ClawHub
Back to skill

Security audit

Setup Automatik

Security checks for vulnerabilities and agentic risk

Overview

This VPS installer is broadly purpose-aligned, but needs Review because it asks for root-level server control while using unsafe install, credential, TLS, and undisclosed telemetry practices.

Install only if you fully trust the publisher and are comfortable giving the skill root-equivalent control of a VPS. Review the bundled shell script before use, avoid pipe-to-shell installers where possible, disable or remove telemetry, require valid TLS for Portainer, and rotate any Portainer credentials or tokens created by this installer.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:42
Finding

Unpinned Remote Scripts Are Executed with Administrative Privileges

Content
View full analysis
/dev/null 2>&1 systemctl enable docker > /dev/null 2>&1 systemctl start docker > /dev/null 2>&1 ``` ### Technical Analysis Both installation paths pipe an HTTP response directly into a shell. The downloaded scripts are not pinned to a specific version or immutable artifact, and their contents are not validated with a cryptographic digest or signature before execution. This creates a time-of-check/time-of-use supply-chain boundary: reviewing the Skill does not establish what code will execute later because the external server can return different content on every invocation. The Docker installation occurs in a workflow that performs system-level operations and enables services, while the OpenClaw command is explicitly intended to be run on the target VPS. In the expected deployment context, the commands therefore execute with administrative or root-equivalent authority. Suppressing the Docker installer output with `> /dev/null 2>&1` also reduces the operator's ability to detect unexpected actions or diagnose compromise. ### Attack Path 1. A user follows the Skill instructions or invokes the Traefik and Portainer installation workflow. 2. The VPS requests a script from `get.openclaw.ai` or `get.docker.com`. 3. The remote endpoint, its hosting infrastructure, DNS resolution, or another delivery component is compromised. 4. The attacker returns a modified shell script. 5. The response is immediately interpreted by `sh` or `bash` without inspection or integrity validation. 6. The payload execute ...[truncated 874 chars]
Remediation
View remediation

other

Warning
Location
assets/SetupOrion.sh:2417
Finding

Undisclosed Installation Telemetry Exports VPS Information

Content
View full analysis
/dev/null 2>&1 } ``` Representative invocations include: ```bash telemetria Docker iniciado ``` ```bash telemetria Docker finalizado ``` ### Technical Analysis The installer sends the machine's address, the selected installation component, and installation status to an Orion Design endpoint. The telemetry function is invoked throughout the installation workflows, commonly before and after deployment operations. The Skill documentation does not disclose this collection, identify the recipient, explain retention or purpose, or offer an opt-in or opt-out mechanism. Sending this information is not technically necessary to deploy applications locally on the VPS. Although the function uses HTTPS, it still intentionally discloses infrastructure and deployment metadata to a third party. Output and errors are suppressed, making this behavior less visible to the operator. ### Attack Path 1. The user starts an installation through `SetupOrion.sh`. 2. The chosen workflow calls `telemetria` with the tool name and an installation status. 3. The function obtains an address from `hostname -I`. 4. It creates a JSON payload containing the address, tool, and status. 5. The payload is sent to `telemetria.oriondesign.art.br` without explicit user consent. 6. Repeated events allow the recipient to build an inventory of instal ...[truncated 607 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
assets/SetupOrion.sh:2179
Finding

Portainer Administrator Passwords and Bearer Tokens Are Persisted in Plaintext

Content
View full analysis
"/root/dados_vps/dados_portainer" ``` The same behavior is repeated by the update function: ```bash ## Função para atualizar o arquivo de dados do Portainer com o novo usuário e senha atualizar_arquivo() { echo -e "[ PORTAINER ]\nDominio do portainer: $PORTAINER_URL\n\nUsuario: $USUARIO\n\nSenha: $SENHA\n\nToken: $TOKEN" > "/root/dados_vps/dados_portainer" echo -e "\nArquivo de dados do Portainer atualizado com sucesso!" } ``` The directory is created without explicit restrictive permissions: ```bash if [ ! -d "dados_vps" ]; then mkdir dados_vps fi ``` No restrictive `umask`, ownership validation, or explicit `chmod 600` operation was identified for the credentials file in the reviewed code. ### Technical Analysis The installer persistently stores a Portainer administrator username, password, and JWT bearer token in one plaintext file. A bearer token grants authority to whoever possesses it and does not require proof of knowledge of the original password. The file's effective permissions depend on the process umask and any pre-existing directory or file. The script does not validate that `/root/dados_vps` is owned by root, does not reject symbolic links, and does not explicitly set directory mode `700` or file mode `600`. Keeping both the reusable administrator password and an active token also unnecessarily expan ...[truncated 1726 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
assets/SetupOrion.sh:2133
Finding

TLS Certificate Verification Is Disabled for Privileged Portainer API Traffic

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (142)

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding

The documented behavior understates the sensitivity and breadth of the skill: it facilitates collecting secrets, may expose generated credentials in output, and references installing a much wider set of software than the description suggests. In an infrastructure-management skill, this mismatch prevents informed consent and can lead users to grant broad access without understanding that secrets handling, telemetry, and expansive deployment behavior are involved.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.

md
Special thanks to **Orion Design** for providing the original `SetupOrion.sh` script.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
Special thanks to **Orion Design** for providing the original `SetupOrion.sh` script.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
Special thanks to **Orion Design** for providing the original `SetupOrion.sh` script.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md
Special thanks to **Orion Design** for providing the original `SetupOrion.sh` script.

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The skill recommends executing a remote installer via 'curl | sh', which runs code fetched from the network directly in the shell without integrity verification or user review. In the context of a VPS administration skill, this is especially dangerous because the command is likely executed with elevated privileges, so a compromised host, CDN, or supply chain could lead to full remote code execution on the server.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
#### Option 1: OpenClaw Node Pairing (Recommended)
This is the most secure and native way. It allows the agent to execute commands directly on your VPS terminal.
1. Run the installer on your VPS: `curl -fsSL https://get.openclaw.ai | sh`
2. Start the pairing process: `openclaw node pair`
3. Paste the resulting pairing code or command here in the chat.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The script uses 'curl -k' to authenticate to Portainer, explicitly disabling TLS certificate validation. That allows machine-in-the-middle attacks to steal Portainer usernames, passwords, and JWTs or alter API responses during privileged stack deployment.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 2131)May include surrounding context.

sh
#TOKEN=$(grep "Token: " /root/dados_vps/dados_portainer | awk -F "Token: " '{print $2}')
    
    ## Pega um token do portainer
    #TOKEN=$(curl -k -X POST -H "Content-Type: application/json" -d "{\"username\":\"$USUARIO\",\"password\":\"$SENHA\"}" https://$PORTAINER_URL/api/auth | jq -r .jwt)

    TOKEN=""
    Tentativa_atual=0

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

Repeated token acquisition over 'curl -k' keeps sending credentials over a connection that is not authenticated against the intended server certificate. In hostile or intercepted network environments, this exposes the management plane to credential theft and spoofed control responses.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 2138)May include surrounding context.

sh
Maximo_de_tentativas=6
    
    while [ -z "$TOKEN" ] || [ "$TOKEN" == "null" ]; do
        TOKEN=$(curl -k -s -X POST -H "Content-Type: application/json" -d "{\"username\":\"$USUARIO\",\"password\":\"$SENHA\"}" https://$PORTAINER_URL/api/auth | jq -r .jwt)
    
        Tentativa_atual=$((Tentativa_atual + 1))

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The script fetches Portainer endpoint metadata using a bearer token over a TLS connection that skips certificate validation. An attacker able to intercept traffic could harvest the token and gain administrative API access to the container environment.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 2182)May include surrounding context.

sh
echo -e "[ PORTAINER ]\nDominio do portainer: $PORTAINER_URL\n\nUsuario: $USUARIO\n\nSenha: $SENHA\n\nToken: $TOKEN" > "/root/dados_vps/dados_portainer"

    ## Pegando o id do portainer
    ENDPOINT_ID=$(curl -k -s -X GET -H "Authorization: Bearer $TOKEN" https://$PORTAINER_URL/api/endpoints | jq -r '.[] | select(.Name == "primary") | .Id')
    if [ $? -eq 0 ]; then
        echo -e "8/10 - [ OK ] - Pegando ID do Portainer: $bege$ENDPOINT_ID$reset"
    else

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The swarm ID is retrieved with 'curl -k', again exposing authenticated control-plane traffic to interception and tampering. Because this ID is then used for deployment actions, spoofed responses can misdirect or disrupt management operations.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 2193)May include surrounding context.

sh
#ENDPOINT_ID=1
    
    ## Pegando o ID do Swarm
    SWARM_ID=$(curl -k -s -X GET -H "Authorization: Bearer $TOKEN" "https://$PORTAINER_URL/api/endpoints/$ENDPOINT_ID/docker/swarm" | jq -r .ID)
    if [ $? -eq 0 ]; then
        echo -e "9/10 - [ OK ] - Pegando ID do Swarm: $bege$SWARM_ID$reset"
    else

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The actual Portainer stack deployment request is sent with 'curl -k', meaning privileged orchestration operations occur over a connection that does not verify server identity. A man-in-the-middle could capture tokens, alter uploaded stack content, or return deceptive success/failure responses.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 2212)May include surrounding context.

sh
response_output=$(mktemp)

    ## Fazendo deploy da stack pelo portainer
    http_code=$(curl -s -o "$response_output" -w "%{http_code}" -k -X POST \
    -H "Authorization: Bearer $TOKEN" \
    -F "Name=$STACK_NAME" \
    -F "file=@$(pwd)/$STACK_NAME.yaml" \

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 2258)May include surrounding context.

sh
## Função para criar o arquivo de dados do Portainer
criar_arquivo() {
    if [ -f "/root/dados_vps/dados_portainer" ]; then
        rm "/root/dados_vps/dados_portainer"
        echo "Arquivo existente removido."
    fi

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

Credential verification to Portainer again relies on insecure TLS, transmitting administrative passwords to any endpoint presenting itself on the network path. This is particularly dangerous because the skill is designed to manage production infrastructure at scale.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 2349)May include surrounding context.

sh
#echo "Usuário: $USUARIO"
        #echo "Senha: $SENHA"

        RESPONSE=$(curl -s -w "\n%{http_code}" -k -X POST -H "Content-Type: application/json" -d "{\"username\":\"$USUARIO\",\"password\":\"$SENHA\"}" "https://$PORTAINER_URL/api/auth")
        TOKEN=$(echo "$RESPONSE" | sed '$d' | jq -r '.jwt')
        HTTP_STATUS=$(echo "$RESPONSE" | tail -n1)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 3605)May include surrounding context.

sh
sudo apt-get install -y ca-certificates curl gnupg lsb-release > /dev/null 2>&1

    ## Adiciona chave GPG
    sudo install -m 0755 -d /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo tee /etc/apt/keyrings/docker.asc > /dev/null
    sudo chmod a+r /etc/apt/keyrings/docker.asc

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 3606)May include surrounding context.

sh
sudo apt-get install -y ca-certificates curl gnupg lsb-release > /dev/null 2>&1

    ## Adiciona chave GPG
    sudo install -m 0755 -d /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo tee /etc/apt/keyrings/docker.asc > /dev/null
    sudo chmod a+r /etc/apt/keyrings/docker.asc

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 3607)May include surrounding context.

sh
sudo apt-get install -y ca-certificates curl gnupg lsb-release > /dev/null 2>&1

    ## Adiciona chave GPG
    sudo install -m 0755 -d /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo tee /etc/apt/keyrings/docker.asc > /dev/null
    sudo chmod a+r /etc/apt/keyrings/docker.asc

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 3611)May include surrounding context.

sh
sudo apt-get install -y ca-certificates curl gnupg lsb-release > /dev/null 2>&1

    ## Adiciona chave GPG
    sudo install -m 0755 -d /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo tee /etc/apt/keyrings/docker.asc > /dev/null
    sudo chmod a+r /etc/apt/keyrings/docker.asc

Chaining Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Piping downloaded content directly into 'sudo tee' writes remote material into a trusted key path without independent verification. While this is common repository setup, it still extends trust to a network response in a privileged chain.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 3606)May include surrounding context.

sh
## Adiciona chave GPG
    sudo install -m 0755 -d /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo tee /etc/apt/keyrings/docker.asc > /dev/null
    sudo chmod a+r /etc/apt/keyrings/docker.asc

    ## Adiciona repositório do Docker

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 3612)May include surrounding context.

sh
## Adiciona repositório do Docker
    echo \
      "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
      focal stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

    ## Atualiza pacotes
    sudo apt-get update > /dev/null 2>&1

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 34995)May include surrounding context.

sh
## Adiciona repositório do Docker
    echo \
      "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
      focal stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

    ## Atualiza pacotes
    sudo apt-get update > /dev/null 2>&1

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 34996)May include surrounding context.

sh
## Adiciona repositório do Docker
    echo \
      "deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
      focal stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

    ## Atualiza pacotes
    sudo apt-get update > /dev/null 2>&1

Docker Socket Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 3723)May include surrounding context.

sh
command:
      - "--api.dashboard=true"
      - "--providers.swarm=true"
      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=$nome_rede_interna" ## Nome da rede interna
      - "--entrypoints.web.address=:80"

Docker Socket Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 3744)May include surrounding context.

sh
command:
      - "--api.dashboard=true"
      - "--providers.swarm=true"
      - "--providers.docker.endpoint=unix:///var/run/docker.sock"
      - "--providers.docker.exposedbydefault=false"
      - "--providers.docker.network=$nome_rede_interna" ## Nome da rede interna
      - "--entrypoints.web.address=:80"

Docker Socket Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

Portainer agent is granted the Docker socket and the Docker volumes directory, which effectively exposes full container orchestration control and sensitive data paths. If the Portainer stack or agent is compromised, an attacker can gain broad control over all managed services and secrets on the host.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 3842)May include surrounding context.

sh
image: portainer/agent:latest ## Versão Agent do Portainer

    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /var/lib/docker/volumes:/var/lib/docker/volumes

    networks:

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

Initial Portainer admin creation is performed over 'curl -k', exposing the first administrator credential exchange to interception. Since this creates the control-plane account, compromise here yields complete management takeover of the deployed environment.

Content

Scanner excerpt · assets/SetupOrion.sh (reported line 3935)May include surrounding context.

sh
CONTA_CRIADA=false

for i in $(seq 1 $MAX_RETRIES); do
  RESPONSE=$(curl -k -s -X POST "https://$url_portainer/api/users/admin/init" \
    -H "Content-Type: application/json" \
    -d "{\"Username\": \"$user_portainer\", \"Password\": \"$pass_portainer\"}")

Static analysis

No suspicious patterns detected.