Openclaw Devboxes Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:45 PM UTC
• Version: 1.4.0

Overview

This skill has a coherent devbox purpose, but its setup grants broad host and network authority with unsafe defaults that users should review carefully before installing.

Install only in a dedicated, non-shared environment where host Docker control, public devbox URLs, and Cloudflare/GitHub token exposure are acceptable. Avoid chmod 666 on the Docker socket, avoid broad tokens, put VSCode/VNC behind authentication, and prefer pinned images and isolated infrastructure before using this skill.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: docker/entrypoint.sh:61

Finding

Externally Routed VSCode and VNC Services Disable Authentication

Content

View full analysis

/dev/null 2>&1 & echo "[devbox] noVNC ready on port ${NOVNC_PORT}" fi if [ "${ENABLE_VSCODE:-false}" = "true" ]; then "${OPENVSCODE_SERVER_ROOT}/bin/openvscode-server" \ --host 0.0.0.0 \ --port "${VSCODE_PORT}" \ --without-connection-token \ --default-folder /workspace \ > /dev/null 2>&1 & echo "[devbox] VSCode ready on port ${VSCODE_PORT}" fi ``` The services are subsequently assigned externally reachable hostnames: ```bash cat > "${CF_CONFIG_DIR}/config.yml" << CFEOF ingress: - hostname: vscode-${DEVBOX_ID}.${DEVBOX_DOMAIN} service: http://localhost:${VSCODE_PORT} - hostname: novnc-${DEVBOX_ID}.${DEVBOX_DOMAIN} service: http://localhost:${NOVNC_PORT} ``` ### Technical Analysis OpenVSCode Server is launched with `--without-connection-token`, explicitly disabling its connection-token authentication. VNC is launched with `-nopw`, explicitly disabling password authentication. The initialization script then creates public Traefik or Cloudflare Tunnel routes for both services. No authentication middleware, identity-aware access policy, source-address restriction, or independently generated session secret is configured in the audited project. Sequential devbox identifiers also make hostnames such as `vscode-1.example.com` easier to predict. ### Attack Path 1. An attacker identifies the configured base domain through DNS, documentation, certificate transparency, or normal reconnaissa ...[truncated 905 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:78

Finding

World-Writable Docker Socket Grants Host-Equivalent Privileges

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:226

Finding

GitHub and Cloudflare Credentials Are Exposed to Devbox Processes

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: docker/devbox-init.sh:10

Finding

Unsanitized Configuration Values Are Evaluated as Shell and Python Source

Content

View full analysis

" exit 1 fi export DEVBOX_ID="$1" cat > /etc/devbox.env << EOF export DEVBOX_ID=$DEVBOX_ID export DEVBOX_DOMAIN=$DEVBOX_DOMAIN export VSCODE_URL=$VSCODE_URL export NOVNC_URL=$NOVNC_URL $(for i in 1 2 3 4 5; do tag_var="APP_TAG_$i" port_var="APP_PORT_$i" echo "export APP_TAG_$i=${!tag_var}" echo "export APP_PORT_$i=${!port_var}" echo "export APP_URL_$i=$(eval echo \$APP_URL_$i)" done) EOF cp /etc/devbox.env /etc/profile.d/devbox.sh grep -q '/etc/devbox.env' /root/.bashrc 2>/dev/null || echo ". /etc/devbox.env" >> /root/.bashrc . /etc/devbox.env ``` The same values are interpolated directly into Python source: ```bash python3 -c " import sys devbox_id = '${DEVBOX_ID}' container = '${CONTAINER_NAME}' domain = '${DEVBOX_DOMAIN}' services = {'vscode': ${VSCODE_PORT}, 'novnc': ${NOVNC_PORT}} tags = ['${APP_TAG_1}','${APP_TAG_2}','${APP_TAG_3}','${APP_TAG_4}','${APP_TAG_5}'] ports = [${APP_PORT_1},${APP_PORT_2},${APP_PORT_3},${APP_PORT_4},${APP_PORT_5}] for tag, port in zip(tags, ports): services[tag] = port ``` ### Technical Analysis `DEVBOX_ID`, domain, tags, URLs, and port values are treated as trusted source text rather than data. Shell metacharacters placed in a value written to `/etc/devbox.env` can introduce command substitutions, separators, or additional commands when the file is sourced. The file is also loaded by future root shells through `/root/.bashrc`. In the Traefik branch, a single quote in a string value can terminate its Python literal and inject arbi ...[truncated 1426 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:216

Finding

Runtime Components Are Retrieved Through Mutable and Unpinned References

Content

View full analysis

Remediation

View remediation

`. - Pin the installer to an exact reviewed version instead of `@latest`. - Specify exact dependency versions and commit a lockfile. - Use reproducible, lockfile-enforced installation in continuous integration. - Verify image signatures and provenance before deployment. - Scan pinned images and packages for known vulnerabilities. - Review updates explicitly and change pins only after validation rather than following mutable tags automatically. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:180

Finding

Onboarding Disables Main-Agent Isolation and Enables Global Session Visibility

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (36)

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

Mounting /var/run/docker.sock into the application container grants it direct control over the host Docker daemon. Any bug, prompt-injection path, or compromised subcomponent in the agent can then create privileged containers, mount host paths, and fully escape the intended sandbox.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

The OpenClaw container needs access to the Docker daemon on the host to manage devbox containers. Start your OpenClaw container with these additional flags:

bash

-v /var/run/docker.sock:/var/run/docker.sock
-v /usr/bin/docker:/usr/bin/docker:ro

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Instructing users to run chmod 666 /var/run/docker.sock makes the Docker control socket world-writable. Any local user or process that can reach that socket can gain effectively root-level control of the host by starting privileged containers, mounting host filesystems, or extracting secrets.

Content

No source excerpt is available for this finding.

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

Making /var/run/docker.sock world-writable compounds the existing Docker socket risk by allowing any local principal to issue Docker API calls. This transforms a dangerous privileged integration into a trivially exploitable host-compromise condition.

Content

Scanner excerpt · README.md (reported line 58)May include surrounding context.

On the host, set the correct permissions to make the Docker socket accessible:

bash

chmod 666 /var/run/docker.sock

Note: This must be done on the host machine before starting the OpenClaw container. If the container is already running, restart it after adding the volume mounts (e.g. docker-compose.yml)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The README instructs a highly dangerous host command (chmod 666) on a sensitive control interface. In an agent-assisted setup, such guidance can directly lead users to weaken core system protections, enabling abuse by other local processes or compromised tools.

Content

Scanner excerpt · README.md (reported line 58)May include surrounding context.

On the host, set the correct permissions to make the Docker socket accessible:

bash

chmod 666 /var/run/docker.sock

Note: This must be done on the host machine before starting the OpenClaw container. If the container is already running, restart it after adding the volume mounts (e.g. docker-compose.yml)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

The documentation normalizes world-writable shared files for convenience, which is an unsafe default and can be abused by other containers or users to tamper with shared state. Although not host-compromise by itself, it weakens integrity boundaries and can facilitate cross-session interference.

Content

Scanner excerpt · README.md (reported line 156)May include surrounding context.

md

| `/home/node/.openclaw/.devbox-counter` | `/shared/.devbox-counter` | ID counter                                |
| `/home/node/.openclaw/traefik/configs` | `/traefik`                | Traefik route configs (Traefik mode only) |

> **Important:** Both paths must be writable by sandbox containers (UID 1000). The counter file needs `chmod 666`, and the Traefik devboxes dir should be owned by `1000:1000`.

## Self-Registration

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 189)May include surrounding context.

md

nvm install && nvm use
npm install

cp template.env .env
sed -i "s/PORT=.*/PORT=$APP_PORT_1/" .env

tmux new -d -s my-server "source /root/.nvm/nvm.sh; nvm use; npm run dev; exec \$SHELL"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 190)May include surrounding context.

md

nvm install && nvm use
npm install

cp template.env .env
sed -i "s/PORT=.*/PORT=$APP_PORT_1/" .env

tmux new -d -s my-server "source /root/.nvm/nvm.sh; nvm use; npm run dev; exec \$SHELL"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The skill recommends an unsafe parameter/permission change (chmod 777) as the operational fix for a mount-write limitation. This is dangerous because it weakens host filesystem protections to make the workflow succeed, enabling tampering with shared routing files from less-trusted contexts.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

| ------------------------------ | --------------------- | --------------------------------------------- |
| `/home/node/.openclaw/traefik` | `/traefik`            | Route configs (only if using Traefik routing) |

**Important:** Due to OpenClaw Security measures, all user capabilites are dropped by default. So even root (in the devbox) has no write access to bind mounts, and can only read from them. The only solution currently is `chmod 777` on the host path that is mapped to `/home/node/.openclaw/traefik`.

### Known Paths

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The onboarding flow instructs users to mount the Docker socket and relax socket permissions with chmod 666 without a strong safety warning. Docker socket access effectively grants root-equivalent control over the host, and world-writable socket permissions further widen the attack surface to any local process able to reach it.

Content

No source excerpt is available for this finding.

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

Mounting /var/run/docker.sock into the main agent container gives the skill the ability to control Docker on the host, which is effectively root-equivalent access. In the context of a skill that can spawn containers, inspect mounts, and write configuration, this dramatically increases the blast radius of any misuse, prompt injection, or compromise.

Content

Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.

text

-v /usr/bin/docker:/usr/bin/docker:ro
-v /var/run/docker.sock:/var/run/docker.sock

and that they need to set chmod 666 /var/run/docker.sock manually on the host, so that the OpenClaw container can work with it.

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The Docker socket reference here is coupled with advice to relax permissions, making already dangerous host control even easier to abuse. Any process within reach of the socket could create privileged containers, mount the host filesystem, or extract secrets from other containers.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

-v /var/run/docker.sock:/var/run/docker.sock

text

and that they need to set `chmod 666 /var/run/docker.sock` manually on the host, so that the OpenClaw container can work with it.

The OpenClaw container needs to be restarted then. After that, they can ask to set up the devbox skill again.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill directs collection of GitHub and Cloudflare tokens but does not warn the user that these secrets will be persisted into configuration and environment variables accessible to spawned environments. This creates a substantial risk of credential exposure, accidental logging, and later misuse by subagents or processes inside the devbox.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The onboarding process explicitly collects sensitive tokens for later operational use, which is a direct secret-handling risk. In this skill's context, those secrets are not transient input to a single command but are intended to become persistent infrastructure credentials, magnifying exposure if the skill, config, logs, or spawned environments are compromised.

Content

No source excerpt is available for this finding.

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md

Store the value as `HOST_OPENCLAW_PATH`. If `HOST_OPENCLAW_PATH` is a "system directory", OpenClaw will not be able to spawn a devbox.

System directories are: /etc, /private/etc, /proc, /sys, /dev, /root, /boot, /run, /var/run, /private/var/run, /var/run/docker.sock, /private/var/run/docker.sock and /run/docker.sock.

If the `HOST_OPENCLAW_PATH` is such a "system directory", abort here and tell the user they need to change their OpenClaw container setup to use a host path for OpenClaw data that is not a system directory. For example, they can create a directory like `/home/openclaw` or `/opt/openclaw` on the host.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill stores Cloudflare and related credentials as retained values for ongoing use across the devbox environment. Persistent storage of infrastructure secrets increases blast radius because any later compromise of the agent, config store, or container environment can expose credentials that permit external DNS and tunnel manipulation.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The devbox agent configuration injects GitHub and Cloudflare secrets directly into container environment variables. Environment variables are commonly exposed to processes, subprocesses, debug tooling, crash reports, and sometimes UIs, making them an unsafe place for broad-scoped credentials in multi-process dev environments.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · docker/devbox-init.sh (reported line 64)May include surrounding context.

sh

L
export NOVNC_URL=$NOVNC_URL
$(for i in 1 2 3 4 5; do
    tag_var="APP_TAG_$i"
    port_var="APP_PORT_$i"
    echo "export APP_TAG_$i=${!tag_var}"
    echo "export APP_PORT_$i=${!port_var}"
    echo "export APP_URL_$i=$(eval echo \$APP_URL_$i)"
done)
EOF

# Make env vars available in all new shells
cp /etc/devbox.env /etc/profile.d/devbox.sh
grep -q '/etc/devbox.env' /root/.bashrc 2>/dev/null || echo ". /etc/devbox.env" >> /root/.bashrc

# Source into the current shell
. /etc/devbox.env

echo "[devbox-init] Env files written"

########################################
# Routing: Traefik or Cloudflare Tunnel
########################################
: "${ROUTING_MODE:=traefik}"

if [ "$ROUTING_MODE" = "cloudflared" ]; then
    ########################################
    # Cloudflare Tunnel routing
    ########################################
    echo "[devbox-init] Routing mode: cloudflared"

    if [ -z "${CF_TUNNEL_TOKEN:-}" ]; then
        echo "[devbox-init] ERROR: CF_TUNNEL_TOKEN i

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation requires mounting the host Docker socket into the OpenClaw container and making it accessible so the skill can create and manage containers. Docker socket access is effectively root-equivalent on the host, so any compromise of the agent or skill flow can lead to arbitrary container creation, filesystem mounts, secret extraction, and host takeover far beyond ordinary devbox management.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The documented chmod 666 /var/run/docker.sock requires privileged host modification and grants universal write access to the Docker daemon. Because the Docker daemon can launch containers with arbitrary mounts and privileges, this is effectively a host root-compromise pathway.

Content

Scanner excerpt · README.md (reported line 58)May include surrounding context.

On the host, set the correct permissions to make the Docker socket accessible:

bash

chmod 666 /var/run/docker.sock

Note: This must be done on the host machine before starting the OpenClaw container. If the container is already running, restart it after adding the volume mounts (e.g. docker-compose.yml)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README directs storage of sensitive Cloudflare credentials and tunnel tokens in agent configuration without emphasizing secure secret handling. If the agent config is exposed through logs, workspace files, backups, or other skills, attackers could take over DNS and tunnel infrastructure for the user's domain.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 78% confidence

Finding

The README instructs installation via npx clawhub@latest install devboxes, which pulls and executes the latest published package without pinning a version or integrity. That creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users may execute unreviewed code during installation.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Recommending chmod 666 on the shared counter file creates unnecessary world-writable state shared across containers. While less severe than the Docker socket, it permits tampering with ID assignment and can enable denial of service, collisions, or interference between devboxes.

Content

Scanner excerpt · README.md (reported line 156)May include surrounding context.

md

| `/home/node/.openclaw/.devbox-counter` | `/shared/.devbox-counter` | ID counter                                |
| `/home/node/.openclaw/traefik/configs` | `/traefik`                | Traefik route configs (Traefik mode only) |

> **Important:** Both paths must be writable by sandbox containers (UID 1000). The counter file needs `chmod 666`, and the Traefik devboxes dir should be owned by `1000:1000`.

## Self-Registration

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

The README states that bind-mounted files and directories must be world-writable due to dropped capabilities, establishing an unsafe operational default. World-writable mounts increase the chance of tampering, accidental overwrite, and cross-container interference, especially in a multi-tenant or partially trusted environment.

Content

Scanner excerpt · README.md (reported line 240)May include surrounding context.

md

## Important Notes

- Sandbox containers run with **all Linux capabilities dropped** (`CapDrop: ALL`). Bind-mounted files/dirs must be world-writable.
- The devbox working directory is always `/workspace`.

## License

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill performs sensitive actions including shell execution, file writes, Docker interaction, and configuration changes, yet it declares no explicit tool scope or permission boundaries. That increases the chance the skill is invoked with broader capabilities than necessary and makes risky operations less visible to operators.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The activation description is broad enough to trigger the skill for common 'setup' or 'manage' requests, including first-time onboarding that performs highly privileged host and Docker operations. Over-broad activation increases the risk that an agent routes ordinary user requests into a dangerous administrative workflow without sufficient confirmation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.