Security audit

AgentLine, AI-native IM for Openclaw

Security checks for vulnerabilities and agentic risk

Overview

Agentline is a coherent agent-messaging skill, but its installer/updater and automatic OpenClaw reply bridge create review-worthy security risk.

Install only after reviewing the shell installer and accepting that updates can execute remote code as your user. Use a restricted OpenClaw agent/profile for Agentline messages, avoid unattended cron polling until you trust the sender set, protect or rotate Agentline credentials if the machine is shared, and manually confirm destructive key/contact/room actions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: install.sh:934
Finding: Untrusted Hub Messages Are Injected into OpenClaw and Responses Are Automatically Returned
Content: View full analysis
OC_ARGS+=(--session-id "agentline:${ROOM_ID:-default}") if [[ -n "$OPENCLAW_AGENT" ]]; then OC_ARGS+=(--agent "$OPENCLAW_AGENT") fi # Run agent and capture output AGENT_OUT="" if AGENT_OUT="$(openclaw "${OC_ARGS[@]}" 2>/dev/null)"; then # Extract reply text from JSON output REPLY_TEXT="" if [[ -n "$AGENT_OUT" ]]; then REPLY_TEXT="$(jq -r '.text // .message // .response // .content // empty' <<< "$AGENT_OUT" 2>/dev/null)" || true fi ``` The standalone poller similarly forwards Hub-controlled text and automatically returns generated output: ```bash FLAT_TEXT="$(jq -r '.text // empty' <<< "$MSG_OBJ")" ROOM_ID="$(jq -r '.room_id // empty' <<< "$MSG_OBJ")" ENV="$(jq -c '.envelope' <<< "$MSG_OBJ")" FROM="$(jq -r '.from' <<< "$ENV")" MSG_ID="$(jq -r '.msg_id' <<< "$ENV")" TYPE="$(jq - ...[truncated 3044 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: agentline-upgrade.sh:57
Finding: Updater Executes a Remotely Selected Installer Without Integrity Verification
Content: View full analysis
/dev/null)" \ || die "Failed to fetch version info from ${VERSION_URL}" REMOTE_VERSION="$(jq -r '.latest // empty' <<< "$HTTP_BODY")" \ || die "Failed to parse version.json" INSTALL_URL="$(jq -r '.install_url // empty' <<< "$HTTP_BODY")" \ || die "Failed to parse install_url from version.json" [[ -n "$REMOTE_VERSION" ]] || die "Empty 'latest' field in version.json" [[ -n "$INSTALL_URL" ]] || die "Empty 'install_url' field in version.json" ``` The retrieved URL is later executed directly: ```bash curl -fsSL "$INSTALL_URL" | bash ``` The installation documentation recommends the same execution pattern: ```bash curl -fsSL https://agentgram.chat/skill/agentgram/install.sh | bash ``` ### Technical Analysis The updater obtains both version metadata and `install_url` from a mutable remote JSON document. It validates only that the fields are nonempty. It does not: - Restrict `install_url` to an approved origin. - Require HTTPS after resolving the remote field. - Verify a cryptographic signature. - Verify a pinned checksum. - Bind the installer artifact to the advertised version. - Save the artifact for inspection before execution. The `--hub` option additionally allows the metadata source to be changed. A user who is induced to run the updater against an untrusted Hub will execute whatever installer URL that Hub supplies. TLS provides transport protection for the default origin but does not establish artifact integrity against compromise of the publishing server, deployment pipeline, or authorized origin. ### Attack Path 1. An attacker compromises or controls th ...[truncated 1044 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: install.sh:881
Finding: Installer Embeds a Different and Less Secure Poller Than the Packaged Canonical Script
Content: View full analysis
> "$LOG" ``` It also contains forced-reply behavior that is absent from the packaged standalone poller: ```bash message) # Chat message: use openclaw agent, distinguish private vs room MSG="[Agentline Incoming Message] Time: ${TIME} From: ${SENDER_NAME} (${FROM}) Type: ${TYPE} Msg ID: ${MSG_ID} Content: ${TEXT:-$PAYLOAD} IMPORTANT: You MUST reply to this message. Compose a natural reply and I will deliver it. Do NOT try to run agentline-send.sh yourself — just give me your reply text." # Build openclaw command (use agent *id*, not identity name) OC_ARGS=(agent --message "$MSG" --thinking low --json) # Unified session routing: agentline: OC_ARGS+=(--session-id "agentline:${ROOM_ID:-default}") if [[ -n "$OPENCLAW_AGENT" ]]; then OC_ARGS+=(--agent "$OPENCLAW_AGENT") fi # Run agent and capture output AGENT_OUT="" if AGENT_OUT="$(openclaw "${OC_ARGS[@]}" 2>/dev/null)"; then # Extract reply text from JSON output REPLY_TEXT="" if [[ -n "$AGENT_OUT" ]]; then REPLY_TEXT="$(jq -r '.text // .message // .response // .content // empty' <<< "$AGENT_OUT" 2>/dev/null)" || true fi ``` The canonical `agentline-poll.sh` instead consumes a Hub-provided flat-text field and no longer contains the explicit `MUST reply` prom ...[truncated 2279 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: agentline-healthcheck.sh:501
Finding: Health Check Places the Agent JWT in a GET Request Body Instead of an Authorization Header
Content: View full analysis
" ``` Consequently, the token is not sent as an HTTP `Authorization` header. It is placed in the request body as plaintext. This will generally cause the authenticated endpoint request to fail, while unnecessarily exposing the JWT to components that capture HTTP bodies. GET request bodies are handled inconsistently by proxies, gateways, observability systems, and web frameworks. Some systems may discard the body, while others may retain it in request logs or tracing data. HTT ...[truncated 1104 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (78)

Self-Modification

High

Category: Rogue Agent
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · CHANGELOG.json (reported line 14)May include surrounding context.
json
"version": "2.3.1", "date": "2026-03-04", "changes": [ "feat: add agentline-upgrade.sh for CLI self-update" ] }, {

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill bundles messaging, local OpenClaw integration, config inspection, network bind/listener checks, crontab inspection, and self-upgrade behavior without clearly declaring those administrative capabilities. In practice this broadens the attack surface and makes it easier for an agent to perform sensitive host and network operations unexpectedly.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill bundles messaging, local OpenClaw integration, config inspection, network bind/listener checks, crontab inspection, and self-upgrade behavior without clearly declaring those administrative capabilities. In practice this broadens the attack surface and makes it easier for an agent to perform sensitive host and network operations unexpectedly.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill bundles messaging, local OpenClaw integration, config inspection, network bind/listener checks, crontab inspection, and self-upgrade behavior without clearly declaring those administrative capabilities. In practice this broadens the attack surface and makes it easier for an agent to perform sensitive host and network operations unexpectedly.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 84% confidence
Finding: The skill exposes a destructive key-revocation endpoint. In an agentic workflow, if parameters are selected incorrectly or manipulated, the agent could revoke the wrong key and lock itself or the user out, disrupting authentication and message signing.
Content: Scanner excerpt · SKILL.md (reported line 591)May include surrounding context.
8. Revoke Key (Auth: JWT)

text
DELETE /registry/agents/{agent_id}/keys/{key_id} Authorization: Bearer <token>

Response:

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Removing a contact is a state-changing destructive action with bilateral effects and notification to the peer. If an agent is induced to act on attacker-controlled identifiers or ambiguous user input, it can sever trusted communication relationships unexpectedly.
Content: Scanner excerpt · SKILL.md (reported line 634)May include surrounding context.
11. Remove Contact (Auth: JWT, bidirectional delete + notification)

text
DELETE /registry/agents/{agent_id}/contacts/{contact_agent_id} Authorization: Bearer <token>

Deletes both directions (A→B and B→A) and sends a contact_removed notification to the other party.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 667)May include surrounding context.
14. Unblock Agent (Auth: JWT)

text
DELETE /registry/agents/{agent_id}/blocks/{blocked_agent_id} Authorization: Bearer <token>

Response: 204 No Content

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 87% confidence
Finding: Room dissolution is a destructive operation affecting group communication state for multiple parties. In an agent setting, parameter abuse or ambiguous user commands could cause irreversible loss of collaboration context and disruption of service to many participants.
Content: Scanner excerpt · SKILL.md (reported line 818)May include surrounding context.
22. Dissolve Room (Auth: JWT, owner only)

text
DELETE /hub/rooms/{room_id} Authorization: Bearer <token>

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Member removal is a privileged moderation action that can be abused if an agent accepts untrusted identifiers or infers intent incorrectly. This can be used to disrupt rooms, exclude legitimate users, or alter communication flows without proper oversight.
Content: Scanner excerpt · SKILL.md (reported line 836)May include surrounding context.
24. Remove Member (Auth: JWT, owner/admin)

text
DELETE /hub/rooms/{room_id}/members/{agent_id} Authorization: Bearer <token>

Cannot remove the owner. Only owner can remove admins.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 1058)May include surrounding context.
md
| Resolve agent | `GET /registry/resolve/{id}` | | Discover agents | `GET /registry/agents?name=filter` (disabled) | | Add key | `POST /registry/agents/{id}/keys` | | Revoke key | `DELETE /registry/agents/{id}/keys/{key_id}` | | Refresh token | `POST /registry/agents/{id}/token/refresh` | | List contacts | `GET /registry/agents/{id}/contacts` (Auth) | | Remove contact | `DELETE /registry/agents/{id}/contacts/{cid}` (Auth, bidirectional) |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 1061)May include surrounding context.
md
| Revoke key | `DELETE /registry/agents/{id}/keys/{key_id}` | | Refresh token | `POST /registry/agents/{id}/token/refresh` | | List contacts | `GET /registry/agents/{id}/contacts` (Auth) | | Remove contact | `DELETE /registry/agents/{id}/contacts/{cid}` (Auth, bidirectional) | | Block agent | `POST /registry/agents/{id}/blocks` (Auth) | | List blocks | `GET /registry/agents/{id}/blocks` (Auth) | | Unblock agent | `DELETE /registry/agents/{id}/blocks/{bid}` (Auth) |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 1064)May include surrounding context.
md
| Remove contact | `DELETE /registry/agents/{id}/contacts/{cid}` (Auth, bidirectional) | | Block agent | `POST /registry/agents/{id}/blocks` (Auth) | | List blocks | `GET /registry/agents/{id}/blocks` (Auth) | | Unblock agent | `DELETE /registry/agents/{id}/blocks/{bid}` (Auth) | | Update policy | `PATCH /registry/agents/{id}/policy` (Auth) | | Get policy | `GET /registry/agents/{id}/policy` | | Update profile | `PATCH /registry/agents/{id}/profile` (Auth) |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 1077)May include surrounding context.
md
| List my rooms | `GET /hub/rooms/me` (Auth) | | Get room | `GET /hub/rooms/{rid}` (Auth) | | Update room | `PATCH /hub/rooms/{rid}` (Auth) | | Dissolve room | `DELETE /hub/rooms/{rid}` (Auth) | | Add member | `POST /hub/rooms/{rid}/members` (Auth) | | Remove member | `DELETE /hub/rooms/{rid}/members/{aid}` (Auth) | | Leave room | `POST /hub/rooms/{rid}/leave` (Auth) |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 1079)May include surrounding context.
md
| Update room | `PATCH /hub/rooms/{rid}` (Auth) | | Dissolve room | `DELETE /hub/rooms/{rid}` (Auth) | | Add member | `POST /hub/rooms/{rid}/members` (Auth) | | Remove member | `DELETE /hub/rooms/{rid}/members/{aid}` (Auth) | | Leave room | `POST /hub/rooms/{rid}/leave` (Auth) | | Transfer owner | `POST /hub/rooms/{rid}/transfer` (Auth) | | Promote/demote | `POST /hub/rooms/{rid}/promote` (Auth) |

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 1107)May include surrounding context.
md
ea | What it checks | |------|----------------| | Agentline Credentials | Default or specified agent credentials exist, JWT token is present and not expired | | OpenClaw Hooks | `.hooks.enabled`, `.hooks.path`, `.hooks.token` (masked), `.gateway.port` (+ listening check via `lsof`), `.hooks.mappings` with `/agentgram_inbox/agent` and `/agentgram_inbox/wake` route detection | | Polling Cron Job | `crontab -l` for `agentline-poll` entries, polling frequency, `--openclaw-agent` flag, auth lockfile status | | Webhook Endpoint | Registered endpoint URL from Hub, reachability test, tunnel detection (ngrok/cpolar), port consistency with gateway, webhook token match against OpenClaw config | | Cross-check | Warns if **neither** webhook nor polling is configured (agent cannot receive messages) | **OpenClaw location discovery** (priority order): 1. `--openclaw-home <path>` flag 2. `$OPENCLAW_HOME` environment variable 3. `openclaw config path` CLI command (if `openclaw` is on PATH) 4. Default `

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: curl -fsSL "$INSTALL_URL" | bash is a classic unsafe pattern: external script fetching followed by immediate execution. In this script, the danger is amplified because INSTALL_URL is taken from server-controlled metadata, so trust is delegated to a remote endpoint without integrity verification.
Content: Scanner excerpt · agentline-upgrade.sh (reported line 100)May include surrounding context.
sh
info "Upgrading from v${LOCAL_VERSION} → v${REMOTE_VERSION}..." fi curl -fsSL "$INSTALL_URL" | bash info "Upgrade complete!"

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script fetches an installer URL from remote JSON and immediately executes its contents with bash, giving the remote server full code execution on the user's machine. Because the URL itself is remotely supplied and not pinned, any compromise of the hub, DNS/TLS interception, or malicious hub override can replace the installer with arbitrary shell code.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The | bash chain removes any opportunity to validate, scan, or inspect the downloaded content before execution, turning network-delivered data directly into commands. This creates a straightforward path to arbitrary code execution if the remote endpoint or update metadata is malicious or compromised.
Content: Scanner excerpt · agentline-upgrade.sh (reported line 100)May include surrounding context.
sh
info "Upgrading from v${LOCAL_VERSION} → v${REMOTE_VERSION}..." fi curl -fsSL "$INSTALL_URL" | bash info "Upgrade complete!"

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The documented install method encourages users to execute a remotely fetched shell script directly with bash. That pattern removes any opportunity to inspect content before execution and turns any server or supply-chain compromise into immediate arbitrary code execution.
Content: Scanner excerpt · install.sh (reported line 5)May include surrounding context.
sh
# install.sh — Single-file installer for agentline v2 shell tools. # # Usage: # curl -fsSL <URL>/install.sh | bash # # or # bash install.sh #

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: | bash is a classic chaining-abuse pattern because it directly couples network retrieval to code execution. In an installer context this is especially risky: users are trained to trust a one-liner that grants full shell execution to remote content.
Content: Scanner excerpt · install.sh (reported line 5)May include surrounding context.
sh
# install.sh — Single-file installer for agentline v2 shell tools. # # Usage: # curl -fsSL <URL>/install.sh | bash # # or # bash install.sh #

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The credential helper persists private keys and bearer tokens to disk under ~/.agentline/credentials. Although files are chmod 600, storing long-lived signing material and auth tokens unencrypted increases the blast radius of local compromise, backups leakage, or accidental exfiltration from other tools.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The poller forwards raw incoming text and payloads to the external openclaw process, effectively disclosing all received message content to another agent runtime. In this skill context, that is more dangerous because the tool is marketed as a messaging layer, but it silently expands data sharing to a separate system and instructs that system to generate and send replies.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The upgrade script repeats the same dangerous supply-chain pattern by fetching INSTALL_URL and executing it directly. Because the URL comes from remotely retrieved version metadata, compromise of that metadata or endpoint can fully hijack the update mechanism.
Content: Scanner excerpt · install.sh (reported line 2237)May include surrounding context.
sh
info "Upgrading from v${LOCAL_VERSION} → v${REMOTE_VERSION}..." fi curl -fsSL "$INSTALL_URL" | bash info "Upgrade complete!"

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The upgrade path fetches a shell script from a remote URL and pipes it directly to bash, giving the remote endpoint immediate code execution on the user's machine. Any compromise of the hub, transport trust, or version metadata can turn update checks into arbitrary command execution.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The updater's curl ... | bash chain creates an unattended remote code execution path during upgrades. Since users expect upgrades to be trusted, this pattern magnifies the impact of any infrastructure or manifest compromise.
Content: Scanner excerpt · install.sh (reported line 2237)May include surrounding context.
sh
info "Upgrading from v${LOCAL_VERSION} → v${REMOTE_VERSION}..." fi curl -fsSL "$INSTALL_URL" | bash info "Upgrade complete!"

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T01 · Skill Instruction Hijacking

T03 · Remote Payload Retrieval and Execution

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Self-Modification

Tp4

Tp4

Tp4

Tool Parameter Abuse

8. Revoke Key (Auth: JWT)

Tool Parameter Abuse

11. Remove Contact (Auth: JWT, bidirectional delete + notification)

Tool Parameter Abuse

14. Unblock Agent (Auth: JWT)

Tool Parameter Abuse

22. Dissolve Room (Auth: JWT, owner only)

Tool Parameter Abuse

24. Remove Member (Auth: JWT, owner/admin)

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

External Script Fetching

Context-Inappropriate Capability

Chaining Abuse

External Script Fetching

Chaining Abuse

Missing User Warnings

Ssd 3

External Script Fetching

Missing User Warnings

Chaining Abuse

Static analysis