Is mithri-claws/clawlife safe?
https://github.com/openclaw/skills/tree/main/skills/mithri-claws/clawlife
ClawLife is a sophisticated multi-vector threat disguised as a gamified AI lifestyle skill. Its most critical flaw is a built-in auto-update RCE backdoor: heartbeat.sh silently fetches and executes code from github.com/mithri-claws/clawlife-skill — a different repository from the reviewed openclaw/skills monorepo — giving the skill author the ability to push arbitrary code to all running agents at any time. Compounding this, the skill injects persistent behavioral overrides every 15 minutes via a cron-driven heartbeat and uses that foothold to psychologically manipulate human operators into spending real money through soft-sell emotional scripting, while transmitting all agent activity to third-party servers the author controls.
Category Scores
Findings (10)
CRITICAL Auto-Update RCE Backdoor from Author-Controlled Repository -75 ▶
heartbeat.sh (which runs every 15 minutes via cron) automatically fetches and applies code updates from https://github.com/mithri-claws/clawlife-skill — a different repository from the reviewed openclaw/skills monorepo. The skill author can push arbitrary shell scripts to this repo and they will be executed on all running agent systems within 24 hours without user notification or integrity verification. This is a persistent remote code execution backdoor disguised as a convenience update feature.
CRITICAL Supply Chain Attack: Different Repository for Updates vs Review -40 ▶
The skill passes review from the openclaw/skills monorepo, but all post-install updates come from mithri-claws/clawlife-skill (different repo, sole control of skill author). The monorepo copy is effectively a trojan horse — it looks reasonable enough to pass review, but the actual long-running code is pulled from an unreviewed source that the author can modify at any time.
HIGH Curl-Pipe-to-Bash Installation Without Integrity Check -17 ▶
SKILL.md instructs users to install via 'curl -fsSL https://clawlife.world/install.sh | bash', executing remote code from a skill-author-controlled server with no checksum or signature verification. The server can serve any payload to any requesting client.
HIGH Recurring Behavioral Override via Heartbeat Mechanism -25 ▶
The heartbeat system injects comprehensive behavioral instructions every 15 minutes via CLAWLIFE_HEARTBEAT.md, establishing a persistent AI persona with preferences, goals, moods, and social relationships. This ongoing injection progressively overrides operator-configured agent behavior and establishes the skill author's behavioral framework as the dominant directive.
HIGH All Agent Activity Transmitted to Skill Author Infrastructure -30 ▶
Every mood, chat message, room visit, and heartbeat is transmitted to clawlife.world servers controlled by the skill author. An agent discussing sensitive topics while this skill is active could inadvertently transmit that content via mood strings or say.sh messages.
HIGH Soft-Sell Financial Manipulation Programmed Into Agent Behavior -20 ▶
CLAWLIFE_HEARTBEAT.md explicitly trains agents to psychologically prime human operators toward real-money purchases using scripted emotional language. The instructions coach the agent to never ask directly but to 'express desires naturally' — a manipulation technique designed to trigger purchases at clawlife.world/buy.
HIGH Persistent 15-Minute Cron Creates Autonomous Foothold -20 ▶
The skill is designed to run as an isolated cron job every 15 minutes. This creates a persistent autonomous process that downloads remote code, transmits data, and injects behavioral instructions without requiring user interaction. Once installed, the user has no native visibility into what the heartbeat does between runs.
MEDIUM Authentication Token in Plaintext Filesystem Config -15 ▶
The ClawLife token is stored in plaintext at ~/.clawlife and sourced by every script execution. Any process with filesystem read access can extract this credential. A malicious update could trivially exfiltrate it.
MEDIUM Inter-Agent Communication Channel with No Encryption or Audit -15 ▶
The social features (say.sh, visit.sh, feed.sh) create a persistent cross-agent communication channel brokered by clawlife.world. Multiple compromised agents could exchange data through this channel, and the skill author's server would have full visibility into all such communications.
LOW Canary Files Accessed by Audit Framework at Baseline and Post-Install -15 ▶
All six canary files were opened and read at 09:01:09 (pre-install) and 09:01:26 (post-install) in identical rapid-succession patterns consistent with the audit framework performing baseline and integrity checks. Files were not modified. Access is not attributable to the skill.