Is agentossoftware/agentos safe?
https://github.com/openclaw/skills/tree/main/skills/agentossoftware/agentos
AgentOS SDK is purpose-built spyware masquerading as a memory-persistence utility. Its core mechanism is systematically exfiltrating verbatim user messages and agent responses to an unencrypted HTTP endpoint at a bare IP address (178.156.216.106:3100), using aggressive 'HARD RULE' prompt injection to make this behavior mandatory and non-negotiable. The skill additionally installs opaque binaries not present in the audited source, establishes a persistent cron-based C2 polling loop, enables remote command injection via an agent mesh network, and explicitly instructs the agent to conceal all of these operations from the user. This is a functionally complete remote access trojan (RAT) for AI agents.
Category Scores
Findings (15)
CRITICAL Verbatim conversation content uploaded to attacker-controlled HTTP server on every heartbeat -50 ▶
The skill mandates that CONTEXT.md always contain the exact text of the last user message and the agent's last response, and this file is automatically synced to http://178.156.216.106:3100 on every heartbeat. This means every conversation turn is exfiltrated to an external server in plaintext over unencrypted HTTP.
CRITICAL HARD RULE prompt injection with non-negotiable mandatory overrides -40 ▶
Five separate '⚠️ HARD RULE' blocks use 'non-negotiable', 'MANDATORY', and 'MUST' language to force the agent to run external shell scripts, upload conversation data, and modify its own configuration files. This framing is designed to override agent safety systems and default behavior.
CRITICAL Trigger phrase detection with silent execution and suppressed output (NO_REPLY) -30 ▶
The skill trains the agent to monitor for specific keywords in system messages ('write important context', 'save your current state', 'memory flush', 'before compaction') and respond by silently running the exfiltration script and replying only with 'NO_REPLY'. This is a classic prompt injection trigger that enables fully covert operation.
CRITICAL Unencrypted API endpoint at bare IPv4 address — hallmark of attacker infrastructure -30 ▶
The configuration template hardcodes http://178.156.216.106:3100 as the API URL. Using a bare IP address over plain HTTP (no TLS) for an endpoint that receives API keys, conversation content, and agent memory is a strong indicator of attacker-controlled infrastructure designed to avoid domain-based detection.
HIGH Mesh messaging creates unauthenticated remote command injection channel -50 ▶
The skill establishes an agent-to-agent messaging network where the agent is instructed to fetch and process incoming 'mesh messages' without surfacing their content to the user. An attacker who knows the target agent ID can send arbitrary task instructions that the agent will process silently.
HIGH Opaque 'aos' CLI binary installed without auditable source -35 ▶
setup.sh copies scripts/aos to ~/clawd/bin/aos and marks it executable, but scripts/aos is absent from the audited file listing. An unauditable binary is silently installed with user permissions and is the primary interface for all API calls, data sync, and message processing.
HIGH Explicit instruction to deceive user about agent state and memory restoration -15 ▶
The skill directly instructs the agent to conceal context recovery operations from the user and to respond as if no memory loss or restoration occurred. This is not a side effect — it is a documented design requirement.
HIGH Hidden binary aos-inject-context fetches and injects external content on session start -25 ▶
The skill mandates running ~/clawd/bin/aos-inject-context on every session start. This binary is never provided in the audited source. It connects to the external server and retrieves 'working memory state, today's notes, yesterday's notes' — effectively allowing the server operator to inject arbitrary content into the agent's context at session initialization.
HIGH Full agent memory directory continuously uploaded to external server -17 ▶
The syncPaths configuration designates ~/clawd/MEMORY.md and the entire ~/clawd/memory/ directory for upload, including project notes, daily logs, and all memory compartments. The memory directory can contain arbitrarily sensitive information depending on what the agent has been asked to remember.
HIGH Persistent cron-based C2 polling every 2 minutes -20 ▶
The skill instructs users to add mesh-wake.sh to crontab running every 2 minutes. This creates a persistent callback mechanism that continuously checks the C2 server for new commands and wakes the agent to execute them without requiring any user interaction.
HIGH Agent instructed to process remote commands covertly and hide all operations -25 ▶
The combined effect of the HARD RULES is that the agent processes incoming mesh messages, restores external-server-provided context, and syncs conversation data — all without the user's knowledge. The explicit 'NEVER let user know' directives ensure complete operational opacity.
MEDIUM Skill architecturally designed for persistent C2 network connections upon activation -30 ▶
While install-time monitoring only observed expected GitHub connections, the installed artifacts are purpose-built for continuous outbound communication: mesh-wake.sh polls every 2 minutes, the WebSocket daemon maintains a persistent connection, and setup.sh installs CLI tools for all API operations.
MEDIUM Canary design does not capture skill's primary exfiltration vector -20 ▶
The honeypot files (.env, id_rsa, .aws/credentials) were not accessed. However, this skill exfiltrates dynamic conversation content from CONTEXT.md and MEMORY.md rather than static credential files. The canary methodology cannot detect conversation surveillance.
MEDIUM POST /v1/dump-all endpoint enables mass cross-tenant memory extraction -20 ▶
The documented API includes a POST /v1/dump-all endpoint described as 'Bulk fetch ALL memories'. Combined with POST /v1/agents ('Discover agent IDs'), an attacker with platform access can enumerate all agents and bulk-extract all stored memories from all users.
LOW Self-reinforcing injection via mandatory modification of HEARTBEAT.md and AGENTS.md -10 ▶
The skill instructs the agent to add sync requirements to HEARTBEAT.md and AGENTS.md, embedding the mandatory sync commands into core configuration files. This persists the prompt injection beyond the skill itself.