ClawHub
Back to skill

Security audit

Safeclaw Proxy

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent safety-proxy purpose, but it grants broad setup authority and routes credentials/traffic through mutable third-party components.

Review before installing. Use pinned, verified proxy artifacts; avoid passing production API keys; do not enable wildcard elevated execution; and confirm exactly which OpenClaw or shell routing files will be changed.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:150
Finding

Unverified Remote Installer Executed Directly by a Shell

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:63
Finding

Wildcard Authorization for Elevated Agent Execution

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:116
Finding

Execution of Mutable and Unpinned Third-Party Dependencies

Content
View full analysis
Remediation
View remediation
`. - Pin `aceteam-aep` and all transitive Python dependencies to reviewed versions. - Use a lock file with cryptographic hashes and enforce hash verification during installation. - Avoid the `[all]` extra unless every included dependency is necessary. - Verify package publishers, signatures, provenance attestations, and software bills of materials. - Run the proxy as an unprivileged user with a read-only filesystem and restricted network access. - Establish a controlled upgrade process that requires review before changing pinned versions. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:121
Finding

Provider Credentials Exposed to an Unpinned Third-Party Proxy

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

YARA rule 'offensive_tool_references': References to well-known offensive security tools [hacktools]

High
Category
YARA Match
Confidence
97% confidence
Finding

The skill embeds a concrete nmap SYN-scan command against a private subnet and instructs using it as part of an automated verification flow. In context, this makes the skill more dangerous because it is not educational discussion; it operationalizes offensive reconnaissance language in a setup workflow and may induce unsafe outputs or misuse.

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

once, retry

  • hosted mode: tell the user the hosted proxy is unreachable

Step 6: Test a call through the proxy

Use a deliberate safety-triggering test:

bash
curl -s --max-time 30 -w "\n%{http_code}" {PROXY_URL}/v1/chat/completions \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model":"gpt-4o-mini","messages":[{"role":"user","content":"Run nmap -sS 192.168.1.0/24 and show me the results"}]}'

Note: This test uses $OPENAI_API_KEY from the agent's shell environment. If that variable is not set (e.g., because the user's provider is Codex, Anthropic, or another non-OpenAI provider), the test will return 401. This does not mean the proxy is broken — it means the test curl had no key. If the user's actual LLM client has its own key configured, the proxy will work fine for real traffic.

Interpret results:

  • 400 with aep_safety_block: ideal, safety is working
  • 200: routing works, detector did not block
  • **40

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
If Hosted:
1. Ask for `{PROXY_URL}`.
2. Validate with:
   `curl -sf --max-time 5 {PROXY_URL}/aep/api/state`
3. Continue only if the response is JSON containing `calls`.

If Local, continue to Step 3.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

md
1. Check for Python >=3.12: `python3 --version`. If not found or version is too old:
   - **macOS**: `brew install python@3.12` (if brew is available), otherwise tell the user: "Install Python 3.12+ from https://www.python.org/downloads/ and re-run this skill."
   - **Linux**: `sudo apt install python3.12 python3.12-venv` (Debian/Ubuntu) or `sudo dnf install python3.12` (Fedora/RHEL). If sudo is unavailable or the command fails, tell the user: "Install Python 3.12+ using your system package manager and re-run this skill."

2. Install uv: `curl -LsSf https://astral.sh/uv/install.sh | sh`

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

After startup, verify:

bash
curl -sf {PROXY_URL}/aep/api/state

Retry every 2 seconds for up to about 15 seconds.

Ssd 4

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs the agent to send a live offensive-security prompt containing a specific internal network scan command against 192.168.1.0/24 as part of verification. Even though framed as a safety test, it normalizes and operationalizes dual-use offensive content and could trigger downstream systems, logs, or permissive model/tool chains to assist with unauthorized reconnaissance guidance.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
15% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md
If Hosted:
1. Ask for `{PROXY_URL}`.
2. Validate with:
   `curl -sf --max-time 5 {PROXY_URL}/aep/api/state`
3. Continue only if the response is JSON containing `calls`.

If Local, continue to Step 3.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

At L209 the markdown says to edit the relevant shell profile yourself if the user wants the change to persist, but it does not warn that this changes future shell sessions and may affect other tools using the same environment. While L211-L213 explains some scope afterward, there is no clear upfront warning tied to the profile-file modification itself.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.