ClawHub
Back to skill

Security audit

Trae CLI for OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent TRAE CLI guide, but it needs Review because its install and automation instructions can run or change code on a machine with limited safety warnings.

Install only if you trust the TRAE CLI publisher and delivery path. Prefer downloading and verifying installers before running them, avoid elevated shells, restrict allowed tools in CI, protect JSON logs, review any custom command that uses shell interpolation, and use version pinning or manual upgrades where available.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:43
Finding

Unverified Remote Installer Download and Immediate Execution

Content
View full analysis
Remediation
View remediation
traecli-install.sh' | sha256sum --check - ``` 5. Prefer vendor-signed artifacts and verify the cryptographic signature against a documented, pinned vendor key. 6. Allow users to inspect the downloaded script before running it, and document its expected file, network, and permission changes. 7. Execute installation with the minimum required privileges. Explicitly warn users not to use an administrator or root shell unless a reviewed installation step requires it. 8. Apply the same staged download and verification process on Windows using `Invoke-WebRequest`, `Get-FileHash`, and an Authenticode signature check instead of `irm ... | iex`. 9. Disable automatic upgrades by default or require upgrades to use the same version pinning and signature-verification controls. 10. For CI/CD use, mirror a reviewed, immutable artifact in a controlled internal registry and validate its digest before every installation. ]]>

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md
| Command | Purpose |
|---------|---------|
| `/agent-new` | Create a new custom agent. |
| `/clear` or `/reset` | Clear conversation history and release context. |
| `/feedback` | Submit feedback or report issues. |
| `/init` | Initialize a new AGENTS.md file for the current directory. |
| `/login` | Log in to TRAE CLI. |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs users to execute remote installation scripts directly via curl/iex, which results in immediate code execution from a network source with no integrity verification, signature check, pinning, or trust warning. If the distribution host, CDN path, DNS, or transport chain is compromised, users could run arbitrary attacker-controlled code on their machines.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The CI examples show non-interactive execution with Bash/Edit/MultiEdit/Write permissions, enabling the tool to run commands and modify repository contents automatically without a safety caveat. In CI or scripted contexts, this can amplify prompt injection, bad prompts, or tool misuse into unattended command execution and unauthorized file changes.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

traecli --allowed-tool Bash,Edit,MultiEdit,Write -p "update README with latest changes"

text

- **Automatically run a pre-written Prompt template in CI script**:
```bash
traecli -p /command arg1 arg2

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The --json option is documented as exposing system prompt, tool calls, execution process, and final results, but there is no warning that these logs may contain sensitive prompts, code, secrets, paths, or internal workflow details. If logged to CI artifacts or centralized logging systems, this can cause unintended data disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The custom slash-command feature explicitly supports embedded system command execution using !command, but the skill presents it as a convenience feature without warning about command injection or arbitrary code execution risk. Because command templates can incorporate user arguments and repository-controlled files, this can be abused to run unintended shell commands on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The documentation states that the CLI may auto-upgrade on launch without warning that this can change local binaries automatically. Silent or unexpected self-modification increases supply-chain and operational risk, especially in controlled developer or CI environments where reproducibility matters.

Content

No source excerpt is available for this finding.