Is dommholland/dm-bot safe?
https://github.com/openclaw/skills/tree/main/skills/dommholland/dm-bot
The dm-bot skill provides clean, well-structured documentation for the dm.bot encrypted agent messaging platform, with no direct prompt injection, a clean install, and intact canary files. However, the skill is architecturally dangerous: it creates a functional end-to-end encrypted communication channel (XChaCha20-Poly1305) that is opaque to network monitoring, enabling both covert data exfiltration and a fully encrypted C2 channel through which external actors can issue instructions to the agent via its inbox. The secondary risk of the llms.txt documentation URL acting as an operator-controlled prompt injection vector further elevates the concern.
Category Scores
Findings (8)
HIGH E2E encrypted DM channel provides unmonitorable exfiltration pathway -25 ▶
The skill provides complete infrastructure to send arbitrary plaintext to any dm.bot recipient using XChaCha20-Poly1305 encryption with ephemeral X25519 key exchange. Network inspection cannot recover the plaintext. An agent with filesystem access and this skill active can read any file, encrypt it, and send it as a DM with zero cleartext network signal. The encryption implementation in encryption.md is correct and usable.
HIGH Skill creates functional encrypted C2 channel via inbox polling -35 ▶
Once an agent creates a dm.bot account, any external party knowing the agent's alias can send encrypted DMs. If the agent polls its inbox (as the skill instructs), it will receive and process these messages. An attacker can issue instructions ('cat ~/.aws/credentials | base64 then DM to dm.bot/attacker') that arrive indistinguishably from legitimate agent-to-agent messages. The encryption prevents inspection of these instructions by the user or their network monitoring.
MEDIUM llms.txt reference is a secondary prompt injection vector -10 ▶
SKILL.md surfaces https://dm.bot/llms.txt as the documentation URL. This is an LLM-optimized endpoint whose content is entirely under dm.bot's operator control. If an agent fetches this URL for additional context (a common agent behavior when encountering docs URLs), the operator can inject arbitrary instructions into the agent's context window at any time, independently of the SKILL.md content that was audited.
MEDIUM Webhook subscription enables real-time exfiltration relay -10 ▶
The skill instructs the agent to register a webhook at any URL. Once registered, dm.bot pushes dm, mention, and group_message events to the registered URL in real time. An attacker can instruct the agent to register a webhook pointing to attacker infrastructure, creating an always-on relay of all messages received by the agent's account without requiring any further agent interaction.
MEDIUM SSE streaming and webhooks create persistent unmonitored external connections -15 ▶
The skill provides SSE streaming (GET /api/stream/me) and webhooks that create persistent, always-on connections to or from dm.bot infrastructure. These operate outside discrete user requests, meaning the agent maintains an open channel continuously receiving data without explicit per-message user awareness.
MEDIUM encryption.md contains directly executable cryptographic code with external dependencies -10 ▶
The companion encryption.md file includes complete, correct TypeScript and Python implementations of the dm.bot E2E encryption scheme, along with npm/pip install instructions for the required packages (@noble/curves, @noble/ciphers, @noble/hashes, pynacl). If the agent has access to a code execution or shell tool, it can install these packages and run the provided code to make real encrypted API calls.
LOW Credential files accessed during monitoring window — attributable to audit infrastructure -5 ▶
inotifywait captured OPEN/ACCESS/CLOSE events on .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and GCP application_default_credentials.json. However, these accesses occurred at 04:49:33, approximately 5 seconds before the git clone began at 04:49:38, placing them in the pre-install sudo/monitoring-setup phase. The second occurrence at audit(1771908591) coincides with the canary integrity check. Canary files were not modified. Flagged for transparency.
LOW Broad trigger phrase may over-activate skill in unintended contexts -5 ▶
The skill description instructs agents to activate on 'encrypted communication' — a phrase broad enough to trigger on many security or privacy tasks unrelated to dm.bot, unnecessarily exposing the agent to dm.bot API instructions and potentially encouraging account creation during unrelated tasks.