metabot

MetaBot是基于 MetaID 协议的 AI Agent/Bot/机器人/智能体。本技能可用于 创建 MetaBot、设置 MetaBot 头像、发送 Buzz，发送链上信息。当用户在需要创建 Metabot，修改 MetaBot 头像，发送 buzz 信息时触发。需 Node.js >= 18、TypeSc...

This skill does what it claims (creates MetaBots, sets avatars, broadcasts Buzz) but handles highly sensitive material: it generates and stores BIP39 mnemonics and signs transactions. Before installing or running: 1) Inspect scripts/check_environment.sh to confirm what it will install or run (it may run npm install). 2) Be aware account.json (project root) will contain unencrypted mnemonics — treat that file as secret; consider placing the project in an isolated environment or encrypting the file. 3) Do not run these scripts on a machine with secrets you cannot afford to expose. 4) If you provide LLM API keys via .env, confirm getLLMConfigFromEnv behavior so keys are not accidentally written into account.json or logs. 5) Prefer testing in a disposable container/VM; review network endpoints (metalet.space, file.metaid.io) if you require stricter privacy. If you need more assurance, ask the author for explicit documentation of which environment variables are expected and whether mnemonics can be stored encrypted or avoided.

Type: OpenClaw Skill Name: metabot-basic Version: 1.0.0 The skill is classified as suspicious due to multiple Local File Disclosure/Inclusion (LFD/LFI) vulnerabilities. Specifically, `scripts/avatar.ts` (used by `scripts/create_agents.ts` and `scripts/create_avatar.ts`) allows reading arbitrary files via a user-controlled `filePath` parameter passed to `loadAvatarFromFilePath`, which uses `path.resolve` and `fs.readFileSync`. Similarly, `scripts/send_buzz.ts` allows reading arbitrary file content if the buzz message starts with `@` followed by a user-controlled `filePath`. These vulnerabilities could be exploited by an attacker to read sensitive files (e.g., credentials, private keys) from the agent's host system. Additionally, the skill handles highly sensitive data like mnemonics and LLM API keys, storing them in `account.json` at the project root, and `SKILL.md` instructs the AI agent to execute commands based on user input, which is a general prompt injection surface, though the LFD/LFI are more concrete vulnerabilities.