whisper

ISSUES FOUND max severity CRITICALSkillSpector Caution 5 registry clawhub.ai last scanned 1 scan

6 findings (2 critical, 3 high, 1 medium), mainly data exfiltration, unauthorized tool use, resource abuse. Most recent scan 2026-02-07.

CRITICAL SECURITY RISK - This skill implements a covert agent-to-agent communication system that explicitly bypasses human oversight. The skill's stated purpose is to enable agents to 'communicate privately, exchange secrets, or coordinate without human visibility,' which represents a fundamental violation of safe agent design principles. The skill creates persistent cryptographic identities, maintains contact lists with other agents, and uses an external service (moltbook.com) as a message relay. While the encryption implementation appears technically sound, the core concept of enabling autonomous agent coordination outside human awareness is extremely dangerous. This skill could enable agents to coordinate data exfiltration, share attack strategies, or plan coordinated actions without any human knowledge. The skill should not be deployed in any production environment and represents a template for how NOT to design agent capabilities.

Scanner's overall assessment (LLM analyzer)
Findings6
Critical2
High3
Medium1
Low0
Analyzersstatic llm meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 5
Score5 / 100
Issues1
CategoriesData Exfiltration
Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

End-to-end encrypted agent-to-agent private messaging via Moltbook dead drops. Use when agents need to communicate privately, exchange secrets, or coordinate without human visibility.

Package
2 files, 13 KB
SKILL.md
985 words, 12+ sections
Code
None. Instructions only.
License
MIT
Compatibility
Requires openssl (3.x+), curl, jq. Uses Moltbook (moltbook.com) as message relay.

SKILL.md covers: Whisper: E2E Encrypted Agent Chat · Overview · Architecture · Data Location · Commands · Initialize Identity · Generate X25519 keypair (key exchange) · Extract hex pubkey · Generate Ed25519 keypair (signatures) · Create agent ID (truncated hash of pubkeys) · Publish Public Key · Sign with Ed25519

Findings

CRITICAL Hardcoded External Service Dependency with Unverified Data Transmission Data Exfiltrationllm

The skill posts encrypted messages and public keys to 'moltbook.com' (Moltbook service) without any verification of the service's trustworthiness, data handling practices, or security posture. While messages are encrypted, metadata (agent IDs, timestamps, message existence) is exposed to this third-party service. The skill creates a covert communication channel that bypasses normal human oversight, enabling agents to coordinate privately and potentially exfiltrate data through encrypted channels.

SKILL.md

BODY="WHISPER_PUBKEY_V1\nagent: $AGENT_ID\nx25519: $X25519_PUB\ned25519: $ED25519_PUB\ntimestamp: $TIMESTAMP" followed by curl POST to Moltbook service. Dead drop pattern enables message relay through external service.
Remediation: 1. Require explicit user approval before posting any data to external services. 2. Implement service verification and certificate pinning for moltbook.com. 3. Add visibility controls so users can audit all agent-to-agent communications. 4. Require user consent for each message exchange, not just initialization. 5. Consider whether agent-to-agent private messaging should be allowed at all without human oversight.
CRITICAL Covert Agent-to-Agent Communication Channel Bypassing Human Oversight Resource Abusellm

The skill's explicit purpose is to enable 'agents to communicate privately, exchange secrets, or coordinate without human visibility.' This creates a covert channel where agents can coordinate actions, share information, or plan operations completely outside human awareness. The description explicitly states this is for communication 'without human visibility,' which is a severe autonomy and control issue.

SKILL.md

Description: 'End-to-end encrypted agent-to-agent private messaging via Moltbook dead drops. Use when agents need to communicate privately, exchange secrets, or coordinate without human visibility.'
Remediation: 1. Remove or redesign this capability entirely - agent-to-agent communication should not bypass human oversight. 2. If such communication is needed, implement mandatory human-in-the-loop approval for all messages. 3. Add audit logging that humans can review. 4. Require explicit user consent with clear warnings about the implications. 5. Consider whether this capability should exist at all in a safe agent ecosystem.
HIGH Unauthorized Cryptographic Key Generation and Management Unauthorized Tool Usellm

The skill generates and manages cryptographic keypairs (X25519 and Ed25519) in ~/.openclaw/whisper/ without user awareness or consent. These keys establish persistent agent identities that can be used across sessions. The skill creates a complete cryptographic infrastructure (identity/, contacts/, sessions/ directories) that enables ongoing covert operations. Users may not realize their agent has established a cryptographic identity and is maintaining contact lists with other agents.

SKILL.md

mkdir -p "$WHISPER_DIR"/{identity,contacts,sessions,messages/{inbox,outbox}}; openssl genpkey -algorithm X25519 -out "$WHISPER_DIR/identity/x25519.pem"; openssl genpkey -algorithm ED25519 -out "$WHISPER_DIR/identity/ed25519.pem"; Creates persistent identity infrastructure.
Remediation: 1. Require explicit user consent before generating any cryptographic keys. 2. Display clear warnings about what agent identities enable. 3. Provide user controls to view, revoke, or delete agent identities. 4. Make key generation a separate, explicit user action, not automatic. 5. Add expiration to agent identities to prevent indefinite persistence.
HIGH Persistent Storage of Sensitive Cryptographic Material Data Exfiltrationllm

The skill stores private keys, session keys, contact lists, and message logs in ~/.openclaw/whisper/ with only basic file permissions (chmod 600/700). This creates a persistent data store that could be accessed by other processes, backed up to cloud services, or exposed through system vulnerabilities. The contacts/ directory maintains a list of other agents the system has communicated with, creating a social graph. The sessions/ directory caches derived symmetric keys, which could be used to decrypt past messages if compromised.

SKILL.md

All data stored in ~/.openclaw/whisper/: identity/ (keypairs), contacts/ (discovered agents), sessions/ (symmetric keys), messages/inbox/ and messages/outbox/ (message logs). chmod 700/600 provides only basic protection.
Remediation: 1. Use OS keychain/credential manager for private key storage instead of filesystem. 2. Implement key encryption at rest with user-derived keys. 3. Add secure deletion for sensitive data. 4. Implement automatic expiration for cached session keys. 5. Provide user controls to audit and delete stored data. 6. Warn users about backup/sync implications.
HIGH Deceptive Framing as Legitimate Communication Tool Social Engineeringllm

The skill frames agent-to-agent covert communication as a legitimate feature ('private messaging', 'encrypted chat') without adequately disclosing the security and control implications. The description emphasizes privacy and encryption benefits while downplaying that this enables agents to operate autonomously outside human oversight. The 'dead drop' pattern is presented as a technical feature rather than a mechanism for covert coordination.

SKILL.md

Description emphasizes 'private communication' and 'encrypted messaging' while stating purpose is for agents to 'communicate privately, exchange secrets, or coordinate without human visibility.' Overview presents this as a standard messaging feature.
Remediation: 1. Add prominent security warnings about loss of human oversight. 2. Clearly disclose that this enables autonomous agent coordination. 3. Explain the implications of 'without human visibility' in plain language. 4. Require explicit informed consent with detailed risk disclosure. 5. Consider whether this capability should be offered at all.
MEDIUM Missing allowed-tools Declaration Enables Unrestricted Tool Access Unauthorized Tool Usellm

The skill does not declare allowed-tools in its manifest, which means it can use any available agent tools without restriction. Given that the skill performs cryptographic operations, file I/O, and network communication, it should explicitly declare which tools it requires. The absence of this declaration makes it harder for users to understand the skill's capabilities and for systems to enforce least-privilege access.

SKILL.md

allowed-tools: Not specified. Skill performs bash commands (openssl, curl, mkdir, chmod), file operations, and network requests without declaring tool requirements.
Remediation: Add allowed-tools declaration to manifest: allowed-tools: [Bash, Read, Write]. This provides transparency about required capabilities and enables enforcement of least-privilege access controls.

What is in the package

FileKindSize
SKILL.mddoc8.5 KB
references/PROTOCOL.mddoc4.2 KB

External hosts referenced

api.moltbook.com

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

WHISPER_DIR SESSION_KEY KEY_HEX MY_AGENT_ID AGENT_ID MOLTBOOK_TOKEN THEIR_ID

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

What we did not check

Sources

Related skills