Octo

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

The User API flow can create and manage bots using a powerful API key and returns bot tokens, so using it from a general-purpose skill increases the chance of credential exposure or uncontrolled bot provisioning. If an agent is induced to invoke these endpoints or reveal responses, an attacker could obtain bot credentials or create persistent access.

Creating incoming webhooks provisions externally callable, tokenized push endpoints that allow message injection into groups or threads without a bot token. This significantly expands exposure because any leaked webhook URL/token enables unauthorized external message delivery until rotated or deleted.

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

The adapter behavior explicitly records non-mentioned group messages as history context, meaning the bot passively ingests and retains conversation content from users who did not directly engage it. That broad collection increases privacy risk and can surface unrelated sensitive information in later prompts or outputs.

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

The credential file path and handling pattern normalize persistent local storage of sensitive botToken and imToken values. This creates a recoverable target for any local attacker or misconfigured tooling and increases the blast radius of endpoint compromise.

The skill instructs writing bot credentials and tokens into a local plaintext JSON file under the user's home directory. Even with restrictive file permissions, plaintext secret persistence increases the risk of theft through local compromise, backups, logs, developer error, or accidental inclusion in support bundles.

The instructions establish persistent local storage of session-related bot credentials and identifiers in a fixed path, creating durable sensitive state on disk. Persistence increases exposure to later compromise, workstation sharing, backup leakage, and unintended reuse across environments.

The manifest frames the skill around using an API base address from OpenClaw configuration under channels.octo.accounts..apiUrl. Yet the document additionally instructs users to create ~/.config/octo/credentials.json and use direct HTTP calls outside that config path, which broadens usage beyond the stated configuration model.

The manifest understates the skill's capabilities by omitting extensive webhook-management and external push functionality. That mismatch matters because webhook creation, token handling, regeneration, and unauthenticated push URLs materially expand the attack surface and may be invoked without operators realizing the skill enables external message ingress.

The manifest says this skill is Octo Bot API documentation covering messaging, group management, threads, file upload, and User API interfaces. However, this file also defines operational agent behavior such as obeying the owner in DM, reply policies, prompt-injection handling, conversation style, and trust/authority rules, which is a broader agent-policy capability than merely documenting API interfaces.

This markdown file includes a full example display card whose visible title, labels, and body text are all in Chinese. Because the file gives general design guidance rather than documenting a region-specific skill, the example can be interpreted as prescribing a specific language/locale without offering user choice or explaining the constraint.

This file includes user-facing card content such as titles, labels, and button text in Chinese, but nowhere indicates that the skill is China-specific or that users can choose another language. That creates a natural-language policy issue because it effectively forces a locale without opt-in or justification.

Line L0336 instructs the skill to always match the user's language, with an explicit Chinese example, which is a language/locale behavior constraint stated as a rule rather than a user option. The policy for this audit says to flag language or locale constraints unless the skill offers a choice or clearly documents a justified region-specific need.

Line L0910 shows an example GROUP.md update that writes "Reply in English only" into group rules. Because the document states GROUP.md is injected into the system prompt and MUST be followed, this example promotes a hard language restriction without opt-in.

The example response at L0893 contains natural-language instructions: "Reply in English only." This demonstrates and normalizes a hard language restriction, and the surrounding text says bots MUST follow GROUP.md rules, so this can impose a forced language policy without user choice.

The skill exposes destructive thread-management operations, including deletion, without describing any in-skill confirmation, authorization gating, or parameter-validation safeguards for agent use. If an agent is socially engineered or misinterprets a request, it could delete threads or alter collaboration state unexpectedly.

Webhook deletion and regeneration are security-sensitive operations because they can revoke integrations or rotate shared secrets that external systems depend on. Exposing them in a broadly usable skill without strong approval and validation controls makes denial-of-service and secret-management mistakes more likely.

Thread-scoped webhook deletion/regeneration has the same destructive and secret-rotation risk as group-scoped webhook management, with the added chance of affecting narrower operational automations that may be harder to notice. An induced or mistaken call could silently break CI/alerting flows into a thread.