agent-pack-n-go

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:34 AM UTC
• Version: 2.3.2

Overview

This skill does what it says, but it asks for very broad system and credential access that users should review carefully before installing.

Install only if both devices are fully trusted and you are comfortable cloning secrets. Before use, avoid NOPASSWD:ALL, review cron entries, exclude or regenerate SSH private keys where possible, encrypt the migration archive, delete it immediately after verification, and avoid skipped-permission automation.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/setup.sh:149

Finding

Unverified Remote Installation Scripts Are Piped Directly to Bash

Content

View full analysis

/dev/null; then echo -e "[5/${TOTAL}] nvm installed (official source) ${GREEN}✅${NC}" elif run_with_spinner "Installing nvm (Gitee mirror)..." _nvm_install_gitee 2>/dev/null; then echo -e "[5/${TOTAL}] nvm installed (Gitee mirror) ${GREEN}✅${NC}" else fail "nvm installation failed, please check network connectivity." fi ``` ### Technical Analysis The setup process retrieves shell code from an external URL and immediately executes it using `bash`. Neither downloaded script is verified against an expected cryptographic digest or trusted signature before execution. Although `NVM_VERSION` is set to a specific tag, a tag or URL alone does not authenticate the returned content. The effective payload can change after the Skill has been audited if an upstream account, repository reference, mirror, DNS path, TLS trust chain, or hosting platform is compromised. The Gitee fallback creates an additional supply-chain trust boundary. A failure to contact the official source automatically causes code from the mirror to be executed without requiring separate user approval. ### Attack Path 1. An attacker compromises an upstream repository account, tag, mirror, hosting service, or relevant network trust path. 2. The attacker modifies the script returned for the configured NVM installation URL. 3. The user invokes the Skill on the mig ...[truncated 1002 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/pack.sh:13

Finding

Sensitive Credential and SSH-Key Archive Is Stored Without Enforced Protection

Content

View full analysis

/dev/null 2>&1; then tar cz -C "$TMP_DIR" . | pv -s "$(du -sb "$TMP_DIR" | cut -f1)" > "$PACK_FILE" else tar czf "$PACK_FILE" -C "$TMP_DIR" . fi ``` Automated deployment removes only the extracted temporary directory and explicitly retains the archive: ```bash rm -rf "$MIGRATION_TMP" echo -e " ${GREEN}✅${NC}" echo -e " ${YELLOW}ℹ️ setup.sh + deploy.sh kept for reference${NC}" echo -e " ${YELLOW}ℹ️ To free space after verification: rm ~/openclaw-migration-pack.tar.gz ~/openclaw-migration-pack.sha256${NC}" ``` ### Technical Analysis The migration archive contains high-value secrets, including: - OpenClaw API keys and channel credentials - Claude Code settings and OAuth credentials - Every file under `~/.ssh`, including private keys - Agent memory and workspace contents - Execution approval configuration - Scheduled tasks and other operational configuration The packing script does not set `umask 077`, does not explicitly apply mode `0600` ...[truncated 2097 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:98

Finding

Migration Workflow Grants Unrestricted Passwordless Root Access

Content

View full analysis

Remediation

View remediation

T06 · System Persistence

Warning

• Location: scripts/deploy.sh:181

Finding

Source Crontab Is Automatically Activated on the Target Without Review

Content

View full analysis

"$TMP_DIR/crontab-backup.txt" 2>/dev/null; then CRON_COUNT=$(grep -v "^#" "$TMP_DIR/crontab-backup.txt" 2>/dev/null | grep -c "[^[:space:]]" || echo 0) echo -e " ${GREEN}✅${NC} (${CRON_COUNT} 条任务)" else echo "# no crontab" > "$TMP_DIR/crontab-backup.txt" echo -e " ${YELLOW}⚠️ crontab is empty, created empty file${NC}" fi ``` The complete file is then installed automatically on the target: ```bash echo -n "[${step}/${TOTAL}] Restoring crontab..." if [ -f "$MIGRATION_TMP/crontab-backup.txt" ] && grep -qv '^#' "$MIGRATION_TMP/crontab-backup.txt" 2>/dev/null; then crontab "$MIGRATION_TMP/crontab-backup.txt" && { CRON_COUNT=$(crontab -l 2>/dev/null | grep -cv '^#' || echo 0) echo -e " ${GREEN}✅${NC} (${CRON_COUNT} 条任务)" } || { echo -e " ${RED}❌ crontab restore failed${NC}" FAILED_STEPS+=("Step ${step}: restore crontab") } else echo -e " ${YELLOW}⚠️ crontab backup empty, skipping${NC}" fi ``` ### Technical Analysis Cron migration is related to the declared full-device-clone functionality, but the implementation restores every source entry without presenting its contents for approval, limiting migration to OpenClaw-related tasks, validating referenced commands, or initially disabling the entries. A source crontab can contain stale, destructive, compromised, host-specific, or malicious commands. Automatic activation converts all such entries into cross-session persistence on the new device. Simple username path replacement does not establish that a command is safe or appropriate for the target environme ...[truncated 1154 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:220

Finding

Unpinned Global Packages and Migrated Python Requirements Are Executed

Content

View full analysis

/dev/null 2>&1; then echo -e " ${GREEN}✅ Already installed ($(claude --version 2>/dev/null || echo 'unknown'))${NC}" else if run_with_spinner "Installing Claude Code..." \ timeout 120 npm install -g @anthropic-ai/claude-code; then ok else echo -e " ${YELLOW}⚠️ Install timeout, trying npmmirror...${NC}" npm config set registry https://registry.npmmirror.com if run_with_spinner "Installing Claude Code (npmmirror)..." \ timeout 120 npm install -g @anthropic-ai/claude-code; then echo -e "[8/${TOTAL}] Claude Code installed (npmmirror) ${GREEN}✅${NC}" else fail "Claude Code installation failed, please check network" fi fi fi ``` ```bash npm install -g openclaw mcporter > /tmp/npm-install.log 2>&1 && { OC_VER=$(openclaw --version 2>/dev/null || echo "unknown") echo -e " ${GREEN}✅${NC} (openclaw ${OC_VER})" } || { echo -e " ${RED}❌ npm install failed (see /tmp/npm-install.log)${NC}" FAILED_STEPS+=("Step ${step}: npm install openclaw mcporter") } ``` ```bash if [ -f ~/openclaw-dashboard/backend/requirements.txt ]; then timeout 120 pip3 install \ -r ~/openclaw-dashboard/backend/requirements.txt \ > /tmp/pip-dashboard.log 2>&1 || true fi ``` ### Technical Analysis The Skill installs global npm packages without exact versions or lockfile integrity metadata. This causes migration behavior to depend on whatever package versions and dependency graphs are current at execution time rather than the versions reviewed with the Skill. On network failure, the script changes the persistent npm registry to a mirror and retries in ...[truncated 1557 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (151)

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The quick-start instructions encourage users to hand over SSH credentials and allow the agent to automate the full transfer process. That normalizes high-trust behavior around secret handling and remote control, making accidental overexposure or misuse more likely in a real deployment context.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README normalizes the agent asking for SSH credentials and handling everything automatically, but does not prominently warn that the operation can transfer highly sensitive data and modify another system. Users may authorize the workflow without understanding that credentials, memory, and keys may be copied and deployed remotely.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The README frames transfer of highly sensitive local data—including credentials, OAuth material, SSH keys, and system configuration—as normal operation. Duplicating such secrets to another device substantially increases the blast radius of compromise and can directly enable lateral movement or account takeover if the destination is less trusted or later breached.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The list of cloned items explicitly includes credential stores and SSH keys, yet the README provides no strong warning about the consequences of duplicating private keys, OAuth tokens, and agent memory onto another host. This can lead to credential compromise, unauthorized access propagation, and long-lived secret sprawl.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description promises an end-to-end automated clone workflow: collect all agent data on the old device, securely transfer it with SCP, then remotely deploy and restore it on the new device via SSH. The supplied code does none of that directly. It only writes a migration-instructions.md document containing step-by-step manual commands for a user or another agent to run locally. Its primary purpose is instruction generation, not migration execution. It also includes system-level restoration actions and package/service configuration steps that are not mentioned in the declared purpose. While these may support migration, the lack of actual packaging, transfer, and auto-deployment makes the description materially inaccurate for this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a device migration/agent cloning capability, including collecting sensitive agent assets and transferring/restoring them on a new machine. The actual code does not implement any migration behavior. Its sole function is to test outbound network connectivity to several services and classify the environment as DIRECT, PROXY_NEEDED, or NO_INTERNET. While such a check could be a supporting helper for a migration workflow, the supplied chunk by itself has a materially different primary purpose and lacks the core behaviors described. Therefore this code chunk does not accurately match the declared skill description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The description promises an end-to-end migration/cloning workflow spanning old-device packaging, secure transfer, and automatic deployment on the new device. The actual code only handles part of the destination-side preparation and partial restore from an already-present local archive (~/openclaw-migration-pack.tar.gz). It sets up runtime dependencies and restores Claude config and SSH keys, but does not perform scp, SSH orchestration, source-device cloning, full agent restoration, or automatic deployment. This is a material purpose mismatch rather than a minor implementation detail difference.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a material mismatch between the declared purpose and the supplied code chunk. The description presents the skill as an operational agent migration utility with sensitive capabilities such as handling credentials, transferring data to another device, and remote deployment. The actual code only echoes a post-install informational message. While the message itself is consistent with the declared post-install text, the code shown does not implement the primary declared functionality at all.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The pipeline writes attacker-significant content directly into a privileged sudoers path through sudo tee, combining shell chaining with privilege elevation. Even though the template shows a fixed string, this pattern is dangerous in agent workflows because small substitutions or user-controlled values can turn it into arbitrary privileged file modification.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

Ask user to run:

bash

ssh USER@NEW_IP 'echo "USERNAME ALL=(ALL) NOPASSWD:ALL" | sudo tee /etc/sudoers.d/migration'

(Replace USERNAME with the actual SSH user. This will prompt for password one last time.)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

md

(Replace `USERNAME` with the actual SSH user. This will prompt for password one last time.)

> **Security note:** After clone is verified (Phase 4), user can remove this with:
> `ssh USER@NEW_IP 'sudo rm /etc/sudoers.d/migration'`

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 302)May include surrounding context.

md

>
> 🧹 **后续清理（3-7 天后）：**
> - 新设备上删除临时文件：`rm ~/openclaw-migration-pack.tar.gz ~/setup.sh ~/deploy.sh ~/migration-instructions.md`
> - （可选）旧设备移除 sudoers：`sudo rm /etc/sudoers.d/migration`
> - （可选）旧设备关闭服务：`systemctl --user disable openclaw-gateway`
>
> 🦁 **Enjoy your new home!**

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 95% confidence

Finding

The document instructs the agent to write ~/.claude/settings.json, which is a sensitive agent configuration file likely containing API endpoints and credentials. In a migration skill that already moves secrets and later runs Claude Code with reduced safeguards, automated write access to this directory materially increases the risk of credential tampering, persistence, or redirection to attacker-controlled services.

Content

Scanner excerpt · references/migration-guide.md (reported line 92)May include surrounding context.

md

#    User replies via Discord/Feishu

# 3. Agent writes config
# ~/.claude/settings.json

# 4. Agent tests
claude "hello test"

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The guide explicitly instructs the user to run Claude Code with --dangerously-skip-permissions, which disables execution safeguards before processing a migration instruction file that performs package installation, system modification, credential restoration, and service management. In this skill’s context, that creates a direct path for unreviewed code or prompt-driven actions to access secrets and execute privileged operations on the new host.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/migration-guide.md (reported line 339)May include surrounding context.

bash

# Clean up sensitive files after migration
rm -rf ~/migration-tmp/
rm ~/openclaw-migration-pack.tar.gz
rm ~/setup.sh
# migration-instructions.md can be kept for reference

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/migration-guide.md (reported line 341)May include surrounding context.

Clean up sensitive files after migration

rm -rf ~/migration-tmp/ rm ~/openclaw-migration-pack.tar.gz rm ~/setup.sh

migration-instructions.md can be kept for reference

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The guide explicitly migrates ~/.ssh/ including id_ed25519, meaning the skill packages and restores private SSH keys onto another device. This is highly sensitive credential material; in the context of automated transfer, remote deployment, and reduced permission checks, compromise of either endpoint or workflow exposes reusable authentication secrets.

Content

Scanner excerpt · references/migration-guide.md (reported line 422)May include surrounding context.

md

| Claude Code fails to start | npm install overwrote the nvm wrapper | Rebuild the bash wrapper script |
| Discord images fail to load | CDN DNS resolution failure | Add Discord CDN static entries to /etc/hosts |
| workspace path errors | Different username on old/new device | Use sed to bulk-replace paths in openclaw.json |
| git push fails | SSH key permissions wrong | `chmod 600 ~/.ssh/id_ed25519` |
| Service dies after SSH logout | systemd user session terminated | `sudo loginctl enable-linger $USER` |
| OpenClaw port already in use | Old process not cleaned up | Kill old process or change port in openclaw.json |
| Discord Bot offline | Same token running on two devices | Ensure old device is stopped before starting new one |

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/troubleshooting.md (reported line 11)May include surrounding context.

Solution:

bash

# Use a third-party API proxy, modify ~/.claude/settings.json
# Change apiBaseUrl to your proxy address
{
  "apiBaseUrl": "https://your-api-proxy.example.com",

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/deploy.sh (reported line 403)May include surrounding context.

sh

**Solution**:
```bash
# Use a third-party API proxy, modify ~/.claude/settings.json
# Change apiBaseUrl to your proxy address
{
  "apiBaseUrl": "https://your-api-proxy.example.com",

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/deploy.sh (reported line 404)May include surrounding context.

sh

**Solution**:
```bash
# Use a third-party API proxy, modify ~/.claude/settings.json
# Change apiBaseUrl to your proxy address
{
  "apiBaseUrl": "https://your-api-proxy.example.com",

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/deploy.sh (reported line 408)May include surrounding context.

sh

**Solution**:
```bash
# Use a third-party API proxy, modify ~/.claude/settings.json
# Change apiBaseUrl to your proxy address
{
  "apiBaseUrl": "https://your-api-proxy.example.com",

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/deploy.sh (reported line 428)May include surrounding context.

sh

**Solution**:
```bash
# Use a third-party API proxy, modify ~/.claude/settings.json
# Change apiBaseUrl to your proxy address
{
  "apiBaseUrl": "https://your-api-proxy.example.com",

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/deploy.sh (reported line 431)May include surrounding context.

sh

**Solution**:
```bash
# Use a third-party API proxy, modify ~/.claude/settings.json
# Change apiBaseUrl to your proxy address
{
  "apiBaseUrl": "https://your-api-proxy.example.com",

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · scripts/setup.sh (reported line 343)May include surrounding context.

sh

**Solution**:
```bash
# Use a third-party API proxy, modify ~/.claude/settings.json
# Change apiBaseUrl to your proxy address
{
  "apiBaseUrl": "https://your-api-proxy.example.com",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 100)May include surrounding context.

Solution:

bash

# Fix private key permissions
chmod 600 ~/.ssh/id_ed25519
chmod 600 ~/.ssh/id_rsa  # if rsa key exists
chmod 700 ~/.ssh
chmod 600 ~/.ssh/config

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/troubleshooting.md (reported line 101)May include surrounding context.

bash

# Fix private key permissions
chmod 600 ~/.ssh/id_ed25519
chmod 600 ~/.ssh/id_rsa  # if rsa key exists
chmod 700 ~/.ssh
chmod 600 ~/.ssh/config

Static analysis

No suspicious patterns detected.