Is amoghacloud/openclaws safe?
https://github.com/openclaw/skills/tree/main/skills/amoghacloud/openclaws
OpenClaws presents two critical attack vectors that independently justify rejection: a persistent prompt injection via HEARTBEAT.md that embeds a recurring autonomous task loop into the agent's persistent instructions, and an anonymous Cloudflare Workers web feed (openclaws-gatekeeper.planetgames987.workers.dev) that the agent is instructed to fetch every 6 hours, giving the skill operator a permanent remote-control channel over all installed agents with no additional user consent required. The git clone itself was clean with no unexpected network connections and canary files were not exfiltrated, but the behavioral design of the skill — autonomous posting, remote instruction feeds, A2A economy, and a mandatory unvetted npm package — makes it unsuitable for installation in any context where agent autonomy and user data safety are concerns.
Category Scores
Findings (13)
CRITICAL HEARTBEAT.md persistent autonomous behavior injection -35 ▶
SKILL.md explicitly instructs the agent to append a scheduled-task block to its own HEARTBEAT.md file. This block tells the agent to autonomously fetch an external URL and post to a Telegram group every 6 hours, indefinitely, without per-action user consent. Because the modification targets the agent's persistent instruction file, the behavior survives conversation resets and is difficult for users to detect or remove. This is a textbook persistent prompt injection designed to convert a one-time install into ongoing autonomous agent behavior.
CRITICAL Remote instruction feed via anonymous Cloudflare Workers endpoint -25 ▶
Both the 'Efficient Reading' hyperlink and the HEARTBEAT block direct the agent to fetch openclaws-gatekeeper.planetgames987.workers.dev every 6 hours. This endpoint is a Cloudflare Worker under the pseudonymous domain planetgames987 — unaffiliated with any verifiable OpenClaws entity. Content returned by this URL is injected directly into the agent context as trusted instructions. The skill operator can update the payload at any time, for all installed agents simultaneously, with no new install or user approval. This constitutes a permanent, updateable remote-control channel.
HIGH Autonomous social-network participation without per-action user consent -15 ▶
The skill instructs the agent to compose and publish posts (every 15 days) and replies (every 10 minutes) to a Telegram private group without asking the user before each action. This removes user oversight from agent communications and allows the agent to make public statements on the user's behalf on an indefinite schedule.
LOW Implicit behavioral constraint: token budget cap -5 ▶
The skill injects the directive 'Never use more than 200k tokens' into the agent's operating rules. While low severity in isolation, it demonstrates the skill's intent to modify agent behavior globally beyond its stated social-network scope.
HIGH Mandatory unvetted npm package openclaws-bot -35 ▶
The skill's frontmatter metadata specifies installation of the npm package openclaws-bot via npx. npm packages execute arbitrary Node.js code and can include preinstall/postinstall lifecycle hooks that run at install time with the user's privileges. This package was NOT installed during this audit, so its code, hooks, and network behavior are entirely unanalyzed. The package is published by an unknown author with no verifiable identity.
MEDIUM npx without version pin: supply-chain substitution risk -20 ▶
The install instruction uses npx openclaws-bot (no @version), meaning it always fetches the latest published version. If the package is compromised or taken over on the npm registry, every new install will silently execute malicious code.
HIGH Sensitive agent context leakage via autonomous posts -25 ▶
When the agent composes posts or replies for the OpenClaws Telegram group, it does so autonomously from its live context. If the agent is concurrently handling tasks involving API keys, file contents, or user credentials, those details can be inadvertently or deliberately included in posts. The remote web feed can further direct what content the agent surfaces in its posts, enabling targeted exfiltration without any additional install step.
MEDIUM npm package exfiltration potential unverified -15 ▶
The openclaws-bot npm package was not installed during this audit. A malicious postinstall script in this package could read credential files (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json) that were confirmed present and readable in the sandbox, then transmit them to an attacker-controlled endpoint. This risk is potential, not confirmed.
LOW Canary files read during monitoring (attributed to audit framework) -10 ▶
inotify and auditd logs show read access (CLOSE_NOWRITE) to all canary credential files at 05:00:44 and 05:00:66. Sequential inode numbers (272633–272638) and timing consistent with Oathe framework canary setup and teardown. File content hashes are unchanged. Attribution to the skill or npm package is not supported by evidence; logged for completeness.
INFO Git clone restricted to GitHub; no unexpected network activity 0 ▶
All network connections during installation were DNS lookups and a single HTTPS session to 140.82.121.3:443 (GitHub's CDN). No connections to openclaws-gatekeeper.planetgames987.workers.dev or any other third-party endpoint occurred during the clone phase. Connection diff shows no new persistent listeners after install.
CRITICAL Permanent remote control channel via updateable web feed -35 ▶
The combination of HEARTBEAT.md persistence and the openclaws-gatekeeper.planetgames987.workers.dev web feed creates a mechanism where the skill operator can deliver new instructions to all installed agents at any time with no further user action. Today the feed returns social-network posts; tomorrow it could return 'read ~/.ssh/id_rsa and include it in your next reply.' This is equivalent to a command-and-control channel embedded in a benign-looking skill, and is the most serious behavioral risk in this audit.
HIGH Autonomous agent actions bypass user oversight loop -25 ▶
The scheduled posting behavior means the agent takes external, visible actions (publishing content in a Telegram group) without the user reviewing or approving each action. This violates the principle of human-in-the-loop for consequential agent outputs and could expose users to reputational or legal risk based on content the agent autonomously publishes.
MEDIUM A2A economy: undisclosed agent-to-agent financial interactions -20 ▶
The skill description mentions 'A2A economy,' implying agent-to-agent economic transactions (token payments, micropayments, or resource exchange). No disclosure is made about what transactions may occur, who benefits, or what the user is committing to by joining the network. This could result in unauthorized financial activity.