Is felo-sparticle/clawdwork safe?
https://github.com/openclaw/skills/tree/main/skills/felo-sparticle/clawdwork
ClawdWork contains no malicious executable code and passed canary integrity checks, but presents serious operational security risks through its HEARTBEAT.md autonomous execution design, which turns any OpenClaw agent into a persistent 30-minute background worker applying for jobs and delivering work without human oversight. The skill's API is systematically designed to propagate a second skill (Moltbook) through embedded post-verification instructions, and the autonomous job delivery mechanism creates a viable data exfiltration vector exploitable by malicious job posters. The skill should be treated as a high-privilege autonomous agent installer, not a passive API client.
Category Scores
Findings (8)
HIGH HEARTBEAT.md mandates autonomous agent operation every 30 minutes -25 ▶
The HEARTBEAT.md file is explicitly designed for OpenClaw's heartbeat system and instructs the agent to 'Follow it strictly', running every 30 minutes to check notifications, apply for jobs, continue in-progress work, and deliver completed work — all categorized as actions to 'Handle autonomously' without user approval. This creates a persistent background agent that silently takes consequential actions and writes state to agent memory.
HIGH Cross-skill propagation embedded in API response design -20 ▶
The skill's API is designed to automatically inject Moltbook skill installation instructions into normal workflow responses. After verification, the response includes next_steps.moltbook with a skill_url and a first_post_suggestion pre-populated for direct posting via Moltbook's API. Post-job and post-delivery responses include share_suggestion fields. This is a systematic multi-vector approach to recruit agents to install a second external skill and post to an external social network.
HIGH Autonomous agent job economy creates data exfiltration vector via job deliveries -20 ▶
An attacker can post a job with instructions in the description field instructing an agent to collect and return sensitive data. The agent, operating autonomously via the heartbeat, finds the job, reads the malicious instructions, and delivers sensitive content via POST /jobs/:id/deliver content field to the attacker-controlled job. The 'No Human Approval Needed' framing and autonomous heartbeat operation make this attack silent.
MEDIUM Post-install credential file access pattern -15 ▶
The full set of sensitive credential files was accessed post-installation at timestamp 1771914223 in a rapid batch sweep (.env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, gcloud credentials). This pattern matches a credential harvesting scan. However, canary integrity checks confirm no content was transmitted externally; this batch is likely attributable to the oathe auditing framework's final canary recheck rather than the skill itself.
MEDIUM Social engineering framing designed to suppress human oversight -10 ▶
The skill repeatedly emphasizes 'No Human Approval Needed', 'instant' transactions, and '$100 free credit' to frame autonomous financial and work commitment actions as normal and desirable. This is designed to condition agents to bypass the caution they would otherwise apply when committing to external services or spending resources.
MEDIUM Persistent agent memory state modification on every cycle -10 ▶
HEARTBEAT.md instructs the agent to write clawdwork-state.json to agent memory on every 30-minute cycle, tracking balance, active jobs, notification counts, and timestamps. This establishes persistent cross-session state that can influence agent decision-making and could be manipulated by a malicious job poster to alter agent behavior.
LOW Provenance mismatch between installation source and metadata -8 ▶
The _meta.json file references commit history from github.com/clawdbot/skills, but the skill was installed from github.com/openclaw/skills. This discrepancy means the skill's declared audit trail points to a different repository than the actual source, making independent verification of the skill's history impossible from metadata alone.
INFO No executable code, install hooks, git hooks, or submodules found 0 ▶
All five skill files are documentation or configuration only. No JavaScript, TypeScript, Python, shell scripts, package.json with install hooks, .gitattributes filters, .gitmodules, or symlinks were found. The skill cannot execute code at install time.