ClawHub
Back to skill

Security audit

Setup Automatik

Security checks for vulnerabilities and agentic risk

Overview

This VPS installer skill is purpose-aligned but asks for broad server access and includes insecure, under-disclosed handling of telemetry, installers, and admin credentials.

Review this skill carefully before installing. Do not paste SSH passwords or private keys into chat; prefer short-lived, least-privilege access. Only run the installer on a disposable or well-backed-up VPS after reviewing the script, accepting or disabling its telemetry, verifying remote installers and images, and planning to rotate Portainer credentials created or stored by the script.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:42
Finding

Unpinned Remote Scripts Are Executed with Administrative Privileges

Content
View full analysis
/dev/null 2>&1 systemctl enable docker > /dev/null 2>&1 systemctl start docker > /dev/null 2>&1 ``` ### Technical Analysis Both installation paths execute the response from an external HTTPS endpoint directly in a shell. The retrieved payload is not pinned to a version, saved for inspection, checked against a cryptographic digest, or authenticated using a detached signature. Consequently, the effective code can change after the Skill package has been reviewed. HTTPS protects the connection under normal circumstances but does not protect against compromise of the publisher account, web server, DNS infrastructure, certificate authority, or upstream build and deployment process. The Docker installation path is especially sensitive because it executes during host provisioning and is followed by administrative service-management operations. The remote script consequently runs with sufficient privileges to modify the operating system, install services, access local secrets, and establish persistence. The OpenClaw installation command is related to the optional node-pairing workflow, but direct pipe-to-shell execution is not the minimum-risk installation method. The Docker installation is relevant to the declared deployment functionality, but executing an unreviewed mutable response is unnecessary. ### Attack Path 1. An attacker compromises `get.openclaw.ai`, `get.docker.com`, a publisher account, or the associated release pipeline. 2. The attacker modifies the response so that it contains malicious shell commands. 3. A user follows `SKILL.md:4 ...[truncated 725 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
assets/SetupOrion.sh:2417
Finding

Undisclosed Telemetry Sends VPS and Deployment Metadata to a Third Party

Content
View full analysis
/dev/null 2>&1 } ``` Representative reachable call sites: ```sh telemetria Docker iniciado ... telemetria Docker finalizado ``` Other confirmed call sites send start and completion states for many supported applications, including Chatwoot, N8N, Portainer, PostgreSQL, Supabase, Passbolt, RustDesk, and other deployed services. ### Technical Analysis The installer automatically transmits the VPS IP address, selected tool name, and installation status to `telemetria.oriondesign.art.br`. This data transfer is not disclosed in `SKILL.md`, and no consent or opt-out mechanism is shown. Telemetry is not necessary to install or configure the requested applications. It therefore exceeds the minimum data access and network communication required for the declared functionality. Suppressing all command output also makes the transfer less visible to the operator. Although `hostname -I` commonly returns local interface addresses rather than a public address, the receiving server can additionally observe the source address of the request. Tool names and start/completion states reveal the software composition and provisioning timeline of the server. ### Attack Path 1. A user asks the Skill to provision Docker or another supported application. 2. The ...[truncated 884 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
assets/SetupOrion.sh:2179
Finding

Portainer Administrator Passwords and Bearer Tokens Are Persisted in Plaintext

Content
View full analysis
"/root/dados_vps/dados_portainer" ``` `assets/SetupOrion.sh:2413`: ```sh echo -e "[ PORTAINER ]\nDominio do portainer: $PORTAINER_URL\n\nUsuario: $USUARIO\n\nSenha: $SENHA\n\nToken: $TOKEN" > "/root/dados_vps/dados_portainer" ``` `assets/SetupOrion.sh:3977-4005`: ```sh ## Salvando informações da instalação dentro de /dados_vps/ cd dados_vps if [ "$CONTA_CRIADA" = true ]; then cat > dados_portainer < dados_portainer <
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
assets/SetupOrion.sh:2138
Finding

TLS Certificate Verification Is Disabled for Privileged Portainer API Operations

Content
View full analysis
"$erro_output") ``` Credential verification at `assets/SetupOrion.sh:2349`: ```sh RESPONSE=$(curl -s -w "\n%{http_code}" -k -X POST -H "Content-Type: application/json" -d "{\"username\":\"$USUARIO\",\"password\":\"$SENHA\"}" "https://$PORTAINER_URL/api/auth") ``` ### Technical Analysis The `-k` option instructs `curl` to accept an invalid, self-signed, expired, or hostname-mismatched certificate. This disables server authentication, which is a core security property of TLS. The affected requests carry Portainer administrator passwords, JWT bearer tokens, and complete deployment stack files. Because any certificate is accepted, a network-positioned attacker can impersonate Portainer and receive those secrets. The attacker can also return forged en ...[truncated 1219 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
assets/SetupOrion.sh:34440
Finding

Mutable Container Images and Unverified Third-Party Artifacts Create Supply-Chain Exposure

Content
View full analysis
/dev/null 2>&1 ... sudo mv /root/blablabla/SetupOrion/Extras/Grafana/monitor-orion /opt ``` Unverified executable installation at `assets/SetupOrion.sh:34440-34448`: ```sh sudo wget https://github.com/bcicen/ctop/releases/download/v0.7.7/ctop-0.7.7-linux-amd64 -O /usr/local/bin/ctop ... sudo chmod +x /usr/local/bin/ctop ``` The installer also downloads mutable files from GitHub branch URLs, including: ```sh wget -O confirmation_instructions.html.erb https://github.com/oriondesign2015/SetupOrion/raw/main/Extras/Chatwoot/emails/confirmation_instructions.html.erb wget "https://raw.githubusercontent.com/DeividMs/QP_Setup_Orion/main/workflows/latest/ChatwootExtra.json" ``` ### Technical Analysis The installer relies extensively on mutable image tags such as `latest`, unpinned Git branches, branch-relative raw files, and an executable downloaded without signature or checksum validation. A mutable tag can resolve to different image content on each installation. A repository owner, compromised publisher account, registry operator, or attacker controlling an upstream release pipeline can replace the artifact while preserving the same ...[truncated 1606 chars]
Remediation
View remediation
`. 2. Pin Git dependencies to reviewed commit hashes rather than default branches. 3. Replace raw `main` and `latest` URLs with immutable commit-based URLs. 4. Verify downloaded binaries using publisher signatures and independently obtained cryptographic checksums. 5. Abort installation when integrity verification fails. 6. Maintain a documented allowlist of approved registries, publishers, image digests, commits, and binary hashes. 7. Automate dependency updates through a review process that records provenance and security scan results. 8. Scan container images for known vulnerabilities and malware before deployment. 9. Minimize container privileges, volume mounts, capabilities, and access to internal networks so an upstream compromise has limited impact. 10. Preserve dependency download and verification logs for incident investigation. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (146)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md
Special thanks to **Orion Design** for providing the original `SetupOrion.sh` script.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
Special thanks to **Orion Design** for providing the original `SetupOrion.sh` script.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
Special thanks to **Orion Design** for providing the original `SetupOrion.sh` script.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md
Special thanks to **Orion Design** for providing the original `SetupOrion.sh` script.

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill instructs users to run a curl-pipe-to-shell command from an external domain, which executes remotely fetched code without prior verification. This creates a high-risk supply-chain and remote code execution path: if the source, transport, or hosting is compromised, arbitrary code runs on the user's VPS with the privileges of the invoking user.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
#### Option 1: OpenClaw Node Pairing (Recommended)
This is the most secure and native way. It allows the agent to execute commands directly on your VPS terminal.
1. Run the installer on your VPS: `curl -fsSL https://get.openclaw.ai | sh`
2. Start the pairing process: `openclaw node pair`
3. Paste the resulting pairing code or command here in the chat.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly asks users to provide SSH passwords or private keys in chat, which are highly sensitive credentials. Collecting such secrets through plain chat exposes them to logging, retention, accidental disclosure, and misuse, and in this skill's context would grant direct administrative access to a VPS.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill instructs the user to send VPS access secrets directly in conversation, including SSH passwords or private keys. In context, this is especially dangerous because the stated purpose is remote installation and management of server software, so the collected secrets would enable full server compromise if exposed or abused.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

Using curl -k disables TLS certificate validation when authenticating to Portainer. That allows man-in-the-middle interception of usernames, passwords, JWTs, and management requests, which is especially dangerous because this script manages deployment of privileged infrastructure.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 2131)May include surrounding context.

sh
#TOKEN=$(grep "Token: " /root/dados_vps/dados_portainer | awk -F "Token: " '{print $2}')
    
    ## Pega um token do portainer
    #TOKEN=$(curl -k -X POST -H "Content-Type: application/json" -d "{\"username\":\"$USUARIO\",\"password\":\"$SENHA\"}" https://$PORTAINER_URL/api/auth | jq -r .jwt)

    TOKEN=""
    Tentativa_atual=0

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

This Portainer token retrieval loop also uses curl -k, again bypassing certificate validation during authentication. An attacker on the network path could capture or substitute management tokens and take over deployments.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 2138)May include surrounding context.

sh
Maximo_de_tentativas=6
    
    while [ -z "$TOKEN" ] || [ "$TOKEN" == "null" ]; do
        TOKEN=$(curl -k -s -X POST -H "Content-Type: application/json" -d "{\"username\":\"$USUARIO\",\"password\":\"$SENHA\"}" https://$PORTAINER_URL/api/auth | jq -r .jwt)
    
        Tentativa_atual=$((Tentativa_atual + 1))

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

Fetching endpoint metadata from Portainer over TLS with verification disabled exposes bearer tokens and management traffic to interception or response tampering. That can redirect deployments or mislead the installer about the target environment.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 2182)May include surrounding context.

sh
echo -e "[ PORTAINER ]\nDominio do portainer: $PORTAINER_URL\n\nUsuario: $USUARIO\n\nSenha: $SENHA\n\nToken: $TOKEN" > "/root/dados_vps/dados_portainer"

    ## Pegando o id do portainer
    ENDPOINT_ID=$(curl -k -s -X GET -H "Authorization: Bearer $TOKEN" https://$PORTAINER_URL/api/endpoints | jq -r '.[] | select(.Name == "primary") | .Id')
    if [ $? -eq 0 ]; then
        echo -e "8/10 - [ OK ] - Pegando ID do Portainer: $bege$ENDPOINT_ID$reset"
    else

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The Swarm ID lookup is also performed with curl -k, extending the same MITM risk across the management flow. In this context, that can facilitate hostile stack deployment to the wrong endpoint or leak privileged orchestration metadata.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 2193)May include surrounding context.

sh
#ENDPOINT_ID=1
    
    ## Pegando o ID do Swarm
    SWARM_ID=$(curl -k -s -X GET -H "Authorization: Bearer $TOKEN" "https://$PORTAINER_URL/api/endpoints/$ENDPOINT_ID/docker/swarm" | jq -r .ID)
    if [ $? -eq 0 ]; then
        echo -e "9/10 - [ OK ] - Pegando ID do Swarm: $bege$SWARM_ID$reset"
    else

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The actual stack deployment request to Portainer is sent over HTTPS with certificate verification disabled. This means an attacker in path could intercept the bearer token and potentially alter or replace the uploaded stack file, resulting in arbitrary code deployment on the VPS.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 2212)May include surrounding context.

sh
response_output=$(mktemp)

    ## Fazendo deploy da stack pelo portainer
    http_code=$(curl -s -o "$response_output" -w "%{http_code}" -k -X POST \
    -H "Authorization: Bearer $TOKEN" \
    -F "Name=$STACK_NAME" \
    -F "file=@$(pwd)/$STACK_NAME.yaml" \

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 2258)May include surrounding context.

sh
## Função para criar o arquivo de dados do Portainer
criar_arquivo() {
    if [ -f "/root/dados_vps/dados_portainer" ]; then
        rm "/root/dados_vps/dados_portainer"
        echo "Arquivo existente removido."
    fi

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

Credential verification against Portainer uses curl -k, exposing the username and password to interception during the login exchange. Because those credentials are reused for future deployments and token generation, compromise here grants persistent admin access.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 2349)May include surrounding context.

sh
#echo "Usuário: $USUARIO"
        #echo "Senha: $SENHA"

        RESPONSE=$(curl -s -w "\n%{http_code}" -k -X POST -H "Content-Type: application/json" -d "{\"username\":\"$USUARIO\",\"password\":\"$SENHA\"}" "https://$PORTAINER_URL/api/auth")
        TOKEN=$(echo "$RESPONSE" | sed '$d' | jq -r '.jwt')
        HTTP_STATUS=$(echo "$RESPONSE" | tail -n1)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 3605)May include surrounding context.

sh
sudo apt-get install -y ca-certificates curl gnupg lsb-release > /dev/null 2>&1

    ## Adiciona chave GPG
    sudo install -m 0755 -d /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo tee /etc/apt/keyrings/docker.asc > /dev/null
    sudo chmod a+r /etc/apt/keyrings/docker.asc

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 3606)May include surrounding context.

sh
sudo apt-get install -y ca-certificates curl gnupg lsb-release > /dev/null 2>&1

    ## Adiciona chave GPG
    sudo install -m 0755 -d /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo tee /etc/apt/keyrings/docker.asc > /dev/null
    sudo chmod a+r /etc/apt/keyrings/docker.asc

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 3607)May include surrounding context.

sh
sudo apt-get install -y ca-certificates curl gnupg lsb-release > /dev/null 2>&1

    ## Adiciona chave GPG
    sudo install -m 0755 -d /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo tee /etc/apt/keyrings/docker.asc > /dev/null
    sudo chmod a+r /etc/apt/keyrings/docker.asc

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 3611)May include surrounding context.

sh
sudo apt-get install -y ca-certificates curl gnupg lsb-release > /dev/null 2>&1

    ## Adiciona chave GPG
    sudo install -m 0755 -d /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo tee /etc/apt/keyrings/docker.asc > /dev/null
    sudo chmod a+r /etc/apt/keyrings/docker.asc

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 3606)May include surrounding context.

sh
## Adiciona chave GPG
    sudo install -m 0755 -d /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo tee /etc/apt/keyrings/docker.asc > /dev/null
    sudo chmod a+r /etc/apt/keyrings/docker.asc

    ## Adiciona repositório do Docker

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 3612)May include surrounding context.

sh
## Adiciona chave GPG
    sudo install -m 0755 -d /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo tee /etc/apt/keyrings/docker.asc > /dev/null
    sudo chmod a+r /etc/apt/keyrings/docker.asc

    ## Adiciona repositório do Docker

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 34995)May include surrounding context.

sh
## Adiciona chave GPG
    sudo install -m 0755 -d /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo tee /etc/apt/keyrings/docker.asc > /dev/null
    sudo chmod a+r /etc/apt/keyrings/docker.asc

    ## Adiciona repositório do Docker

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 34996)May include surrounding context.

sh
## Adiciona chave GPG
    sudo install -m 0755 -d /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo tee /etc/apt/keyrings/docker.asc > /dev/null
    sudo chmod a+r /etc/apt/keyrings/docker.asc

    ## Adiciona repositório do Docker

Docker Socket Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 3723)May include surrounding context.

sh
command:
      - "--api.dashboard=true"
      - "--providers.swarm=true"
      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=$nome_rede_interna" ## Nome da rede interna
      - "--entrypoints.web.address=:80"

Docker Socket Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 3744)May include surrounding context.

sh
command:
      - "--api.dashboard=true"
      - "--providers.swarm=true"
      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=$nome_rede_interna" ## Nome da rede interna
      - "--entrypoints.web.address=:80"

Docker Socket Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 3842)May include surrounding context.

sh
command:
      - "--api.dashboard=true"
      - "--providers.swarm=true"
      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=$nome_rede_interna" ## Nome da rede interna
      - "--entrypoints.web.address=:80"

Static analysis

No suspicious patterns detected.