Rpi Cpu Monitor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:29 PM UTC
• Version: 1.0.0

Overview

This CPU monitor mostly matches its stated purpose, but it sets up recurring execution that reads an OpenClaw bearer token and sends authenticated alerts without enough scoping or warning.

Review before installing. Use a dedicated least-privilege alert token, avoid putting tokens in command-line arguments, replace the hard-coded /home/weiye path with user-controlled configuration, and add clear install/removal instructions for any cron job. This does not appear malicious, but it handles credentials and persistent authenticated messaging in a way users should explicitly approve.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cpu-temp-monitor.sh:17

Finding

Gateway bearer token exposed through process command-line arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/cpu-temp-monitor.sh:17
Additional Location: SKILL.md:23
Vulnerability Type: Exposure of sensitive credentials through process arguments
Risk Level: Medium

Vulnerable Code

bash

-H "Authorization: Bearer $(cat /home/weiye/.openclaw/gateway-token 2>/dev/null)" \

Technical Analysis

The shell command substitution reads the OpenClaw gateway token and interpolates it directly into a curl command-line argument. Consequently, the expanded Authorization header can appear in the process argument vector while curl is running.

A local process with sufficient same-user access, process-inspection permissions, or access to an inadequately restricted /proc filesystem may inspect the command line and recover the bearer token. The hard-coded /home/weiye path also assumes a specific user account and does not verify the token file's ownership or permissions.

The same insecure pattern is included in the installation example in SKILL.md, encouraging users to reproduce it.

Attack Path

1. An attacker obtains local process-observation capability, such as access to process command lines under the monitoring user's account.
2. The measured CPU temperature exceeds the configured threshold, causing the script to invoke curl.
3. The shell expands the token file contents into the Authorization header argument.
4. While curl is running, the attacker monitors process arguments and captures the bearer token.
5. The attacker reuses the token to make unauthorized requests to the local OpenClaw gateway, subject to the permissions assigned to that token and network access to the gateway.

Exploitation requires local process visibility and suitable timing; restrictive /proc settings or process-isolation controls may reduce practical exposure.

Impact Assessment

Successful exploitation discloses the OpenClaw gateway bearer token. The attacker ma ...[truncated 587 chars]

Remediation

View remediation

Remediation Suggestions

• Avoid placing the bearer token in command-line arguments. Supply sensitive configuration through a mechanism that does not expose it in the process argument vector, such as a protected curl configuration supplied through standard input.
• Store the token path in a configurable environment variable or configuration file rather than hard-coding a user-specific home directory.
• Before use, verify that the credential file is a regular file, owned by the expected user, and restricted to owner access, such as mode 0600.
• Run the monitor under a dedicated unprivileged account and grant that account access only to the temperature interface and the specific gateway operation required for alerting.
• Apply restrictive process-observation controls where supported, including appropriately configured /proc mount options.
• Update the example in SKILL.md so users do not reproduce the vulnerable command-line credential handling.
• Configure the gateway token with the minimum API scope required to send temperature alerts, and rotate the existing token if command-line exposure may already have occurred.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior exceeds the stated CPU-monitoring purpose by including authenticated API calls and reading a local bearer token from disk, which are sensitive capabilities not clearly disclosed in the description. This mismatch is dangerous because users may run what appears to be a simple monitoring skill without realizing it accesses credentials and transmits data to another service.

Content

No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

---

name: rpi-cpu-monitor description: 树莓派 CPU 温度监控。当需要监控树莓派 CPU 温度时使用此 skill。功能：(1) 读取当前 CPU 温度，(2) 设置定时监控任务，(3) 温度超标时自动告警。支持 crontab 方案（零消耗，推荐）和 OpenClaw cron 方案。

树莓派 CPU 温度监控

快速开始

方案 1：crontab 方案（推荐，零消耗）

bash

# 创建监控脚本
cat > /path/to/scripts/cpu-temp-monitor.sh << 'EOF'
#!/bin/bash
TEMP=$(vcgencmd measure_temp 2>/dev/null | cut -d= -f2 | cut -d\' -f1)
[ -z "$TEMP" ] && TEMP=$(cat /sys/class/thermal/thermal_zone0/temp | awk '{print $1/1000}')
TEMP_INT=${TEMP%.*}

if [ "$TEMP_INT" -gt 70 ]; then
  curl -s -X POST "http://localhost:3000/api/sessions/agent:main:main/message" \
    -H "Content-Type: application/jso

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents shell-based behavior but does not declare any tool scope or permissions, making its operational capabilities opaque to users and reviewers. In this context, the omission matters because the skill creates scripts, reads local files, performs network requests, and configures scheduled execution, all of which should be explicitly declared.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The script transmits temperature data over HTTP to a local OpenClaw endpoint using an Authorization header, which is an external transmission and privileged action that should be treated as sensitive. In context, localhost limits exposure compared with internet exfiltration, but the call still crosses a trust boundary and relies on a bearer token that could be abused if the script or endpoint is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

TEMP_INT=${TEMP%.*}

if [ "$TEMP_INT" -gt 70 ]; then
  curl -s -X POST "http://localhost:3000/api/sessions/agent:main:main/message" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $(cat /home/weiye/.openclaw/gateway-token)" \
    -d '{"message":"⚠️ CPU温度过高: '${TEMP}'°C", "channel":"feishu"}'

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script reads a bearer token from /home/weiye/.openclaw/gateway-token and uses it to authenticate a request, introducing credential-access behavior into a monitoring script. Even if intended for alerting, embedding token reads in shared documentation normalizes handling secrets unsafely and increases the chance of credential exposure or misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instructions direct users to run a script that both accesses a local credential and sends an authenticated HTTP request, but they provide no warning about secret use or network transmission. This is risky because users may copy-paste the script without understanding that it reaches into local auth material and communicates with another service.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill instructs users to add the script to crontab, creating persistent scheduled execution. Persistence is not inherently malicious here, but it is security-relevant because it causes recurring privileged actions, including credential reads and authenticated requests, long after the initial setup.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

chmod +x /path/to/scripts/cpu-temp-monitor.sh

添加到 crontab（每 35 分钟执行）

crontab -e

添加: */35 * * * * /path/to/scripts/cpu-temp-monitor.sh

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The script transmits system state externally via an HTTP POST and includes an Authorization bearer token, creating an authenticated communication path that is not obvious from the skill description alone. Although the endpoint is localhost rather than a remote host, this still expands the trust boundary to another service and can leak operational data or enable message-sending if that local service is intercepted, exposed, or abused.

Content

Scanner excerpt · scripts/cpu-temp-monitor.sh (reported line 15)May include surrounding context.

sh

if [ "$TEMP_INT" -gt 70 ]; then
  # 温度超标，发送告警到 OpenClaw
  curl -s -X POST "http://localhost:3000/api/sessions/agent:main:main/message" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer $(cat /home/weiye/.openclaw/gateway-token 2>/dev/null)" \
    -d '{"message":"⚠️ CPU温度过高: '${TEMP}'°C (阈值70°C)", "channel":"feishu"}' \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script reads a bearer token from a local file and immediately uses it to send an authenticated alert, but the file provides no disclosure that it will access credentials and trigger outbound messaging. Even though the destination is localhost, this still performs authenticated actions on behalf of the user and could be abused if the local service is compromised, misconfigured, or exposed through another channel.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The natural-language instructions and description are entirely in Chinese, and the file does not indicate that this is a region-specific or Chinese-only skill, nor does it offer alternative language support. Under the stated policy, forcing a specific language without user opt-in can be a locale-policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The file's human-readable comments and alert message are written only in Chinese, including the operational notification payload sent at runtime. This imposes a specific language/locale without any indication of user opt-in or documented region-specific constraint.

Content

No source excerpt is available for this finding.