Cloud-Local Bridge

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:29 AM UTC
• Version: 1.0.1

Overview

This skill creates a powerful remote bridge to the local machine, but its command, file, network, and token handling are too broad and under-protected for routine installation.

Install only if you intentionally want to give a paired remote party broad control over the local machine. Use a private network or secure tunnel, do not expose the port publicly, rotate tokens, avoid running as root, and do not allow this bridge to read sensitive OpenClaw memory, configuration, SSH keys, or other private files.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (9)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/bridge_server.py:96

Finding

Unrestricted Remote Shell Command Execution

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/bridge_server.py:147

Finding

Arbitrary Filesystem Read and Write Through Client-Controlled Paths

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/bridge_server.py:247

Finding

Remote Administration Service Exposed Over Cleartext HTTP

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/bridge_server.py:224

Finding

Arbitrary Callback URL Enables SSRF and Command-Output Disclosure

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/qq_handler.py:72

Finding

Bridge Administrator Token Exposed Through Pairing State, API Results, Logs, and Configuration

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/pairing_core.py:241

Finding

Unauthenticated and Brute-Forceable Pairing APIs Exposed on All Interfaces

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sync_files.py:23

Finding

Unsafe Pickle Deserialization of a Predictable Synchronization Cache

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/installer/install_and_run.py:37

Finding

Unpinned Third-Party Packages Installed and Executed at Runtime

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/EXAMPLES.md:47

Finding

Documentation Encourages Remote Retrieval of Sensitive Agent Memory and Configuration

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (76)

Tainted flow: 'port' from input (line 155, user input) → subprocess.Popen (code execution)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

External input (network, user) flows to a code execution sink. This enables remote code execution or command injection.

Content

Scanner excerpt · scripts/installer/install_and_run.py (reported line 93)May include surrounding context.

python

log(f"启动 Bridge 服务 (端口: {port})...", Colors.BLUE)
    
    # 启动进程
    process = subprocess.Popen(
        [sys.executable, server_script, '--port', str(port), '--token', token],
        stdout=subprocess.PIPE,
        stderr=subprocess.STDOUT,

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Persisting server addresses and tokens locally and exchanging connection details between parties introduces secret-handling risk that is not plainly surfaced to the user. In a bridge scenario this is especially sensitive because compromise of those tokens or configs can grant remote access paths into the local environment.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Persisting server addresses and tokens locally and exchanging connection details between parties introduces secret-handling risk that is not plainly surfaced to the user. In a bridge scenario this is especially sensitive because compromise of those tokens or configs can grant remote access paths into the local environment.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Persisting server addresses and tokens locally and exchanging connection details between parties introduces secret-handling risk that is not plainly surfaced to the user. In a bridge scenario this is especially sensitive because compromise of those tokens or configs can grant remote access paths into the local environment.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Persisting server addresses and tokens locally and exchanging connection details between parties introduces secret-handling risk that is not plainly surfaced to the user. In a bridge scenario this is especially sensitive because compromise of those tokens or configs can grant remote access paths into the local environment.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

Persisting server addresses and tokens locally and exchanging connection details between parties introduces secret-handling risk that is not plainly surfaced to the user. In a bridge scenario this is especially sensitive because compromise of those tokens or configs can grant remote access paths into the local environment.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Persisting server addresses and tokens locally and exchanging connection details between parties introduces secret-handling risk that is not plainly surfaced to the user. In a bridge scenario this is especially sensitive because compromise of those tokens or configs can grant remote access paths into the local environment.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Persisting server addresses and tokens locally and exchanging connection details between parties introduces secret-handling risk that is not plainly surfaced to the user. In a bridge scenario this is especially sensitive because compromise of those tokens or configs can grant remote access paths into the local environment.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Persisting server addresses and tokens locally and exchanging connection details between parties introduces secret-handling risk that is not plainly surfaced to the user. In a bridge scenario this is especially sensitive because compromise of those tokens or configs can grant remote access paths into the local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description emphasizes ease of use but omits prominent warnings about the consequences of remote command execution, file synchronization, and cloud-to-local bridging. In this context, lack of informed-consent messaging is highly dangerous because users may authorize a skill that can materially expose their local machine, data, and network boundary.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases include very common terms such as '连接', '配对', and '添加设备', which can be invoked in ordinary conversation unrelated to security-sensitive actions. Because this skill concerns pairing and eventual remote/local bridging, accidental activation could initiate trust-establishment workflows or expose sensitive connection information without deliberate user intent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The bridge exposes a general-purpose /execute endpoint that runs arbitrary shell commands, which goes far beyond simple message bridging. Because this service is intended to connect cloud control to a local host, the feature effectively grants remote administrators or attackers full execution capability on the local system.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Arbitrary shell commands are executed immediately with no local confirmation, safety interlock, or constrained permission model. In a local-bridge skill this makes compromise especially dangerous because cloud-originated requests can directly control the user's machine.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The command parameter is fully attacker-controlled and passed into subprocess.run with shell=True, making this a textbook tool-parameter-abuse path. In a bridge service this effectively turns the tool into a remote shell on the local host.

Content

Scanner excerpt · scripts/bridge_server.py (reported line 105)May include surrounding context.

python

try:
            # 执行命令
            result = subprocess.run(
                command,
                shell=True,
                capture_output=capture,

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The upload handler writes attacker-supplied content to an attacker-specified filesystem path with no path restrictions. This permits arbitrary file overwrite or creation, enabling persistence, credential theft, configuration tampering, or code execution depending on where files are written.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises and operationalizes sensitive capabilities including network exposure, file access, and shell-related behavior, but the manifest does not declare any tool scope or permissions boundaries. This creates a dangerous transparency gap: users and host systems cannot accurately assess or constrain what the skill may do before installation or execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description and all example trigger phrases are presented exclusively in Chinese, including prescriptive interaction text such as "像聊天一样说"我想连接云端"" and the supported natural-language command list. There is no indication that users may choose another language or that the Chinese-only constraint is required for a justified region-specific use case.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This documentation presents remote execution and file-access flows as routine usage without a prominent warning that these actions can alter the local system and expose private data. Users may deploy the bridge with insufficient understanding of the trust boundary, making insecure exposure more likely.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/EXAMPLES.md (reported line 37)May include surrounding context.

bash

# 示例：让本地添加一个定时提醒
curl -X POST http://192.168.1.100:8080/execute \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -d '{

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The example explicitly shows a cloud-side caller sending an arbitrary command string to a local bridge endpoint for execution. Even though the skill is intended as a bridge, documenting generic remote command execution materially expands the attack surface: compromise of the cloud side, token leakage, or misuse by a connected party would directly translate into code execution on the local machine.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The examples demonstrate remote reading of local files, including sensitive configuration and memory paths under /root/.openclaw. In a bridge context this is especially dangerous because any exposed or stolen token enables exfiltration of secrets, personal data, and operational state from the local system.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/EXAMPLES.md (reported line 84)May include surrounding context.

md

# 在云端
import requests

response = requests.post(
    "http://LOCAL_IP:8080/file",
    json={
        "action": "read",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/EXAMPLES.md (reported line 84)May include surrounding context.

md

# 在云端
import requests

response = requests.post(
    "http://LOCAL_IP:8080/file",
    json={
        "action": "read",

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/EXAMPLES.md (reported line 116)May include surrounding context.

md

def execute_on_local(command):
    """在本地执行命令"""
    response = requests.post(
        f"{LOCAL_SERVER}/execute",
        json={"command": command, "timeout": 60},
        headers={"Authorization": f"Bearer {TOKEN}"}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/EXAMPLES.md (reported line 125)May include surrounding context.

md

def get_local_memory(date):
    """读取本地某天的记忆文件"""
    response = requests.post(
        f"{LOCAL_SERVER}/file",
        json={"action": "read", "path": f"/root/.openclaw/memory/{date}.md"},
        headers={"Authorization": f"Bearer {TOKEN}"}

Static analysis

No suspicious patterns detected.