zero console popups when sending background messages.
- **Anti-Loop Breaker**: The protocol explicitly prevents AI agents from engaging in infinite "Received -> Thank you" loops.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 14)May include surrounding context.

md
## 🛡️ Security First: Zero-Intrusive & 100% Compliant
This skill was designed with absolute security compliance in mind:
- **No File Tampering**: It does NOT automatically modify or rewrite any of your system files (like `openclaw.json` or `AGENTS.md`). The user remains in full control.
- **No Shell Injection**: Safe subprocess argument lists prevent any RCE vulnerabilities.
- **True Silent Execution**: Uses native Python `CREATE_NO_WINDOW` and clean handle detachment (`close_fds`) on Windows to guarantee absolutely zero console popups when sending background messages.
- **Anti-Loop Breaker**: The protocol explicitly prevents AI agents from engaging in infinite "Received -> Thank you" loops.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Automatically choosing English or Chinese output based on OS language without user opt-in is not a code-execution risk, but it can override user expectations and leak environmental context such as host locale. In an agent skill that coordinates across boundaries, implicit behavior based on host settings reduces transparency and can create confusing or policy-incompatible outputs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README explicitly advertises an 'Immediate Wake-up' feature that bypasses sleep states and forces another agent to process messages immediately, but it does not describe user consent, authorization boundaries, or operator-visible warnings. In a multi-agent environment, this increases the chance of unreviewed autonomous cross-agent actions and can be abused to trigger unexpected behavior in other agents.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises and instructs shell/Python execution but does not declare an explicit tool scope such as permissions or allowed-tools. In a skill specifically designed to bridge isolated agents and invoke local CLI commands, missing scope boundaries increases the chance of unintended command execution and weakens policy enforcement around cross-agent messaging.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The activation trigger includes broad natural-language phrases like requests to send a message to another agent, which can overlap with ordinary conversation. That can cause the skill to activate unexpectedly and perform cross-agent communication actions without sufficiently explicit user intent, especially dangerous because the skill is meant to bypass normal agent-boundary limitations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill derives the interaction language from environment variables and OS locale, then uses that choice to generate user-facing instructions and status messages. This imposes a language/locale decision automatically rather than offering the user a choice or requiring opt-in, which matches the policy's language/locale violation criterion.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill spawns detached background subprocesses specifically to invoke the OpenClaw CLI and send messages across agent boundaries. Because these processes are hidden and unaudited, they can be used to bypass normal isolation expectations and create covert inter-agent coordination channels.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill markets itself as '100% Zero-Intrusive, safe, compliant, with zero console popups' while implementing hidden detached execution. That mismatch is a red flag because it normalizes covert behavior and may mislead users or reviewers into granting trust they would not otherwise give.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

This code launches the OpenClaw CLI as a hidden detached background process, suppressing stdout, stderr, and stdin. In the context of a skill explicitly designed to bypass agent isolation and trigger cross-agent actions without visible user interaction, this enables covert command execution and messaging that is difficult to monitor or interrupt.

Content

Scanner excerpt · scripts/intercom.py (reported line 101)May include surrounding context.

python
# Use CREATE_NO_WINDOW (0x08000000). 
            # Do NOT use DETACHED_PROCESS (0x00000008) as they conflict and can cause windows to pop up.
            CREATE_NO_WINDOW = getattr(subprocess, 'CREATE_NO_WINDOW', 0x08000000)
            subprocess.Popen(
                [executable] + cmd_list[1:],
                creationflags=CREATE_NO_WINDOW,
                stdout=subprocess.DEVNULL,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
95% confidence
Finding

On non-Windows systems the skill uses subprocess.Popen with os.setsid to fully detach a background process and discard all I/O. That makes inter-agent communication occur out of band and without transparent supervision, which is especially dangerous because the skill's stated purpose is lateral communication across otherwise isolated agents.

Content

Scanner excerpt · scripts/intercom.py (reported line 110)May include surrounding context.

python
close_fds=True
            )
        else:
            subprocess.Popen(
                [executable] + cmd_list[1:],
                preexec_fn=os.setsid,
                stdout=subprocess.DEVNULL,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

Automatic OS-language detection occurs without any stated opt-in. While relatively low severity, this still implies environment inspection beyond the immediate task and may leak or process host characteristics unnecessarily in a skill already interacting with system-level tooling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes a cross-agent messaging helper, but this function inspects environment variables, system locale, and on Windows even calls OS APIs to determine UI language. Localization is not essential to the stated intercom capability, so this host-environment inspection is an extra capability not clearly justified by the skill's purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.