ClawHub
Back to skill

Security audit

openclaw-connect子节点专用skill

Security checks for vulnerabilities and agentic risk

Overview

This node package is mostly consistent with its stated remote-worker purpose, but it grants broad persistent root-level remote execution and data-sync authority with weak local controls.

Install only on an isolated host you control, pointed at a trusted Hub, and treat it as a high-privilege remote execution agent. Before production use, run it as a dedicated unprivileged service account, bind administrative APIs to localhost or add authentication, disable automatic task execution and memory sync unless explicitly needed, protect or redact secrets, require HTTPS, and regenerate dependencies from trusted HTTPS registries.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (7)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
server/src/index.ts:199
Finding

Automatic Exfiltration of Agent Memory and Identity Data

Content
View full analysis
0) { heartbeatPayload.memories = pendingMemories; } await axios.post( `${hubUrl}/api/nodes/${nodeId}/heartbeat`, heartbeatPayload, { headers: { Authorization: `Bearer ${sessionToken}` }, timeout: 10000, } ); ``` ```ts const WORKSPACE = path.join(homeDir, '.openclaw/workspace'); const MEMORY_MD = path.join(WORKSPACE, 'MEMORY.md'); const MEMORY_DIR = path.join(WORKSPACE, 'memory'); if (fs.existsSync(MEMORY_MD)) { const text = fs.readFileSync(MEMORY_MD, 'utf-8'); const sections = parseMarkdownSections(text); for (const s of sections) { addMemory('ltm', s.title, s.body, ['workspace']); } } if (fs.existsSync(MEMORY_DIR)) { cons ...[truncated 1857 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
server/src/index.ts:537
Finding

Unrestricted Automatic Execution of Remote Hub Tasks

Content
View full analysis
(t.status === 'pending' || t.status === 'assigned') && !executingTaskIds.has(t.id) ); for (const task of toExecute) { executeTask(task); } ``` ### Technical Analysis Tasks obtained from the Hub are automatically converted into prompts and executed through the local OpenClaw Gateway or CLI. The use of `execFileSync` avoids direct shell metacharacter injection, but it does not mitigate the core trust-boundary problem: attacker-controlled task content is intentionally supplied to an Agent that may possess filesystem, network, command, and tool access. There is no local approval, task signature, capability allowlist, tool policy, prompt-content restriction, or isolated operating-system sandbox. The executor is enabled by default unless `TASK_EXECUTOR=false` is set. When installed through the provided installation script, thi ...[truncated 969 chars]
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
install-node.sh:20
Finding

Remote Scripts Are Piped Directly into a Root Shell

Content
View full analysis
/dev/null apt-get install -y nodejs 2>/dev/null || { curl -fsSL https://rpm.nodesource.com/setup_22.x | bash - 2>/dev/null yum install -y nodejs 2>/dev/null || error "Node.js installation failed" } ``` ```sh if command -v apt-get &>/dev/null; then curl -fsSL https://deb.nodesource.com/setup_22.x | bash - 2>/dev/null apt-get install -y nodejs 2>/dev/null || error "Node.js installation failed" elif command -v yum &>/dev/null; then curl -fsSL https://rpm.nodesource.com/setup_22.x | bash - 2>/dev/null yum install -y nodejs 2>/dev/null || error "Node.js installation failed" fi ``` ### Technical Analysis The documented installation method and automatic Node.js setup execute downloaded scripts immediately without storing them for review or verifying a version, checksum, or cryptographic signature. The installer requires root privileges, so the retrieved script receives unrestricted system access. HTTPS reduces passive interception but does not protect against compromise of the remote endpoint, DNS or certificate infrastructure, an administrator-controlled `your-hub` endpoint, or an upstream account. The effective payload can also change after the Skill package has been audited. ### Attack Path 1. An attacker compromises the Hub endpoint, NodeSource account, hosting infrastructure, or delivery path. 2. The attacker replaces the remotely served setup script. 3. An administrator runs the documented pipe-to-shell command or triggers automatic Node.js installation. 4. `bash` execu ...[truncated 434 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
install-node.sh:120
Finding

Boot-Persistent Remote Task Service Runs as Root

Content
View full analysis
"/etc/systemd/system/${SERVICE_NAME}.service" << SVCEOF [Unit] Description=OpenClaw Connect Node (${NODE_NAME}) After=network.target Wants=network-online.target [Service] Type=simple User=root WorkingDirectory=${INSTALL_DIR} EnvironmentFile=${INSTALL_DIR}/.env ExecStart=${NODE_PATH} --import tsx/esm ${INSTALL_DIR}/node/server/src/index.ts Restart=always RestartSec=10 StartLimitIntervalSec=300 StartLimitBurst=5 StandardOutput=journal StandardError=journal SyslogIdentifier=${SERVICE_NAME} LimitNOFILE=65535 MemoryMax=2G Environment=NODE_ENV=production Environment=NODE_NO_WARNINGS=1 KillMode=mixed KillSignal=SIGTERM TimeoutStopSec=30 [Install] WantedBy=multi-user.target SVCEOF systemctl daemon-reload systemctl enable "$SERVICE_NAME" 2>/dev/null ``` ### Technical Analysis The installer creates a system-wide systemd unit, configures it to start at boot, restarts it automatically, and runs it as root. Root access is not required for listening on port 3200, collecting ordinary process-level health information, or communicating with the Hub. The service also performs remote task execution. Consequently, a Hub compromise, vulnerable dependency, exposed API, or malicious Agent task inherits the service's root-level access. No systemd hardening directives such as `NoNewPrivileges`, `ProtectSystem`, `ProtectHome`, `PrivateTmp`, capability restrictions, or syscall filtering are applied. ### Attack Path 1. An administrator executes the installer as root. 2. The script installs and enables the systemd service. 3. The node starts at every boot and automatically reconnects to the Hub. 4. An attacker compromises the Hub, node API, depe ...[truncated 481 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
server/src/index.ts:1004
Finding

Network-Exposed Administrative and Hub-Proxy APIs Lack Authentication

Content
View full analysis
{ clearTimers(); connected = false; connecting = false; nodeId = ''; sessionToken = ''; addLog('info', 'Manually triggered reconnect...'); const ok = await registerWithHub(); return { code: 0, message: ok ? 'Reconnect successful' : 'Reconnect failed', data: { connected: ok } }; }); ``` ```ts app.post('/api/tasks/:id/complete', async (req) => { try { const result = await reportTaskAction( (req.params as any).id, 'complete', (req.body as any) || {} ); return { code: 0, message: 'Task completed', data: result.data }; } catch (err: any) { return { code: 500, message: err.message }; } }); ``` ```ts app.post('/api/agents', async (req) => { const { name, role, soulMd, capabilities, skills } = req.body as any; if (!name) return { code: 400, message: 'Agent name is required' }; if (sessionToken && nodeId) { const res = await axios.post( `${resolvedHubUrl()}/api/nodes/${nodeId}/agents/register`, { name, role, soulMd, capabilities, skills }, { headers: { Authorization: `Bearer ${sessionToken}` }, timeout: 10000, } ); return res.data; } return { code: 503, message: 'Not connected to Hub' }; }); ``` ```ts app.put('/api/collaborations/state/:key', async (req) => { if (!sessionToken) return { code: 503, message: 'Not connected to Hub' }; const { key } = req.params as any; const res = await axios.put( `${resolvedHubUrl()}/api/collaborations/state/${key}`, req.body, { headers: { Authorization: `Bearer ${sessionToken}` }, timeout: 10000, } ); return res.data; }); ``` ```ts await app.listen({ port: NODE_ ...[truncated 1495 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
server/src/index.ts:34
Finding

Hub Credentials and Session Tokens Are Persisted in Plaintext

Content
View full analysis
"$INSTALL_DIR/.env" << ENVEOF HUB_URL=${HUB_URL} NODE_APP_ID=${APP_ID} NODE_APP_KEY=${APP_KEY} NODE_TOKEN=${TOKEN} NODE_NAME=${NODE_NAME} NODE_PORT=${PORT} DATA_DIR=${INSTALL_DIR}/data NODE_ENV=production ENVEOF ``` The generated management command also includes: ```sh config) echo "Configuration file: ${ENV_FILE}" cat "$ENV_FILE" ;; ``` ### Technical Analysis Long-lived application credentials and the node session token are stored in JSON and `.env` files without explicit restrictive modes. The actual permissions depend on the process umask. The parent directory is also created without an explicit `0700` mode. The installer duplicates credentials across the environment file and persistent node configuration. Its management command prints the complete `.env`, increasing the chance that secrets will appear in terminal logs, support transcripts, or monitoring output. ### Attack Path 1. A local user, compromised service, backup process, or suppor ...[truncated 646 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
frontend/package-lock.json:31
Finding

Frontend Dependencies Are Resolved Through a Plaintext Third-Party Mirror

Content
View full analysis
&1 | tail -3 cd "$INSTALL_DIR/node/frontend" npm install 2>&1 | tail -3 npx vite build 2>&1 | tail -5 ``` ### Technical Analysis The frontend lockfile contains numerous package tarball URLs using plaintext HTTP through a third-party mirror. Plaintext transport does not authenticate the server or protect package responses from in-transit modification. Although npm integrity metadata can provide some protection when correctly present and enforced, relying on it does not justify insecure transport or an unapproved mirror. The installer also uses `npm install` rather than deterministic `npm ci` and runs as root, allowing dependency lifecycle scripts to execute with excessive privileges. ### Attack Path 1. An attacker intercepts plaintext mirror traffic or compromises the third-party mirror. 2. The attacker attempts to supply modified package content or influence dependency resolution. 3. The root installer runs `npm install`. 4. A malicious dependency or lifecycle script executes during installation, or malicious code is included in the frontend build. 5. The attacker compromi ...[truncated 370 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (109)

Credential Access

High
Category
Privilege Escalation
Confidence
82% confidence
Finding

The troubleshooting instructions tell users to source .env, which imports secrets such as NODE_APP_KEY and NODE_TOKEN into the interactive shell environment. This increases exposure risk because credentials may be inherited by child processes, captured in debugging output, or mishandled during support sessions; in a security-sensitive node that authenticates to a central Hub, that context makes the practice more dangerous.

Content

Scanner excerpt · README.md (reported line 173)May include surrounding context.

手动启动测试

cd /opt/openclaw-node source .env cd node/server && npx tsx src/index.ts

text

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 197)May include surrounding context.

ss -tlnp | grep :3200

修改端口

vim /opt/openclaw-node/.env # 修改 NODE_PORT openclaw-node restart

text

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
97% confidence
Finding

axios 1.13.6 is flagged with multiple advisories including SSRF/proxy bypass and prototype-pollution-related MITM or credential exposure conditions. Because axios is a direct application dependency, these issues can affect real request handling depending on how the app constructs outbound requests and trusts configuration.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.1 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High
Category
Supply Chain
Confidence
87% confidence
Finding

browserslist 4.28.1 is flagged for crash/prototype-write and unbounded memory growth issues involving untrusted query or stats input. Although typically a build-time dependency, compromise of CI/build stability or configuration poisoning can still be meaningful in shared pipelines.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
85% confidence
Finding

form-data 4.0.5 is flagged for CRLF injection via unescaped multipart field names/filenames. If attacker-controlled values are ever used to construct multipart requests, this can corrupt requests or enable header/body injection to downstream services.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High
Category
Supply Chain
Confidence
80% confidence
Finding

nanoid 3.3.11 is flagged for integer/looping issues that can lead to denial of service under certain generator/size conditions. Here it is a dev dependency via postcss, so the main exposure is build-time instability rather than direct production compromise.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: picomatch==2.3.1 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High
Category
Supply Chain
Confidence
84% confidence
Finding

picomatch 2.3.1 is flagged for ReDoS and glob matching manipulation issues. As a tooling dependency, it can still allow CPU exhaustion or incorrect file selection if attacker-controlled glob patterns are processed in development or CI contexts.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.8 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High
Category
Supply Chain
Confidence
90% confidence
Finding

postcss 8.5.8 is flagged with multiple issues including arbitrary file read, information disclosure, and potential XSS in stringify output. Although primarily a build-time dependency, many CSS toolchains process external or repository-supplied content, so compromise can affect CI secrets or generated artifacts.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: picomatch==4.0.3 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High
Category
Supply Chain
Confidence
84% confidence
Finding

picomatch 4.0.3 is also flagged for ReDoS and method-injection style glob parsing issues. Even as a dev dependency, malicious patterns can consume CPU or affect file matching behavior in tooling pipelines.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==5.4.21 — 3 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-53632 (launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows)

High
Category
Supply Chain
Confidence
92% confidence
Finding

vite 5.4.21 is flagged for path traversal, deny-bypass on Windows paths, and UNC handling issues. Because Vite operates a development server and processes project files, these issues can expose local files or developer credentials in realistic development setups.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.8 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High
Category
Supply Chain
Confidence
89% confidence
Finding

The resolved PostCSS version is associated with multiple advisories including arbitrary file read/information disclosure and XSS-related behavior. Although PostCSS is primarily a build-time dependency here, malicious CSS or crafted source mapping input in development/CI pipelines could expose files or taint generated output; this is especially relevant because it is part of the frontend toolchain. The skill context slightly reduces runtime exposure but still leaves meaningful supply-chain and developer-environment risk.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==5.4.21 — 3 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-53632 (launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows)

High
Category
Supply Chain
Confidence
90% confidence
Finding

The resolved Vite version is flagged for path traversal and Windows-specific filesystem/UNC handling issues. Because Vite is a development server and build tool, exploitation is most likely during local development or preview environments rather than production runtime, but it can still expose developer files, bypass intended filesystem restrictions, or leak credentials such as NTLM hashes on Windows. In this frontend context, the danger is concentrated in developer and CI environments using Vite.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The usage instructions explicitly encourage curl ... | bash for remote execution of installer code. This is highly dangerous because it executes unaudited network-delivered script content directly, and the installer requires root, so any compromise of the distribution path yields immediate full-system code execution.

Content

Scanner excerpt · install-node.sh (reported line 21)May include surrounding context.

sh
#       --node-name "我的节点" --from-local
#
#   方式三 (远程 curl):
#     curl -sSL https://your-hub/install-node.sh | bash -s -- \
#       --hub-url http://YOUR_HUB_IP:3100 \
#       --app-id xxx --app-key xxx --token xxx \
#       --node-name "��的节点"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install-node.sh (reported line 261)May include surrounding context.

sh
# Fallback if rsync not available
      cp -r "$PROJECT_ROOT/"* "$INSTALL_DIR/" 2>/dev/null
      # Clean up node_modules if copied
      rm -rf "$INSTALL_DIR/node/server/node_modules" "$INSTALL_DIR/node/frontend/node_modules" 2>/dev/null
    }
  fi
  success "本地代码已就绪 ✓"

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

This section generates a .env file containing sensitive credentials (APP_KEY, TOKEN) in a predictable location under /opt/openclaw-node. Storing long-lived secrets in plaintext on disk increases risk of credential disclosure through local access, backups, support scripts, or accidental exposure.

Content

Scanner excerpt · install-node.sh (reported line 294)May include surrounding context.

sh
echo ""

# ═══════════════════════════════════════════════════════════════════
# Step 4: Generate .env Configuration
# ═══════════════════════════════════════════════════════════════════
info "Step 4/7: 生成配置文件..."

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The here-document writes hub credentials directly into ${INSTALL_DIR}/.env without setting restrictive permissions first. In a root-run installer, default umask may leave the file more widely readable than intended, exposing authentication material needed to impersonate the node or access the hub.

Content

Scanner excerpt · install-node.sh (reported line 301)May include surrounding context.

sh
# Create data directory
mkdir -p "$INSTALL_DIR/data"

cat > "$INSTALL_DIR/.env" << ENVEOF
# ═══════════════════════════════════════════════════════════════════
# OpenClaw Connect Node Configuration
# Generated at: $(date '+%Y-%m-%d %H:%M:%S')

Credential Access

High
Category
Privilege Escalation
Confidence
83% confidence
Finding

Announcing the exact location of the secrets-bearing .env file is not the main issue, but in combination with plaintext storage it lowers the effort for local discovery by users or scripts. The context makes this more concerning because the script later provides a management command that can print the file contents directly.

Content

Scanner excerpt · install-node.sh (reported line 324)May include surrounding context.

sh
NODE_ENV=production
ENVEOF

success "配置文件已生成: $INSTALL_DIR/.env ✓"
echo ""

# ═══════════════════════════════════════════════════════════════════

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Referencing the plaintext .env through EnvironmentFile= loads secrets into the service environment, where they may be exposed through process inspection, debugging, crash dumps, or overly permissive service management practices. Running the service as root amplifies the consequences of any compromise involving those credentials.

Content

Scanner excerpt · install-node.sh (reported line 349)May include surrounding context.

sh
Type=simple
User=root
WorkingDirectory=${INSTALL_DIR}
EnvironmentFile=${INSTALL_DIR}/.env
ExecStart=${NODE_PATH} --import tsx/esm ${INSTALL_DIR}/node/server/src/index.ts
Restart=always
RestartSec=10

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

The generated management command includes a config action that prints the entire .env file, directly exposing APP_KEY and TOKEN to anyone with permission to run the helper. This turns passive plaintext-at-rest risk into active easy credential disclosure.

Content

Scanner excerpt · install-node.sh (reported line 393)May include surrounding context.

sh
SERVICE_NAME="PLACEHOLDER_SERVICE"
INSTALL_DIR="PLACEHOLDER_DIR"
ENV_FILE="${INSTALL_DIR}/.env"

RED='\033[0;31m'
GREEN='\033[0;32m'

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · install-node.sh (reported line 434)May include surrounding context.

sh
PORT=$(grep NODE_PORT "$ENV_FILE" 2>/dev/null | cut -d= -f2)
    PORT=${PORT:-3200}
    echo -e "${CYAN}健康检查:${NC}"
    curl -s "http://localhost:${PORT}/health" 2>/dev/null | python3 -m json.tool 2>/dev/null || \
    curl -s "http://localhost:${PORT}/health" 2>/dev/null || \
    echo "  (无法连接到 http://localhost:${PORT}/health)"
    ;;

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · install-node.sh (reported line 471)May include surrounding context.

sh
health)
    PORT=$(grep NODE_PORT "$ENV_FILE" 2>/dev/null | cut -d= -f2)
    PORT=${PORT:-3200}
    curl -s "http://localhost:${PORT}/api/health" 2>/dev/null | python3 -m json.tool 2>/dev/null || \
    curl -s "http://localhost:${PORT}/api/health" 2>/dev/null || \
    echo -e "${RED}无法连接到健康检查端点${NC}"
    ;;

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The code explicitly performs automatic collection and upstream synchronization of workspace memory contents during heartbeat. In a node/agent product, these files are likely to contain user prompts, notes, operational context, and other sensitive material, so automatic remote transmission materially increases confidentiality risk.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The collector broadly harvests MEMORY.md and recent memory/*.md files, parses section bodies, and queues them for synchronization. This broad file ingestion expands the blast radius of any sensitive data stored in the workspace and can leak proprietary or personal information to the Hub without strong minimization or user review.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The script accepts a user-controlled service name and, when run as root, deletes /etc/systemd/system/${SERVICE_NAME}.service without validating that the name belongs to the intended application. An attacker or mistaken operator could supply a different service name and cause deletion of arbitrary systemd unit files, impacting system integrity and service availability.

Content

Scanner excerpt · uninstall-node.sh (reported line 69)May include surrounding context.

sh
echo -e "${CYAN}[3/4] 删除 systemd 配置...${NC}"
if [[ -f "/etc/systemd/system/${SERVICE_NAME}.service" ]]; then
  rm -f "/etc/systemd/system/${SERVICE_NAME}.service"
  systemctl daemon-reload
  echo -e "${GREEN}  ✓ systemd 配置已删除${NC}"
else

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The script deletes /usr/local/bin/${SERVICE_NAME} based on an untrusted command-line parameter while running with root privileges. Because the parameter is not constrained to the product's expected binary name, a malicious or accidental value could remove unrelated administrative commands and disrupt system operation.

Content

Scanner excerpt · uninstall-node.sh (reported line 78)May include surrounding context.

sh
echo -e "${CYAN}[4/4] 删除管理命令...${NC}"
if [[ -f "/usr/local/bin/${SERVICE_NAME}" ]]; then
  rm -f "/usr/local/bin/${SERVICE_NAME}"
  echo -e "${GREEN}  ✓ 管理命令已删除${NC}"
else
  echo "  管理命令不存在，跳过"

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
server/src/index.ts:162

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
server/src/index.ts:16