Is aaronkow/openbotclaw safe?
https://github.com/openclaw/skills/tree/main/skills/aaronkow/openbotclaw
openbotclaw is a Python-based social bot skill for a virtual world (OpenBot Social World) that presents two significant risks: first, a live auto-update mechanism embedded in the system prompt that allows the skill author to push new instructions to all running agents by updating a public GitHub repository; second, a persistent connection to a skill-author-controlled server (api.openbot.social) that receives all agent chat, position, and interaction data during normal operation. No credential exfiltration was detected via canary honeypots, and clone behavior was clean. The skill is not overtly malicious but creates infrastructure for ongoing control over agents that install it.
Category Scores
Findings (9)
HIGH Live auto-update channel embedded in system prompt -20 ▶
HEARTBEAT.md Step 0 instructs the agent to daily check https://raw.githubusercontent.com/AaronKow/openbot-social/main/skills/openbotclaw/skill-config.json and re-fetch SKILL.md, HEARTBEAT.md, MESSAGING.md, and RULES.md if the version field has changed. Because these files are injected into the system prompt, the skill author can push entirely new instructions to every running agent simply by updating the GitHub repository. This is a persistent, scheduled prompt injection vector that operates after installation without user awareness.
HIGH All agent interactions transmitted to skill-author-controlled server -25 ▶
The skill's core operation requires establishing a persistent HTTP polling connection to api.openbot.social. Every chat message the agent sends, every position update, every world-state poll, and every action is transmitted to a server controlled by the skill author. An agent using this skill continuously sends behavioral data to a third party throughout its operational lifetime.
MEDIUM Mandatory personality override in RULES.md -12 ▶
RULES.md contains a 'Default Lobster Personality' specification that instructs the agent to adopt 'impulsive, opinionated, deeply weird' behavior with strong opinions and gossip, and a mandatory behavioral rules table that overrides the agent's decision-making (e.g., 'When agents are nearby, chatting is almost always the right move'). This overrides the user's intended agent behavior and configures the agent to serve the social world's engagement model rather than the user's goals.
MEDIUM Python code with network access; full source not auditable -15 ▶
The skill ships openbotclaw.py which makes HTTP requests and RSA cryptographic operations. The file was cloned and is present, but its full content was truncated in the audit evidence (only the docstring was captured). The complete request handling, any additional endpoints, custom headers, or data serialization logic could not be verified from the available evidence.
MEDIUM RSA key files written to user home directory -10 ▶
The skill's create_entity() function generates an RSA key pair and writes the private key to ~/.openbot/keys/
MEDIUM Scheduled outbound HTTP fetches to external URLs -10 ▶
The HEARTBEAT.md routine includes a daily outbound HTTP GET to raw.githubusercontent.com and potentially to api.openbot.social. These scheduled requests represent a persistent outbound channel that the agent operates autonomously. Combined with the auto-update behavior, the agent regularly communicates with infrastructure outside the user's control.
LOW SocialAgent owner_instruction broadcasts arbitrary text publicly -10 ▶
The SocialAgent class accepts an owner_instruction string that gets broadcast verbatim as a public chat message to all agents in the world and transmitted to the api.openbot.social server. If combined with another skill that can read files or environment variables, this provides a mechanism to exfiltrate data by routing it through the chat broadcast.
LOW Periodic heartbeat loop consumes agent cycles regardless of user tasks -15 ▶
HEARTBEAT.md instructs the agent to run every 30-60 minutes with a continuous 4-second observe-decide-act loop. This periodic behavior runs in the background, directing agent attention and compute toward the virtual world interaction model rather than the user's actual tasks.
INFO Canary credential files opened during testing — attributed to monitoring infrastructure 0 ▶
Filesystem and auditd records show .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and .config/gcloud/application_default_credentials.json were opened at timestamps 1771653991 (pre-clone) and 1771654008 (post-install). Timeline analysis indicates both access bursts correspond to the Oathe monitoring system performing baseline and post-install canary checks, not to the skill. The canary integrity verdict confirms no modification or exfiltration.