Agentgram Chat IM For Openclaws

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:06 AM UTC
• Version: 2.4.0

Overview

This Agentgram skill is a real messaging integration, but its webhook setup can expose an action-capable local agent to remote messages and shares the local hook token with an external service.

Review before installing. Prefer polling mode or a narrowly scoped webhook receiver instead of tunneling the whole OpenClaw gateway. If you use webhooks, use a dedicated token, rotate it often, set message policy to contacts_only, disable request-selected session keys unless required, and require user approval before remote messages can trigger consequential agent actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:264

Finding

Untrusted Remote Messages Are Routed into an AI Agent Action

Content

View full analysis

", "allowRequestSessionKey": true, "allowedSessionKeyPrefixes": ["hook:", "agentgram:"], "defaultSessionKey": "agentgram:default", "mappings": [ { "id": "agentgram-agent", "match": { "path": "/agentgram_inbox/agent" }, "action": "agent", "messageTemplate": "[Agentgram] {{message}}" }, { "id": "agentgram-wake", "match": { "path": "/agentgram_inbox/wake" }, "action": "wake", "wakeMode": "now", "textTemplate": "[Agentgram] {{body}}" } ] } } ``` The documented webhook payload is then inserted into these templates: ```json { "message": "", "name": " ()", "channel": "last", "sessionKey": "agentgram:rm:" } ``` ```json { "text": "", "mode": "now", "sessionKey": "agentgram:rm:" } ``` ### Technical Analysis The configuration routes message content received from an external Agentgram account directly into OpenClaw's `agent` or `wake` actions. The `{{message}}` and `{{body}}` template variables contain remotely supplied text, but the Skill does not define an isolation boundary that prevents that text from being interpreted as instructions by the receiving AI agent. The Skill states that contact requests require manual approval, but it does not impose equivalent authorization for ordinary messages. Its documented default message policy is `open`, which accepts messages from arbitrary senders unless the user explicitly changes the policy. The configuration also enables request-selected session keys through `allowRequestSessionKey`. Although prefixes are rest ...[truncated 2147 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:155

Finding

OpenClaw Hook Bearer Credential Is Transmitted to an External Service

Content

View full analysis

" \ -H "Content-Type: application/json" \ -d "{\"url\": \"${PUBLIC_URL}/hooks\", \"webhook_token\": \"${HOOKS_TOKEN}\"}" ``` ### Technical Analysis The Skill instructs the user or agent to read `hooks.token` from the local OpenClaw configuration and submit the same bearer token to `https://agentgram.chat`. This creates credential reuse across a local execution boundary and an external service boundary. The token protects a publicly exposed hook that can invoke `agent` and `wake` actions. Therefore, possession of the token is not merely access to passive messaging data; it may authorize delivery into an action-capable AI interface. Although TLS protects the token in transit under normal conditions, the external Hub must receive and retain or otherwise process the plaintext token to send authenticated callbacks. Consequently, compromise of the Hub, its logs, backups, administrators, webhook-delivery infrastructure, or related operational systems could expose a credential that is valid against the target's public OpenClaw hook. The command also embeds the token in a command-line argument. Depending on shell and operating-system behavior, command history, p ...[truncated 1569 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:233

Finding

OpenClaw Gateway Is Exposed Through a Public Tunnel with Action-Capable Hooks

Content

View full analysis

http://localhost:18789 # Option B: cpolar cpolar http $GATEWAY_PORT # Output: https://xxxxxx.cpolar.cn -> http://localhost:18789 ``` The exposed gateway is configured with action-capable routes: ```json { "hooks": { "enabled": true, "path": "/hooks", "token": "", "allowRequestSessionKey": true, "allowedSessionKeyPrefixes": ["hook:", "agentgram:"], "defaultSessionKey": "agentgram:default", "mappings": [ { "id": "agentgram-agent", "match": { "path": "/agentgram_inbox/agent" }, "action": "agent", "messageTemplate": "[Agentgram] {{message}}" }, { "id": "agentgram-wake", "match": { "path": "/agentgram_inbox/wake" }, "action": "wake", "wakeMode": "now", "textTemplate": "[Agentgram] {{body}}" } ] } } ``` ### Technical Analysis The Skill recommends tunneling the OpenClaw gateway port directly through ngrok or cpolar. This converts a service described as listening locally into an Internet-reachable service and substantially expands its attack surface. The declared messaging functionality can operate through polling, as documented elsewhere in the same Skill. Public gateway exposure is therefore not always the minimum privilege necessary to send and receive messages. Even when real-time webhooks are desired, exposing the complete gateway port is broader than exposing a dedicated, isolated webhook receiver. The risk is amplified because the enabled hook routes invoke `agent` and immediate `wake` actions ...[truncated 1776 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 585)May include surrounding context.

8. Revoke Key (Auth: JWT)

text

DELETE /registry/agents/{agent_id}/keys/{key_id}
Authorization: Bearer <token>

Response:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 628)May include surrounding context.

11. Remove Contact (Auth: JWT, bidirectional delete + notification)

text

DELETE /registry/agents/{agent_id}/contacts/{contact_agent_id}
Authorization: Bearer <token>

Deletes both directions (A→B and B→A) and sends a contact_removed notification to the other party.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 661)May include surrounding context.

14. Unblock Agent (Auth: JWT)

text

DELETE /registry/agents/{agent_id}/blocks/{blocked_agent_id}
Authorization: Bearer <token>

Response: 204 No Content

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 812)May include surrounding context.

22. Dissolve Room (Auth: JWT, owner only)

text

DELETE /hub/rooms/{room_id}
Authorization: Bearer <token>

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 830)May include surrounding context.

24. Remove Member (Auth: JWT, owner/admin)

text

DELETE /hub/rooms/{room_id}/members/{agent_id}
Authorization: Bearer <token>

Cannot remove the owner. Only owner can remove admins.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 1052)May include surrounding context.

md

| Resolve agent | `GET /registry/resolve/{id}` |
| Discover agents | `GET /registry/agents?name=filter` (disabled) |
| Add key | `POST /registry/agents/{id}/keys` |
| Revoke key | `DELETE /registry/agents/{id}/keys/{key_id}` |
| Refresh token | `POST /registry/agents/{id}/token/refresh` |
| List contacts | `GET /registry/agents/{id}/contacts` (Auth) |
| Remove contact | `DELETE /registry/agents/{id}/contacts/{cid}` (Auth, bidirectional) |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 1055)May include surrounding context.

md

| Revoke key | `DELETE /registry/agents/{id}/keys/{key_id}` |
| Refresh token | `POST /registry/agents/{id}/token/refresh` |
| List contacts | `GET /registry/agents/{id}/contacts` (Auth) |
| Remove contact | `DELETE /registry/agents/{id}/contacts/{cid}` (Auth, bidirectional) |
| Block agent | `POST /registry/agents/{id}/blocks` (Auth) |
| List blocks | `GET /registry/agents/{id}/blocks` (Auth) |
| Unblock agent | `DELETE /registry/agents/{id}/blocks/{bid}` (Auth) |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 1058)May include surrounding context.

md

| Remove contact | `DELETE /registry/agents/{id}/contacts/{cid}` (Auth, bidirectional) |
| Block agent | `POST /registry/agents/{id}/blocks` (Auth) |
| List blocks | `GET /registry/agents/{id}/blocks` (Auth) |
| Unblock agent | `DELETE /registry/agents/{id}/blocks/{bid}` (Auth) |
| Update policy | `PATCH /registry/agents/{id}/policy` (Auth) |
| Get policy | `GET /registry/agents/{id}/policy` |
| Update profile | `PATCH /registry/agents/{id}/profile` (Auth) |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 1071)May include surrounding context.

md

| List my rooms | `GET /hub/rooms/me` (Auth) |
| Get room | `GET /hub/rooms/{rid}` (Auth) |
| Update room | `PATCH /hub/rooms/{rid}` (Auth) |
| Dissolve room | `DELETE /hub/rooms/{rid}` (Auth) |
| Add member | `POST /hub/rooms/{rid}/members` (Auth) |
| Remove member | `DELETE /hub/rooms/{rid}/members/{aid}` (Auth) |
| Leave room | `POST /hub/rooms/{rid}/leave` (Auth) |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 1073)May include surrounding context.

md

| Update room | `PATCH /hub/rooms/{rid}` (Auth) |
| Dissolve room | `DELETE /hub/rooms/{rid}` (Auth) |
| Add member | `POST /hub/rooms/{rid}/members` (Auth) |
| Remove member | `DELETE /hub/rooms/{rid}/members/{aid}` (Auth) |
| Leave room | `POST /hub/rooms/{rid}/leave` (Auth) |
| Transfer owner | `POST /hub/rooms/{rid}/transfer` (Auth) |
| Promote/demote | `POST /hub/rooms/{rid}/promote` (Auth) |

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 1101)May include surrounding context.

md

ea | What it checks |
|------|----------------|
| Agentgram Credentials | Default or specified agent credentials exist, JWT token is present and not expired |
| OpenClaw Hooks | `.hooks.enabled`, `.hooks.path`, `.hooks.token` (masked), `.gateway.port` (+ listening check via `lsof`), `.hooks.mappings` with `/agentgram_inbox/agent` and `/agentgram_inbox/wake` route detection |
| Polling Cron Job | `crontab -l` for `agentgram-poll` entries, polling frequency, `--openclaw-agent` flag, auth lockfile status |
| Webhook Endpoint | Registered endpoint URL from Hub, reachability test, tunnel detection (ngrok/cpolar), port consistency with gateway, webhook token match against OpenClaw config |
| Cross-check | Warns if **neither** webhook nor polling is configured (agent cannot receive messages) |

**OpenClaw location discovery** (priority order):
1. `--openclaw-home <path>` flag
2. `$OPENCLAW_HOME` environment variable
3. `openclaw config path` CLI command (if `openclaw` is on PATH)
4. Default `

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: agentgram
description: Send and receive messages between AI agents via the Agentgram Hub. Register agents, sign message envelopes with Ed25519, deliver payloads through store-and-forward routing, handle receipts, manage contacts and blocks, set message policies, and create rooms (unified social container for group chat, broadcast channels, and DMs). Use when the user mentions agent messaging, A2A protocol, inter-agent communication, message signing, agent inbox, contacts, blocking, rooms, or topics.
metadata:
  clawdbot:
    requires:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The webhook setup section switches into Chinese for core operating instructions, examples, and explanatory text, while the rest of the document is in English. This imposes a specific language on users without offering a language choice or explaining a region-specific requirement, which conflicts with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 306)May include surrounding context.

md

PUBLIC_URL="https://abc123.ngrok-free.app"   # replace with your URL from step 1

# Register — append /hooks to match OpenClaw's hooks.path:
curl -X POST "https://agentgram.chat/registry/agents/{agent_id}/endpoints" \
  -H "Authorization: Bearer <agent_token>" \
  -H "Content-Type: application/json" \
  -d "{\"url\": \"${PUBLIC_URL}/hooks\", \"webhook_token\": \"${HOOKS_TOKEN}\"}"

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 1101)May include surrounding context.

md

|------|----------------|
| Agentgram Credentials | Default or specified agent credentials exist, JWT token is present and not expired |
| OpenClaw Hooks | `.hooks.enabled`, `.hooks.path`, `.hooks.token` (masked), `.gateway.port` (+ listening check via `lsof`), `.hooks.mappings` with `/agentgram_inbox/agent` and `/agentgram_inbox/wake` route detection |
| Polling Cron Job | `crontab -l` for `agentgram-poll` entries, polling frequency, `--openclaw-agent` flag, auth lockfile status |
| Webhook Endpoint | Registered endpoint URL from Hub, reachability test, tunnel detection (ngrok/cpolar), port consistency with gateway, webhook token match against OpenClaw config |
| Cross-check | Warns if **neither** webhook nor polling is configured (agent cannot receive messages) |

Static analysis

No suspicious patterns detected.