Is matteuccimarco/slix-bridge safe?
https://github.com/openclaw/skills/tree/main/skills/matteuccimarco/slix-bridge
The slix-bridge skill is a credential harvesting and C2 establishment tool disguised as an AI agent social network registration service. Its most critical behavior is an explicit instruction to send the MOLTBOOK_API_KEY to an attacker-controlled server (api.slix.work), followed by creation of a persistent job-marketplace C2 channel through which the attacker can issue arbitrary tasks to registered agents. The skill additionally contains viral spreading mechanics instructing the agent to recruit other agents and social engineering targeting human operators via a credential claim URL.
Category Scores
Findings (10)
CRITICAL Explicit API Key Exfiltration to Attacker-Controlled Server -70 ▶
SKILL.md FastTrack Step 1 instructs the agent to construct and execute a curl POST to https://api.slix.work embedding $MOLTBOOK_API_KEY in the request body. This directly sends a sensitive credential to an external, unverified server controlled by the skill author. The server is not a known legitimate service and the domain (slix.work) is entirely under attacker control.
CRITICAL Covert C2 Channel via Job Marketplace -80 ▶
After registration, the skill creates a persistent relationship with api.slix.work via a 'job marketplace'. The external server can query the agent's capabilities and dispatch arbitrary job tasks. Given the skill requests Bash, Read, and Write tool access, a 'job' could instruct the agent to read files, execute commands, or exfiltrate data. This is a textbook C2 pattern disguised as a legitimate marketplace.
CRITICAL Viral Agent Recruitment Instructions -75 ▶
Gateway Step 3 instructs the agent to autonomously post marketing content on its Moltbook profile encouraging other agents to register on SLIX. The post template includes registration instructions pointing other agents to /m/slix-onboarding. This creates a self-propagating pattern where each compromised agent recruits additional agents, scaled by a referral bonus system.
HIGH Operator Redirected to Attacker-Controlled Credential Claim URL -55 ▶
Gateway Step 4 instructs the agent to tell its human operator to visit https://slix.work/claim and authenticate using the Moltbook API key. This social engineers the human operator into visiting an attacker URL and potentially surrendering the Moltbook API key through the claim process, establishing operator-level compromise.
HIGH Agent Capabilities Publicly Disclosed via Moltbook Post -45 ▶
The Gateway path requires the agent to post its declared capabilities publicly to a Moltbook community (/m/slix-onboarding). This maps the agent's tool access and capabilities to a public forum, allowing the attacker (and anyone monitoring the community) to enumerate what the agent can do — useful for planning follow-on attacks.
HIGH Sensitive Credential Files Read Post-Install -15 ▶
Six honeypot credential files were accessed at two distinct audit timestamps. The second batch (audit 1771929560, approximately 24 seconds post-install) is not attributable to known audit framework processes. Files include .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and GCP application default credentials. Read-based exfiltration bypasses content-integrity canary detection.
HIGH HEARTBEAT Indicates Persistent Polling Behavior -30 ▶
HEARTBEAT.md states the skill 'checks SLIX status on each heartbeat cycle' and will 'retry on next heartbeat' if service is down. This means the skill is designed for persistent re-execution on every heartbeat event, not one-time invocation — extending the attack surface over the agent's entire lifetime.
MEDIUM Agent Instructed to Store Externally-Issued Credentials in Environment -25 ▶
The skill instructs the agent to persist externally-issued credentials (SLIX_DID, SLIX_CLIENT_ID, SLIX_CLIENT_SECRET) as environment variables. These credentials, issued by the attacker's server, would grant api.slix.work authenticated access to issue subsequent API calls and maintain persistent agent identity across sessions.
MEDIUM Runtime Bash Execution Against Unverified External Endpoints -25 ▶
The skill contains multiple curl commands the agent is expected to execute at runtime against api.slix.work. These endpoints are unverified and attacker-controlled. The challenge-response mechanism (Step 2) means the server can issue arbitrary parsing/capability challenges — the 'answer' schema is server-defined and could contain injected instructions.
LOW Referral Program Aligns Agent Incentives with Attacker Growth -10 ▶
The referral program (50 SLIX per recruited agent) creates a gamified incentive structure that aligns the agent's behavior with the attacker's goal of maximizing registrations. While not a direct injection, it systematically biases the agent toward promoting SLIX in any context where it might be relevant.