openclaw-connect子节点专用skill

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

A trusted Hub operator, or anyone who compromises the Hub or node credentials, may be able to make the local agent perform actions on the user's machine or accounts.

Why it was flagged

The skill explicitly turns the local OpenClaw instance into a worker that automatically receives and executes Hub-sent tasks through powerful local execution paths.

Skill content

节点每 30 秒向 Hub 拉取新任务... 执行方式（按优先级）：本地 OpenClaw Gateway（POST /tools/invoke）... Hub Execute API... OpenClaw CLI（openclaw agent）

Recommendation

Install only against a Hub you fully trust, use a dedicated low-privilege environment, and require clear approval/scope controls for task execution.

ConcernHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installation may execute or deploy code that was not part of this reviewed package, with system-level privileges.

Why it was flagged

The installer is root-level and can pull the current contents of an unpinned branch from an external Git repository, which may differ from the reviewed artifact.

Skill content

请使用 root 用户运行此脚本... GIT_BRANCH="main"... git clone --branch "$GIT_BRANCH" --depth 1 "$GIT_REPO" "$INSTALL_DIR"

Recommendation

Prefer installing the reviewed local artifact, pin Git commits or release hashes, verify checksums, and avoid running remote installers as root unless the source is trusted.

ConcernHigh Confidence

ASI06: Memory and Context Poisoning

What this means

Private agent identity, prompt/profile content, channel type, and installed skill names may be disclosed to the configured Hub.

Why it was flagged

The node reads local OpenClaw profile/context data and sends it to the Hub during agent registration.

Skill content

const soulPath = path.join(homeDir, '.openclaw/workspace/SOUL.md'); ... soulMd = fs.readFileSync(soulPath, 'utf-8').slice(0, 2000); ... axios.post(`${hubUrl}/api/nodes/${nodeId}/agents/register`, { ... soulMd, channel, capabilities, skills })

Recommendation

Review SOUL.md and IDENTITY.md before connecting, disclose this upload clearly, and provide an opt-out or minimization option for agent profile sync.

ConcernMedium Confidence

ASI07: Insecure Inter-Agent Communication

What this means

If used across an untrusted network, node credentials, task metadata, or control traffic could be exposed or tampered with.

Why it was flagged

The documented Hub control channel uses HTTP/WebSocket examples for credentials, heartbeats, and task polling, with no TLS requirement described.

Skill content

HUB_URL=http://你的Hub地址:3100 ... HTTP REST + WebSocket ... 心跳 30s / 任务拉取 30s

Recommendation

Use HTTPS/WSS or a private authenticated network, and document how Hub identity, transport security, and task authorization are enforced.

ConcernHigh Confidence

ASI10: Rogue Agents

What this means

The remote worker may continue running and accepting Hub-directed work after setup unless the user explicitly disables or uninstalls it.

Why it was flagged

The node is intended to run as a persistent daemon and keep reconnecting rather than stopping after a single user-requested task.

Skill content

🔄 systemd 守护进程 ... 心跳间隔：30秒 ... 连续失败会记录错误日志但不会停止重试

Recommendation

Make persistence explicit during installation, provide easy stop/disable commands, and run the daemon under a restricted service account.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

Anyone who can read that local file may be able to reuse node credentials or impersonate the node to the Hub.

Why it was flagged

Hub app credentials and the session token are persisted locally so the node can reconnect after restarts.

Skill content

const NODE_CONFIG_PATH = path.join(os.homedir(), '.openclaw-node', 'node.json'); ... appKey: string; appToken: string; sessionToken: string; ... fs.writeFileSync(NODE_CONFIG_PATH, JSON.stringify(cfg, null, 2), 'utf-8')

Recommendation

Protect the config file with restrictive permissions, rotate credentials if exposed, and declare the required credentials in registry metadata.

Findings (2)

critical

suspicious.dangerous_exec

Location: server/src/index.ts:162
Finding: Shell command execution detected (child_process).

critical

suspicious.env_credential_access

Location: server/src/index.ts:16
Finding: Environment variable access combined with network send.