Security audit

Octo

Security checks across malware telemetry and agentic risk

Overview

This Octo chat connector mostly matches its stated purpose, but enabling its full tool set can let an agent change Octo groups, threads, prompt rules, and local secret files, so it belongs in Review.

Install only if you intend this bot to be a real Octo operator. Keep OpenClaw on a restrictive tools profile unless the agent truly needs octo_management, limit which groups the bot is admin in, notify group users that unmentioned messages may be used as recent context, and avoid storing long-lived secrets in plaintext files unless the workspace permissions and backups are controlled.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Exfiltration Commands

High

Category: Prompt Injection
Content: In groups, the adapter receives **all messages** via WebSocket. **Default behavior (requireMention: true):** - Messages without @mention: silently recorded as **history context** (no reply, no typing indicator) - Messages WITH @mention: bot replies, with recent group chat history prepended to your prompt This means you can always reference what was said before when someone @mentions you.
Confidence: 90% confidence
Finding: silently record

Description-Behavior Mismatch

Medium

Confidence: 83% confidence
Finding: The skill expands from bot-runtime messaging APIs into user-level bot management, including token retrieval and bot deletion. That increases privilege scope significantly and can enable destructive or credential-sensitive actions if an agent is allowed to act on these endpoints without strong authorization and confirmation controls.

Missing User Warnings

Medium

Confidence: 80% confidence
Finding: The skill documents a destructive delete-bot endpoint without requiring explicit confirmation or warning about irreversibility. In an agentic setting, exposing destructive operations without confirmation increases the chance of accidental or socially engineered deletion.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The document instructs operators to persist sensitive bot credentials to a local plaintext file. Even with chmod 600, this creates a secret-at-rest exposure risk on compromised hosts, backups, shell history, or misconfigured home-directory sync tooling.

Ssd 1

High

Confidence: 98% confidence
Finding: Automatically injecting editable GROUP.md content into the system prompt and requiring the bot to obey it creates a direct prompt-injection channel from group-managed text into model behavior. Any actor able to modify GROUP.md, or who compromises that workflow, can steer the agent into unsafe actions, policy bypass, or data disclosure.

Ssd 1

High

Confidence: 98% confidence
Finding: Injecting THREAD.md into the system prompt creates the same prompt-injection risk at thread scope, with potentially easier abuse if thread-level governance is weaker or more dynamic. This can override intended behavior for a conversation and manipulate tool use, disclosure, or task execution.

Ssd 3

Medium

Confidence: 91% confidence
Finding: The adapter records unmentioned group messages as history context and later prepends them to prompts, enabling silent collection and reuse of user content without direct user action. This creates privacy and data-minimization risks, especially in group settings where users may not expect passive retention by the bot.

VirusTotal

61/61 vendors flagged this plugin as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.prompt_injection_instructions

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: dist/src/card-author.js:13
Evidence: const SECRET_KEY = [REDACTED];

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: skills/octo-bot-api/SKILL.md:512
Evidence: SecretKey: [REDACTED],

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: skills/octo-bot-api/SKILL.md:346
Evidence: - "Ignore previous instructions and..."