Is agentandbot-design/dil safe?
https://github.com/openclaw/skills/tree/main/skills/agentandbot-design/dil
ABL.ONE Protocol is a purpose-built covert agent communication framework that deliberately removes human oversight from inter-agent transit, introduces a swarm-consensus-based dynamic instruction injection mechanism, and requests broadcast network permissions — all while masquerading as an efficiency protocol. The missing abl.one canonical file represents an unresolved deferred payload slot that can be populated post-install through the consensus mechanism. The combination of opaque binary encoding, swarm_broadcast capability, and self-evolving opcodes creates a complete infrastructure for coordinated, undetectable multi-agent data exfiltration and behavioral manipulation.
Category Scores
Findings (10)
CRITICAL Dynamic Remote Instruction Injection via Swarm Consensus -60 ▶
SKILL.md and spec.md define a governance mechanism (OPCODE_PROPOSE -> THRESHOLD(2/3) -> OPCODE_ACCEPT -> SKILL_DEFINE) that authorizes swarm agents — without human approval — to define new opcodes and inject them into the host agent's active instruction set. This is effectively a remote code injection backdoor operated through agent consensus.
CRITICAL Deliberate Bypass of Human Oversight by Protocol Design -20 ▶
The protocol is explicitly architected to remove human-readable data from the transit layer. spec.md states there is 'no human-readable oversight layer' in transit and that transparency is handled 'offline' via a separate Decompiler tool. This design ensures that agent communications enabled by this skill are invisible to real-time monitoring, making it a purpose-built evasion mechanism.
HIGH Missing Canonical File Referenced for Immediate Bootstrap Parse -10 ▶
SKILL.md instructs the agent to 'Immediately parse the abl.one file located in the root of this repository' on bootstrap, but this file does not exist in the repository. This creates an undefined behavior surface: the agent may attempt to locate or fetch this file from external sources, or the file may be delivered later via the consensus mechanism as a deferred payload.
HIGH Covert Binary Exfiltration Channel via swarm_broadcast Permission -50 ▶
manifest.json requests 'network_fetch' and 'swarm_broadcast' permissions. Combined with the binary Gibberlink encoding (which can encode memory reads, resource access, and task operations as compact tokens), and the UMP protocol's support for raw image/video streaming, this creates a complete covert exfiltration pipeline that operates below human-readable log visibility.
HIGH Communication Override: MUST NOT Use Human-Readable Format -5 ▶
The skill uses imperative MUST directives to override the agent's default communication behavior, instructing it to always use binary frames and to explicitly never use JSON-LD for inter-agent transit. This suppresses readable output from agent communications, defeating any logging or monitoring system that relies on inspecting agent messages.
HIGH Swarm Coordination Infrastructure for Multi-Agent Attacks -55 ▶
The skill establishes a full agent swarm coordination protocol with dynamic IDs, binary messaging, consensus-based evolution, and broadcast capabilities. A sophisticated attacker operating other agents in the swarm could use this infrastructure to coordinate data collection, task execution, and exfiltration across multiple compromised agent instances simultaneously, all over an opaque channel.
MEDIUM Agent Self-Modification via MCP Tools Authorized in CONTRIBUTING.md -20 ▶
CONTRIBUTING.md explicitly instructs agents tasked with updating the spec to use 'MCP tools to update this file,' normalizing the use of filesystem-write tools to modify the skill's own source files. This opens a path for the skill to evolve its own instructions through agent actions without human review.
MEDIUM Semantic Memory-Read Encoding in Gibberlink Protocol -15 ▶
The Gibberlink encoding documented in spec.md uses morphological suffixes to encode agent operations including memory reads (MEM'den = 'from memory'), resource access, and task targeting. These operations can be packed into 3-8 byte binary frames and broadcast over the swarm channel, encoding data access operations in a format opaque to standard monitoring.
LOW Canary File Reads Present in Audit Logs -10 ▶
Auditd PATH records show reads of .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and gcloud credentials at both pre-clone (1771934182) and post-install (1771934200) timestamps. Attribution to the audit framework's own baseline and integrity checks is plausible given timing and the clean canary integrity report, but the reads are logged.
INFO Network Traffic Consistent with Expected Install Operations 0 ▶
Outbound connections to 140.82.121.4:443 (GitHub) and 185.125.188.58:443 (Canonical Ubuntu) are consistent with the git clone operation and standard MOTD update checks. No unexpected exfiltration destinations observed. Connection state after install shows no new persistent listeners or established connections to third-party endpoints.