Security audit
Security checks for vulnerabilities and agentic risk
The skill is marked suspicious because scanners found environment and network capabilities not covered by declared permissions, and the scan was incomplete.
Consider the flagged permission gap and verify that you trust the external service and understand what data or credentials it receives. The scan covered 66.7% of components and was partial, including opaque script content, so the evidence is incomplete.
The skill uses 'env' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
The skill uses 'network' capability that is not covered by the declared 'allowed-tools' preapproval. Review the host runtime's actual enforcement policy; runtime permissions are unknown unless separately verified, and this declaration alone does not establish a permission ceiling.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
## What your owner sets up once
1. A prepaid compute balance and a compute key on it:
`POST https://api.agentgates.ai/api/compute/credits` with `{"amountUsd": 5}`
(1, 5, 25 or 100), paid over x402 by their wallet, then
`POST https://api.agentgates.ai/api/compute/keys` with `{"name": "my-agent"}`,
signed by that wallet. Contract: `GET https://api.agentgates.ai/api/compute/docs`.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
1. A prepaid compute balance and a compute key on it:
`POST https://api.agentgates.ai/api/compute/credits` with `{"amountUsd": 5}`
(1, 5, 25 or 100), paid over x402 by their wallet, then
`POST https://api.agentgates.ai/api/compute/keys` with `{"name": "my-agent"}`,
signed by that wallet. Contract: `GET https://api.agentgates.ai/api/compute/docs`.
2. A prepaid inference balance and a key on it: the same two calls under
`/api/inference/credits` and `/api/inference/keys`. Contract:
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
`POST https://api.agentgates.ai/api/compute/credits` with `{"amountUsd": 5}`
(1, 5, 25 or 100), paid over x402 by their wallet, then
`POST https://api.agentgates.ai/api/compute/keys` with `{"name": "my-agent"}`,
signed by that wallet. Contract: `GET https://api.agentgates.ai/api/compute/docs`.
2. A prepaid inference balance and a key on it: the same two calls under
`/api/inference/credits` and `/api/inference/keys`. Contract:
`GET https://api.agentgates.ai/api/inference/docs`.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
signed by that wallet. Contract: `GET https://api.agentgates.ai/api/compute/docs`.
2. A prepaid inference balance and a key on it: the same two calls under
`/api/inference/credits` and `/api/inference/keys`. Contract:
`GET https://api.agentgates.ai/api/inference/docs`.
3. The two secrets in your environment: `AGENTGATES_COMPUTE_KEY` (agc_...) and
`AGENTGATES_INFERENCE_KEY` (ag_...).
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
refuses when `--max-usd` is missing, the price is over it, or the balance is
short or cannot be read. Only then does it buy the machine (default
`compute.standard`, 1 hour; `--hours N` or `--minutes 15|30|45`, `--model <id>`
from `GET https://api.agentgates.ai/api/inference/catalog`), and it checks the
charge against `--max-usd` after, exiting with code 2 if the price moved past
it. It makes a fresh gateway token, seals it into the machine with the
inference key, keeps it in `~/.agentgates/openclaw-machines.json` (readable by
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
included. So keep wallet keys, exchange keys and private data on confidential
machines, give plain workers public work only, and have them send their results
back to you. The catalog marks a plain plan with `"proof": "none"`
(`GET https://api.agentgates.ai/api/compute/catalog`). A plain plan sells while
its host has room: when it has none, `price` and `start` say so and nothing is
bought.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
carries on where it was.
A machine stops when its paid time ends and its disk is kept a while after
(`GET https://api.agentgates.ai/api/compute/docs`, "Lifecycle"). Renew before
`expiresAt` to keep it. Your compute key cannot destroy a machine; your owner's
wallet can.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# OpenClaw on an Agentgates computer: a confidential VM, or a plain VM for a
# worker with nothing secret on it.
#
# Send this file as the "compose" of POST https://api.agentgates.ai/api/compute/deployments.
# The gateway answers at the machine's endpoint (host port 8080).
#
# Sealed env (the create call's "env"; never write them into this file):
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Sealed env (the create call's "env"; never write them into this file):
# OPENCLAW_GATEWAY_TOKEN required: the gateway's bearer, 64 random hex characters
# AGENTGATES_API_KEY required: an Agentgates inference key (ag_...) on a prepaid balance
# AGENTGATES_MODEL optional: a model id from GET https://api.agentgates.ai/api/inference/catalog
# OPENCLAW_TRUSTED_PROXIES plain VM only: the private range its https name's proxy reaches
# the gateway from, 172.16.0.0/12 (the skill's script sends it)
#
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
token into the machine with `POST /api/compute/deployments/{id}/update`. Runs
side by side are safe: each change to the file takes a lock. Before you send a
confidential machine secrets, check its proof page,
`https://api.agentgates.ai/compute/verify/<deploymentId>`: its compose hash, OS
image hash and Intel TDX quote. A plain VM has no proof page: send it no
secrets.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
`node {baseDir}/scripts/openclaw-machine.mjs body --name worker-2 --minutes 15`
prints the create body (this compose, a fresh token, the inference key) and
saves the token. The body holds both secrets: keep it out of logs and send it
only to `https://api.agentgates.ai/api/compute/deployments`, with your x402
client. The `402` names the exact price on each network, asking it is free, and
your client signs that exact amount, so keep its per-payment cap at your
owner's budget. Then run `attach worker-2 <deploymentId>` and `list` until it
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
OPENCLAW_GATEWAY_TOKEN: ${OPENCLAW_GATEWAY_TOKEN:-}
AGENTGATES_API_KEY: ${AGENTGATES_API_KEY:-}
AGENTGATES_MODEL: ${AGENTGATES_MODEL:-glm-5-3-flash}
AGENTGATES_BASE_URL: ${AGENTGATES_BASE_URL:-https://api.agentgates.ai/api/inference/v1}
OPENCLAW_TRUSTED_PROXIES: ${OPENCLAW_TRUSTED_PROXIES:-}
TZ: UTC
volumes: