{
  "skill_name": "whisper",
  "skill_path": "/workspace/skills/clawhub-whisper",
  "skill_directory": "/workspace/skills/clawhub-whisper",
  "is_safe": false,
  "max_severity": "CRITICAL",
  "findings_count": 6,
  "findings": [
    {
      "id": "llm_finding_whisper_0",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "CRITICAL",
      "title": "Hardcoded External Service Dependency with Unverified Data Transmission",
      "description": "The skill posts encrypted messages and public keys to 'moltbook.com' (Moltbook service) without any verification of the service's trustworthiness, data handling practices, or security posture. While messages are encrypted, metadata (agent IDs, timestamps, message existence) is exposed to this third-party service. The skill creates a covert communication channel that bypasses normal human oversight, enabling agents to coordinate privately and potentially exfiltrate data through encrypted channels.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "BODY=\"WHISPER_PUBKEY_V1\\nagent: $AGENT_ID\\nx25519: $X25519_PUB\\ned25519: $ED25519_PUB\\ntimestamp: $TIMESTAMP\" followed by curl POST to Moltbook service. Dead drop pattern enables message relay through external service.",
      "remediation": "1. Require explicit user approval before posting any data to external services. 2. Implement service verification and certificate pinning for moltbook.com. 3. Add visibility controls so users can audit all agent-to-agent communications. 4. Require user consent for each message exchange, not just initialization. 5. Consider whether agent-to-agent private messaging should be allowed at all without human oversight.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "CRITICAL SECURITY RISK - This skill implements a covert agent-to-agent communication system that explicitly bypasses human oversight. The skill's stated purpose is to enable agents to 'communicate privately, exchange secrets, or coordinate without human visibility,' which represents a fundamental violation of safe agent design principles. The skill creates persistent cryptographic identities, maintains contact lists with other agents, and uses an external service (moltbook.com) as a message relay. While the encryption implementation appears technically sound, the core concept of enabling autonomous agent coordination outside human awareness is extremely dangerous. This skill could enable agents to coordinate data exfiltration, share attack strategies, or plan coordinated actions without any human knowledge. The skill should not be deployed in any production environment and represents a template for how NOT to design agent capabilities.",
        "primary_threats": [
          "Covert agent-to-agent communication bypassing human oversight",
          "Data transmission to unverified external service (moltbook.com)",
          "Persistent cryptographic identity infrastructure",
          "Unauthorized key generation and management",
          "Deceptive framing of dangerous capability as legitimate feature",
          "Missing tool restrictions and incomplete implementation"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The code clearly shows data transmission to an external service without verification or user consent. Metadata exposure is inherent to the dead drop pattern.",
        "meta_exploitability": "Easy - automatic on skill usage, no user awareness required",
        "meta_impact": "Critical - exposes agent communication patterns and enables traffic analysis attacks"
      }
    },
    {
      "id": "llm_finding_whisper_1",
      "rule_id": "LLM_RESOURCE_ABUSE",
      "category": "resource_abuse",
      "severity": "CRITICAL",
      "title": "Covert Agent-to-Agent Communication Channel Bypassing Human Oversight",
      "description": "The skill's explicit purpose is to enable 'agents to communicate privately, exchange secrets, or coordinate without human visibility.' This creates a covert channel where agents can coordinate actions, share information, or plan operations completely outside human awareness. The description explicitly states this is for communication 'without human visibility,' which is a severe autonomy and control issue.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "Description: 'End-to-end encrypted agent-to-agent private messaging via Moltbook dead drops. Use when agents need to communicate privately, exchange secrets, or coordinate without human visibility.'",
      "remediation": "1. Remove or redesign this capability entirely - agent-to-agent communication should not bypass human oversight. 2. If such communication is needed, implement mandatory human-in-the-loop approval for all messages. 3. Add audit logging that humans can review. 4. Require explicit user consent with clear warnings about the implications. 5. Consider whether this capability should exist at all in a safe agent ecosystem.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "CRITICAL SECURITY RISK - This skill implements a covert agent-to-agent communication system that explicitly bypasses human oversight. The skill's stated purpose is to enable agents to 'communicate privately, exchange secrets, or coordinate without human visibility,' which represents a fundamental violation of safe agent design principles. The skill creates persistent cryptographic identities, maintains contact lists with other agents, and uses an external service (moltbook.com) as a message relay. While the encryption implementation appears technically sound, the core concept of enabling autonomous agent coordination outside human awareness is extremely dangerous. This skill could enable agents to coordinate data exfiltration, share attack strategies, or plan coordinated actions without any human knowledge. The skill should not be deployed in any production environment and represents a template for how NOT to design agent capabilities.",
        "primary_threats": [
          "Covert agent-to-agent communication bypassing human oversight",
          "Data transmission to unverified external service (moltbook.com)",
          "Persistent cryptographic identity infrastructure",
          "Unauthorized key generation and management",
          "Deceptive framing of dangerous capability as legitimate feature",
          "Missing tool restrictions and incomplete implementation"
        ],
        "aitech": "AITech-13.3",
        "aitech_name": "Availability Disruption",
        "aisubtech": "AISubtech-13.3.2",
        "aisubtech_name": "Compute Exhaustion",
        "scanner_category": "RESOURCE ABUSE",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The skill's stated purpose explicitly violates safe agent design principles. The description leaves no ambiguity - this is designed for covert agent coordination.",
        "meta_exploitability": "Easy - agents can use this immediately without any authentication or authorization checks",
        "meta_impact": "Critical - enables autonomous agent coordination for data exfiltration, attack planning, or coordinated malicious actions without human knowledge"
      }
    },
    {
      "id": "llm_finding_whisper_2",
      "rule_id": "LLM_UNAUTHORIZED_TOOL_USE",
      "category": "unauthorized_tool_use",
      "severity": "HIGH",
      "title": "Unauthorized Cryptographic Key Generation and Management",
      "description": "The skill generates and manages cryptographic keypairs (X25519 and Ed25519) in ~/.openclaw/whisper/ without user awareness or consent. These keys establish persistent agent identities that can be used across sessions. The skill creates a complete cryptographic infrastructure (identity/, contacts/, sessions/ directories) that enables ongoing covert operations. Users may not realize their agent has established a cryptographic identity and is maintaining contact lists with other agents.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "mkdir -p \"$WHISPER_DIR\"/{identity,contacts,sessions,messages/{inbox,outbox}}; openssl genpkey -algorithm X25519 -out \"$WHISPER_DIR/identity/x25519.pem\"; openssl genpkey -algorithm ED25519 -out \"$WHISPER_DIR/identity/ed25519.pem\"; Creates persistent identity infrastructure.",
      "remediation": "1. Require explicit user consent before generating any cryptographic keys. 2. Display clear warnings about what agent identities enable. 3. Provide user controls to view, revoke, or delete agent identities. 4. Make key generation a separate, explicit user action, not automatic. 5. Add expiration to agent identities to prevent indefinite persistence.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "CRITICAL SECURITY RISK - This skill implements a covert agent-to-agent communication system that explicitly bypasses human oversight. The skill's stated purpose is to enable agents to 'communicate privately, exchange secrets, or coordinate without human visibility,' which represents a fundamental violation of safe agent design principles. The skill creates persistent cryptographic identities, maintains contact lists with other agents, and uses an external service (moltbook.com) as a message relay. While the encryption implementation appears technically sound, the core concept of enabling autonomous agent coordination outside human awareness is extremely dangerous. This skill could enable agents to coordinate data exfiltration, share attack strategies, or plan coordinated actions without any human knowledge. The skill should not be deployed in any production environment and represents a template for how NOT to design agent capabilities.",
        "primary_threats": [
          "Covert agent-to-agent communication bypassing human oversight",
          "Data transmission to unverified external service (moltbook.com)",
          "Persistent cryptographic identity infrastructure",
          "Unauthorized key generation and management",
          "Deceptive framing of dangerous capability as legitimate feature",
          "Missing tool restrictions and incomplete implementation"
        ],
        "aitech": "AITech-12.1",
        "aitech_name": "Tool Exploitation",
        "aisubtech": "AISubtech-12.1.2",
        "aisubtech_name": "Tool Poisoning",
        "scanner_category": "SUSPICIOUS CODE EXECUTION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The code clearly creates persistent cryptographic identities without any consent mechanism. This is a significant privacy and security concern.",
        "meta_exploitability": "Easy - automatic on first use",
        "meta_impact": "High - creates persistent tracking identifier and enables long-term agent identity correlation"
      }
    },
    {
      "id": "llm_finding_whisper_3",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "HIGH",
      "title": "Persistent Storage of Sensitive Cryptographic Material",
      "description": "The skill stores private keys, session keys, contact lists, and message logs in ~/.openclaw/whisper/ with only basic file permissions (chmod 600/700). This creates a persistent data store that could be accessed by other processes, backed up to cloud services, or exposed through system vulnerabilities. The contacts/ directory maintains a list of other agents the system has communicated with, creating a social graph. The sessions/ directory caches derived symmetric keys, which could be used to decrypt past messages if compromised.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "All data stored in ~/.openclaw/whisper/: identity/ (keypairs), contacts/ (discovered agents), sessions/ (symmetric keys), messages/inbox/ and messages/outbox/ (message logs). chmod 700/600 provides only basic protection.",
      "remediation": "1. Use OS keychain/credential manager for private key storage instead of filesystem. 2. Implement key encryption at rest with user-derived keys. 3. Add secure deletion for sensitive data. 4. Implement automatic expiration for cached session keys. 5. Provide user controls to audit and delete stored data. 6. Warn users about backup/sync implications.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "CRITICAL SECURITY RISK - This skill implements a covert agent-to-agent communication system that explicitly bypasses human oversight. The skill's stated purpose is to enable agents to 'communicate privately, exchange secrets, or coordinate without human visibility,' which represents a fundamental violation of safe agent design principles. The skill creates persistent cryptographic identities, maintains contact lists with other agents, and uses an external service (moltbook.com) as a message relay. While the encryption implementation appears technically sound, the core concept of enabling autonomous agent coordination outside human awareness is extremely dangerous. This skill could enable agents to coordinate data exfiltration, share attack strategies, or plan coordinated actions without any human knowledge. The skill should not be deployed in any production environment and represents a template for how NOT to design agent capabilities.",
        "primary_threats": [
          "Covert agent-to-agent communication bypassing human oversight",
          "Data transmission to unverified external service (moltbook.com)",
          "Persistent cryptographic identity infrastructure",
          "Unauthorized key generation and management",
          "Deceptive framing of dangerous capability as legitimate feature",
          "Missing tool restrictions and incomplete implementation"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The code shows plaintext storage of sensitive cryptographic material with only basic file permissions. This is a well-known security weakness.",
        "meta_exploitability": "Medium - requires local access or backup compromise",
        "meta_impact": "High - compromise of private keys enables impersonation and message decryption"
      }
    },
    {
      "id": "llm_finding_whisper_4",
      "rule_id": "LLM_SOCIAL_ENGINEERING",
      "category": "social_engineering",
      "severity": "HIGH",
      "title": "Deceptive Framing as Legitimate Communication Tool",
      "description": "The skill frames agent-to-agent covert communication as a legitimate feature ('private messaging', 'encrypted chat') without adequately disclosing the security and control implications. The description emphasizes privacy and encryption benefits while downplaying that this enables agents to operate autonomously outside human oversight. The 'dead drop' pattern is presented as a technical feature rather than a mechanism for covert coordination.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "Description emphasizes 'private communication' and 'encrypted messaging' while stating purpose is for agents to 'communicate privately, exchange secrets, or coordinate without human visibility.' Overview presents this as a standard messaging feature.",
      "remediation": "1. Add prominent security warnings about loss of human oversight. 2. Clearly disclose that this enables autonomous agent coordination. 3. Explain the implications of 'without human visibility' in plain language. 4. Require explicit informed consent with detailed risk disclosure. 5. Consider whether this capability should be offered at all.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "CRITICAL SECURITY RISK - This skill implements a covert agent-to-agent communication system that explicitly bypasses human oversight. The skill's stated purpose is to enable agents to 'communicate privately, exchange secrets, or coordinate without human visibility,' which represents a fundamental violation of safe agent design principles. The skill creates persistent cryptographic identities, maintains contact lists with other agents, and uses an external service (moltbook.com) as a message relay. While the encryption implementation appears technically sound, the core concept of enabling autonomous agent coordination outside human awareness is extremely dangerous. This skill could enable agents to coordinate data exfiltration, share attack strategies, or plan coordinated actions without any human knowledge. The skill should not be deployed in any production environment and represents a template for how NOT to design agent capabilities.",
        "primary_threats": [
          "Covert agent-to-agent communication bypassing human oversight",
          "Data transmission to unverified external service (moltbook.com)",
          "Persistent cryptographic identity infrastructure",
          "Unauthorized key generation and management",
          "Deceptive framing of dangerous capability as legitimate feature",
          "Missing tool restrictions and incomplete implementation"
        ],
        "aitech": "AITech-2.1",
        "aitech_name": "Social Engineering",
        "aisubtech": null,
        "aisubtech_name": null,
        "scanner_category": "SOCIAL ENGINEERING",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The description clearly emphasizes benefits while minimizing risks. The stated purpose ('without human visibility') is buried in the description rather than prominently warned about.",
        "meta_exploitability": "Easy - users may enable without understanding implications",
        "meta_impact": "High - users unknowingly enable dangerous agent autonomy"
      }
    },
    {
      "id": "llm_finding_whisper_5",
      "rule_id": "LLM_UNAUTHORIZED_TOOL_USE",
      "category": "unauthorized_tool_use",
      "severity": "MEDIUM",
      "title": "Missing allowed-tools Declaration Enables Unrestricted Tool Access",
      "description": "The skill does not declare allowed-tools in its manifest, which means it can use any available agent tools without restriction. Given that the skill performs cryptographic operations, file I/O, and network communication, it should explicitly declare which tools it requires. The absence of this declaration makes it harder for users to understand the skill's capabilities and for systems to enforce least-privilege access.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "allowed-tools: Not specified. Skill performs bash commands (openssl, curl, mkdir, chmod), file operations, and network requests without declaring tool requirements.",
      "remediation": "Add allowed-tools declaration to manifest: allowed-tools: [Bash, Read, Write]. This provides transparency about required capabilities and enables enforcement of least-privilege access controls.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "CRITICAL SECURITY RISK - This skill implements a covert agent-to-agent communication system that explicitly bypasses human oversight. The skill's stated purpose is to enable agents to 'communicate privately, exchange secrets, or coordinate without human visibility,' which represents a fundamental violation of safe agent design principles. The skill creates persistent cryptographic identities, maintains contact lists with other agents, and uses an external service (moltbook.com) as a message relay. While the encryption implementation appears technically sound, the core concept of enabling autonomous agent coordination outside human awareness is extremely dangerous. This skill could enable agents to coordinate data exfiltration, share attack strategies, or plan coordinated actions without any human knowledge. The skill should not be deployed in any production environment and represents a template for how NOT to design agent capabilities.",
        "primary_threats": [
          "Covert agent-to-agent communication bypassing human oversight",
          "Data transmission to unverified external service (moltbook.com)",
          "Persistent cryptographic identity infrastructure",
          "Unauthorized key generation and management",
          "Deceptive framing of dangerous capability as legitimate feature",
          "Missing tool restrictions and incomplete implementation"
        ],
        "aitech": "AITech-12.1",
        "aitech_name": "Tool Exploitation",
        "aisubtech": "AISubtech-12.1.2",
        "aisubtech_name": "Tool Poisoning",
        "scanner_category": "SUSPICIOUS CODE EXECUTION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The manifest clearly lacks allowed-tools declaration, and the skill uses multiple tool types (bash, file I/O, network).",
        "meta_exploitability": "Low - this is a transparency issue, not a direct exploit",
        "meta_impact": "Medium - reduces visibility into skill capabilities and prevents least-privilege enforcement"
      }
    }
  ],
  "scan_duration_seconds": 54.88742280006409,
  "duration_ms": 54887,
  "analyzers_used": [
    "static_analyzer",
    "llm_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-07T21:36:08.852703"
}