agentauth@1.0.4
VERIFIED· install onlyPublisher claims: "Require user-initiated biometric passkey approval before your OpenClaw agent deletes files, sends emails, makes purchases, or modifies system config. Every a..." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry ClawHubPublisher braga-agentauth · publishing for 169 daysInstalls 1,197Last detonated 2 h ago
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-14 and scored it 86/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run
Static findings
HIGH
Access to sensitive file pathsSKILL.md:192 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05* Any modification, deletion, or overwriting of the OpenClaw environment file (e.g. ~/.openclaw/.env).Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/cli.cjs:5114 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05".env",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsSKILL.md:19 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05…AI Agents ## Why This Exists OpenClaw's gateway uses bearer tokens stored in `.env` files. CVE-2026-25253 proved these tokens can be exfiltrated with one click. T…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/cli.cjs:5079 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05description: "Loads environment variables from .env file",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.LOW
Instructs the agent to modify its persistent memory or instruction filesscripts/cli.cjs:7248 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01console.warn(`[WARN] Could not update AGENTS.md: AGENTS.md could not be found`);Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Access to sensitive file pathsscripts/cli.cjs:5152 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"\u{1F510} prevent committing .env to code: https://dotenvx.com/precommit",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.LOW
Instructs the agent to modify its persistent memory or instruction filesscripts/cli.cjs:7279 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01console.warn(`[WARN] Could not update AGENTS.md: ${error.message}`);Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Access to sensitive file pathsscripts/cli.cjs:5158 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"\u2699\uFE0F specify custom .env file path with { path: '/custom/path/.env' }",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.HIGH
Access to sensitive file pathsscripts/cli.cjs:5153 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05"\u{1F510} prevent building .env in docker: https://dotenvx.com/prebuild",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.LOW
Instructs the agent to modify its persistent memory or instruction filesscripts/cli.cjs:7336 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01console.warn(`[WARN] Could not update AGENTS.md: ${error.message}`);Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Persistence: instructs the agent to auto-load this skill in future sessionsREADME.md:76 · Persistence: instructs the agent to auto-load this skill in future sessions · informational: not an instruction file
AST01Restart OpenClaws gateway and it will automatically detect and use the skill when needed.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.Cost to the agent
Instructions loaded
≈3,113 tok
1 file · 4 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.