ClawHub
Back to skill

Security audit

Openclaw Expert

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only OpenClaw administration skill, but it repeatedly recommends high-impact installation and permission commands that users should review carefully before running.

Install only if you want an OpenClaw sysadmin reference skill and are comfortable manually reviewing commands before execution. Do not run curl-to-shell, sudo bash, chmod -R 777, or ~/.zshrc helper commands blindly; prefer official package-manager installs, pinned/checksummed downloads, restrictive permissions, SecretRef-based credential handling, and backups before OpenClaw changes.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/installation.md:115
Finding
Unverified Remote Installers Are Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: - `references/examples.md:56` - `references/examples.md:81-82` - `references/examples.md:178-179` - `references/examples.md:182-183` - `references/nodes-and-remote.md:50` - `references/nodes-and-remote.md:155` - `references/tailscale-integration.md:170-171` - `references/tailscale-integration.md:182-183` - `references/troubleshooting.md:354-362` - `references/installation.md:110-116` **Vulnerability Type**: Unverified remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash # references/examples.md:56 curl -fsSL https://get.openclaw.ai | bash ``` ```bash # references/examples.md:81-82 curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up ``` ```bash # references/examples.md:178-183 curl -fsSL https://deb.nodesource.com/setup_22.x | sudo bash - sudo apt install -y nodejs curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up ``` ```bash # references/nodes-and-remote.md:50 and 155 curl -fsSL https://tailscale.com/install.sh | sh ``` ```bash # references/tailscale-integration.md:170-183 curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up --ssh # Raspberry Pi: curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up ``` ```json5 // references/troubleshooting.md:354-362 sandbox: { docker: { network: "bridge", readOnlyRoot: false, user: "0:0", setupCommand: "apt-get update && apt-get install -y curl && curl -LsSf https://astral.sh/uv/install.sh | sh", }, } ``` ```bash # references/installation.md:110-116 # Alpine-basiertes Community-Image: docker pull alpine/openclaw:latest # Phioranex Community-Image mit install-Script: curl -fsSL https://raw.githubusercontent.com/phioranex/openclaw-docker/main/install.sh | sudo bash ``` ### Technical Analysis These instructions stream mutable content from external servers directly into a shell without first saving, inspecting, pinning, or cryptographically verifyin ...[truncated 1973 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove all `curl | bash`, `curl | sh`, and `curl | sudo bash` instructions. 2. Download installers to a local file before execution: ```bash curl --fail --show-error --location \ --output /tmp/installer.sh \ https://trusted.example/release/installer.sh ``` 3. Pin an immutable release version, tag, or commit rather than a mutable branch or generic installer endpoint. 4. Verify a publisher-provided cryptographic signature or checksum before execution. 5. Display or review the downloaded script before running it. 6. Execute with an unprivileged account unless a documented installation step specifically requires elevation. 7. Prefer signed operating-system repositories and package managers over remote shell installers. 8. Remove the personal-repository root installer or replace it with an audited official release artifact. 9. For the sandbox setup, install `uv` from a pinned package or verified artifact during image build rather than through a root `setupCommand`. ]]>

T03 · Remote Payload Retrieval and Execution

Error
Location
references/docker-setup.md:349
Finding
Mutable Downloaded Shell Helper Is Persisted in the User's Shell Startup File<![CDATA[ ## Vulnerability Details **File Location**: `references/docker-setup.md:346-353` **Vulnerability Type**: Remote payload execution with shell-startup persistence **Risk Level**: High ### Vulnerable Code ```bash ## Shell Helpers (Optional) mkdir -p ~/.clawdock && curl -sL https://raw.githubusercontent.com/openclaw/openclaw/main/scripts/shell-helpers/clawdock-helpers.sh -o ~/.clawdock/clawdock-helpers.sh # In ~/.zshrc: echo 'source ~/.clawdock/clawdock-helpers.sh' >> ~/.zshrc && source ~/.zshrc ``` ### Technical Analysis The helper is retrieved from the mutable `main` branch without a checksum, signature, immutable commit pin, or review step. The next command modifies `~/.zshrc` so the downloaded file is sourced during every future interactive Zsh session. It also sources the file immediately. This creates a persistent execution path from a network-delivered script into the user's shell environment. While optional shell helpers are related to Docker administration, automatically editing a startup file is not necessary for the Skill's core functionality and creates a broader, cross-session trust boundary. ### Attack Path 1. An attacker compromises the upstream repository, maintainer account, or delivery path. 2. Malicious commands are added to `clawdock-helpers.sh` on the mutable `main` branch. 3. A user follows the download command and receives the modified helper. 4. The Skill's command appends a `source` directive to `~/.zshrc`. 5. The malicious helper executes immediately and every time a new interactive Zsh session starts. 6. The payload can inspect shell environment variables, replace commands with functions or aliases, modify user files, and establish additional persistence. A local attacker able to modify `~/.clawdock/clawdock-helpers.sh` after installation could exploit the same startup entry even without controlling the upstream repository. ### Impact Assessment The payload executes with the user's privileges in an interactive shell c ...[truncated 300 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin the helper to an immutable, reviewed commit or signed release. 2. Publish and verify a cryptographic checksum or signature before use. 3. Download the file without automatically sourcing it: ```bash curl --fail --show-error --location \ --output ~/.clawdock/clawdock-helpers.sh \ https://raw.githubusercontent.com/openclaw/openclaw/<immutable-commit>/scripts/shell-helpers/clawdock-helpers.sh chmod 600 ~/.clawdock/clawdock-helpers.sh ``` 4. Require the user to inspect and explicitly approve the helper. 5. Do not automatically modify `~/.zshrc`; provide a manual, reversible opt-in instruction. 6. Before adding a startup entry, validate ownership and permissions of the helper and its parent directory. 7. Document removal procedures for both the startup entry and downloaded file. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error
Location
references/docker-setup.md:253
Finding
World-Writable Permissions Are Recommended for the OpenClaw Data Directory<![CDATA[ ## Vulnerability Details **File Location**: `references/docker-setup.md:253-266` **Vulnerability Type**: Excessive filesystem permissions and least-privilege violation **Risk Level**: High ### Vulnerable Code ```bash # Option 1 (empfohlen): Ownership auf UID 1000 sudo chown -R 1000:$(id -g) ~/.openclaw sudo chmod -R u+rwX,g+rwX,o-rwx ~/.openclaw # Option 2: Gruppe beschreibbar chmod -R 775 ~/.openclaw # Option 3 (LETZTER AUSWEG): World-writable chmod -R 777 ~/.openclaw ``` ### Technical Analysis Recursive mode `777` grants every local user and process read, write, and directory traversal permission throughout `~/.openclaw`. The project documentation identifies this directory as containing configuration, sessions, persistent workspace files, memory, and credentials. Marking the command as a last resort does not make it safe. It destroys access-control boundaries across all files and directories and permits unauthorized modification of content subsequently trusted by the OpenClaw runtime. Recursive `775` can present a similar risk when the selected group is broad or untrusted. ### Attack Path 1. An operator encounters a Docker permission error. 2. The operator applies the documented `chmod -R 777 ~/.openclaw` fallback. 3. Any local account or compromised process modifies files under the directory. 4. The attacker replaces configuration, workspace instructions, skills, memory, or credential material. 5. OpenClaw later reads the modified data and may execute attacker-influenced instructions or expose affected accounts. ### Impact Assessment A local attacker can read or replace sensitive OpenClaw files. Potential consequences include theft of API keys and channel credentials, session disclosure, manipulation of persistent memory or agent instructions, configuration poisoning, and loss of integrity across all agents using the directory. The command does not itself create a new privileged account, but it removes filesystem protections beyond what ...[truncated 59 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Remove the `chmod -R 777` fallback entirely. 2. Correct ownership for the exact UID and GID used by the container rather than granting global access. 3. Apply restrictive permissions by file type: - OpenClaw root and credential directories: `700` - Credential and configuration files: `600` - Shared directories, only when required: `750` - Shared files, only when required: `640` 4. Use Docker user namespace mapping, Compose `user`, or carefully scoped group membership instead of world-writable mounts. 5. Avoid recursive permission changes where possible; target only the file or directory producing the error. 6. Add validation commands such as: ```bash find ~/.openclaw -type d -perm -0002 -print find ~/.openclaw -type f -perm -0004 -print ``` 7. Warn operators to rotate credentials and inspect workspace/configuration integrity if world-writable permissions were previously applied. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
references/installation.md:173
Finding
Sensitive API Keys and Channel Tokens Are Passed Through Command Arguments and URLs<![CDATA[ ## Vulnerability Details **File Location**: - `references/installation.md:173-197` - `references/channels.md:121-128` - `references/docker-setup.md:272-281` - `references/quick-reference.md:65` - `references/quick-reference.md:79` **Vulnerability Type**: Exposure of secrets through command history, process arguments, and URLs **Risk Level**: Medium ### Vulnerable Code ```bash # references/installation.md:173-182 # Environment-Variable export ANTHROPIC_API_KEY="sk-ant-..." # Oder in Config openclaw config set models.providers.anthropic.apiKey "sk-ant-..." ``` ```bash # references/installation.md:189-197 # Telegram openclaw channels add --channel telegram --token "123456:ABC..." # WhatsApp (QR-Code scannen) openclaw channels login --channel whatsapp # Discord openclaw channels add --channel discord --token "YOUR_BOT_TOKEN" ``` ```bash # references/channels.md:127 curl "https://api.telegram.org/bot<TOKEN>/getUpdates" | jq '.result[-1].message.from.id' ``` ```bash # references/docker-setup.md:272-281 # WhatsApp (QR) docker compose run --rm openclaw-cli channels login # Telegram (Bot Token) docker compose run --rm openclaw-cli channels add --channel telegram --token "<TOKEN>" # Discord (Bot Token) docker compose run --rm openclaw-cli channels add --channel discord --token "<TOKEN>" ``` ```bash # references/quick-reference.md:65 and 79 openclaw channels add --channel telegram --token "<TOKEN>" openclaw channels add --channel discord --token "<TOKEN>" ``` ### Technical Analysis When users replace placeholders with live values, the secrets become literal command-line arguments. Commands may be retained in shell history, terminal logs, session recordings, diagnostic output, or process telemetry. On systems where process arguments are visible to other principals, a token may also be observable while the command is running. The Telegram example embeds the bot token in the request URL. URLs are commonly recorded by command history, debugging proxies, ...[truncated 1188 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Prefer the documented interactive secret setup: ```bash openclaw secrets configure ``` 2. Use SecretRef backed by a protected environment, file, or external secret manager rather than literal configuration or CLI arguments. 3. If a CLI must accept a token, support reading it from standard input or a protected file descriptor. 4. Avoid embedding authentication tokens in URLs. 5. Warn users not to paste live secrets into commands that will be retained in shell history. 6. Ensure secret files are owned by the OpenClaw user and use mode `600`. 7. Redact tokens from logs, diagnostics, process telemetry, and support bundles. 8. Rotate any token suspected of having entered command history or logs. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
references/troubleshooting.md:390
Finding
Credential File Is Duplicated Without Enforcing Secure Destination Permissions<![CDATA[ ## Vulnerability Details **File Location**: `references/troubleshooting.md:390-399` **Vulnerability Type**: Unsafe credential handling and expansion of credential exposure **Risk Level**: Medium ### Vulnerable Code ```bash ## Multi-Agent-Probleme ### Credentials teilen **Auth-Profile sind per-Agent!** # Credential kopieren (manuell): cp ~/.openclaw/credentials/anthropic/default \ ~/.openclaw/agents/work/agent/credentials/anthropic/default ``` ### Technical Analysis The instruction duplicates provider authentication material into an agent-specific directory using ordinary `cp`. It does not verify destination ownership, create destination directories with restrictive permissions, force file mode `600`, or explain whether the copied credential grants broader access than the destination agent requires. Copying a shared provider credential increases the number of locations from which it can be read, backed up, or accidentally disclosed. It also weakens agent isolation by giving the `work` agent the same provider identity represented by the source credential. Credential access is relevant to the Skill's declared troubleshooting scope, but direct duplication without permission checks or scoped credential provisioning does not follow least-privilege practice. ### Attack Path 1. The operator follows the troubleshooting instruction to share an authentication profile. 2. The destination directory has weaker ownership or permissions than the source credential directory, or is accessible to another agent or process. 3. The credential is copied into that broader trust boundary. 4. Another principal reads the duplicated file. 5. The principal authenticates to the provider using the copied credential and obtains whatever account access the credential grants. ### Impact Assessment The copied credential may grant access to a paid AI provider account or other provider resources associated with the profile. Consequences can include unauthorized API usage, ...[truncated 276 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Prefer per-agent, independently scoped credentials or SecretRef instead of copying a shared credential. 2. Use the provider's supported credential-management workflow where available. 3. If duplication is unavoidable, validate ownership and create the destination securely: ```bash install -d -m 700 ~/.openclaw/agents/work/agent/credentials/anthropic install -m 600 \ ~/.openclaw/credentials/anthropic/default \ ~/.openclaw/agents/work/agent/credentials/anthropic/default ``` 4. Verify that both the source and destination are owned by the intended OpenClaw user. 5. Grant the destination agent only the provider scopes required for its role. 6. Exclude credential directories from ordinary workspace backups and public repositories. 7. Rotate and revoke duplicated credentials when the destination agent no longer requires access. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (97)

Chaining Abuse

High
Category
Tool Misuse
Content
dig +short api.telegram.org AAAA

# Fix: IPv4 erzwingen via /etc/hosts
echo "$(dig +short api.telegram.org A | head -1) api.telegram.org" | sudo tee -a /etc/hosts

# Oder: proxy in Config setzen
```
Confidence
91% confidence
Finding
This command chains network-derived output directly into a privileged write via a shell pipe to sudo tee. Even though the source is a DNS lookup for a legitimate service, the pattern is dangerous because it normalizes taking externally influenced command output and writing it as root without an intermediate verification step.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
```bash
# Option 1 (empfohlen): Ownership auf UID 1000
sudo chown -R 1000:$(id -g) ~/.openclaw
sudo chmod -R u+rwX,g+rwX,o-rwx ~/.openclaw

# Option 2: Gruppe beschreibbar
Confidence
97% confidence
Finding
The recursive chown/chmod block can be misused because it modifies an entire state directory that likely contains authentication tokens, configuration, memory, and workspace files for the agent system. Combined with the later 777 fallback, this can make sensitive files writable by unintended local users or malware, enabling credential theft, configuration tampering, and persistence.

External Script Fetching

High
Category
Supply Chain
Content
### Erste Schritte
```bash
# 1. Installieren
curl -fsSL https://get.openclaw.ai | bash

# 2. Wizard durchlaufen (Token, Model, Telegram-Bot)
openclaw setup
Confidence
98% confidence
Finding
The example instructs users to pipe a remote script directly into bash, which grants immediate code execution to whatever is served by that URL at runtime. In a setup guide for an agent framework, this is especially risky because users are likely to run it verbatim on servers that will later hold tokens, channel credentials, and agent data.

Chaining Abuse

High
Category
Tool Misuse
Content
### Erste Schritte
```bash
# 1. Installieren
curl -fsSL https://get.openclaw.ai | bash

# 2. Wizard durchlaufen (Token, Model, Telegram-Bot)
openclaw setup
Confidence
98% confidence
Finding
Piping curl output directly into bash is a classic unsafe chaining pattern because it executes attacker-controlled network data without validation. In this skill's context, the resulting host may store gateway tokens and messaging credentials, increasing the real-world impact of compromise.

External Script Fetching

High
Category
Supply Chain
Content
### VPS-Setup
```bash
# Tailscale installieren
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
tailscale ip -4   # z.B. 100.64.x.x
```
Confidence
97% confidence
Finding
Piping the Tailscale installer directly into sh executes unreviewed network content immediately, creating a straightforward supply-chain and MITM execution risk if the distribution path is compromised. Because this config is for a VPS gateway environment, successful exploitation could expose network routing, credentials, and access to connected agent infrastructure.

Chaining Abuse

High
Category
Tool Misuse
Content
### VPS-Setup
```bash
# Tailscale installieren
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
tailscale ip -4   # z.B. 100.64.x.x
```
Confidence
97% confidence
Finding
The '| sh' chain causes immediate shell execution of remote content with no integrity or authenticity verification. On a VPS used for gateway and tailnet connectivity, exploitation could grant persistent access to both the host and attached communication channels.

Chaining Abuse

High
Category
Tool Misuse
Content
```bash
# 1. Raspberry Pi OS Lite (64-bit) installieren
# 2. SSH aktivieren, Updates
sudo apt update && sudo apt upgrade -y

# 3. Node.js 22+ installieren
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo bash -
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Chaining Abuse

High
Category
Tool Misuse
Content
sudo apt update && sudo apt upgrade -y

# 3. Node.js 22+ installieren
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo bash -
sudo apt install -y nodejs

# 4. Tailscale
Confidence
95% confidence
Finding
The pipeline sends remotely fetched content straight into sudo bash, combining chaining abuse with privileged execution. This removes opportunities for inspection and turns any compromise of the upstream script or delivery path into immediate root code execution.

External Script Fetching

High
Category
Supply Chain
Content
sudo apt install -y nodejs

# 4. Tailscale
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

# 5. OpenClaw (nur Node-Host, kein Gateway!)
Confidence
97% confidence
Finding
This repeats the same high-risk curl-to-sh pattern for Tailscale on the Raspberry Pi node. Since the node is intended to connect back to the gateway and may receive automation capabilities, compromise here could be leveraged into broader control of the OpenClaw environment.

Chaining Abuse

High
Category
Tool Misuse
Content
sudo apt install -y nodejs

# 4. Tailscale
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

# 5. OpenClaw (nur Node-Host, kein Gateway!)
Confidence
97% confidence
Finding
This is the same unsafe network-to-shell chaining pattern on the Raspberry Pi node setup. Because the node is designed to participate in the OpenClaw control plane, a compromised install can become a foothold for later movement or abuse of granted capabilities.

Chaining Abuse

High
Category
Tool Misuse
Content
docker pull alpine/openclaw:latest

# Phioranex Community-Image mit install-Script:
curl -fsSL https://raw.githubusercontent.com/phioranex/openclaw-docker/main/install.sh | sudo bash
```

### Docker-Volumes
Confidence
99% confidence
Finding
The `curl ... | sudo bash` chain combines remote content retrieval, shell piping, and privilege escalation into a single opaque command, eliminating opportunities for user review or integrity checks. In security terms this greatly amplifies the blast radius of any compromise in the source, transport, or command substitution path.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
```bash
# Index zurücksetzen (bei Provider/Modell-Wechsel)
rm ~/.openclaw/memory/<agentId>.sqlite

# Gateway neu starten
systemctl --user restart openclaw-gateway
Confidence
85% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

External Script Fetching

High
Category
Supply Chain
Content
### Schritt 1: Tailscale auf VPS installieren
```bash
# Auf dem VPS:
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
# Tailscale-IP notieren: tailscale ip -4
```
Confidence
98% confidence
Finding
Piping a remote script directly into 'sh' executes unverified code from the network with no integrity check or review step. If the remote host, transport, DNS, or distribution path is compromised, an attacker could gain code execution during installation, which is especially dangerous because the next step uses administrative privileges and this guide targets gateway infrastructure.

Chaining Abuse

High
Category
Tool Misuse
Content
### Schritt 1: Tailscale auf VPS installieren
```bash
# Auf dem VPS:
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
# Tailscale-IP notieren: tailscale ip -4
```
Confidence
99% confidence
Finding
The '| sh' chain is the dangerous mechanism that turns a network fetch into immediate shell execution, removing any opportunity for review or integrity enforcement. In infrastructure documentation for gateways and remote nodes, this materially increases the chance of accidental execution of attacker-controlled content.

External Script Fetching

High
Category
Supply Chain
Content
```bash
# Auf dem Pi:
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

npm install -g openclaw@latest
Confidence
98% confidence
Finding
This installation pattern again executes a remotely fetched script without validation, creating a supply-chain and remote code execution risk on a Raspberry Pi node. In this skill's context, nodes may later execute shell commands and remain always-on, so compromising the node during setup can yield durable control over a trusted device.

Chaining Abuse

High
Category
Tool Misuse
Content
```bash
# Auf dem Pi:
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up

npm install -g openclaw@latest
Confidence
99% confidence
Finding
Using '| sh' on the Pi setup path creates immediate execution of remote content on a device intended to be persistent and trusted within the OpenClaw environment. A compromise here could lead to long-term node takeover, abuse of exec capabilities, and pivoting within the tailnet or attached environment.

Credential Access

High
Category
Privilege Escalation
Content
providers: {
    filemain: {
      source: "file",
      path: "~/.openclaw/secrets.json",
      mode: "json",  // oder "singleValue"
    },
  },
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
providers: {
    filemain: {
      source: "file",
      path: "~/.openclaw/secrets.json",
      mode: "json",  // oder "singleValue"
    },
  },
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
ssh: {
        target: "user@gateway-host:22",
        workspaceRoot: "/tmp/openclaw-sandboxes",
        identityFile: "~/.ssh/id_ed25519",
        // ODER SecretRefs:
        identityData: { source: "env", provider: "default", id: "SSH_IDENTITY" },
        certificateData: { source: "env", provider: "default", id: "SSH_CERTIFICATE" },
Confidence
90% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

External Script Fetching

High
Category
Supply Chain
Content
#### 1. Tailscale auf VPS installieren
```bash
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --ssh    # Optional: SSH über Tailscale
tailscale ip -4            # IP notieren
tailscale status           # Prüfen
Confidence
98% confidence
Finding
The documentation instructs users to fetch and execute a remote script directly with 'curl ... | sh', which creates a supply-chain execution risk. If the remote server, transport path, or script content is compromised, arbitrary code will run immediately on the target host, likely followed by privileged operations.

Chaining Abuse

High
Category
Tool Misuse
Content
#### 1. Tailscale auf VPS installieren
```bash
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up --ssh    # Optional: SSH über Tailscale
tailscale ip -4            # IP notieren
tailscale status           # Prüfen
Confidence
97% confidence
Finding
Piping directly into 'sh' removes any review barrier and enables immediate command chaining from untrusted network content into shell execution. In a deployment guide for remote access tooling, this increases the likelihood of infrastructure compromise because administrators may run it on sensitive servers.

External Script Fetching

High
Category
Supply Chain
Content
brew install tailscale
# iPhone/Android: App Store / Play Store
# Raspberry Pi:
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
```
Confidence
98% confidence
Finding
This is the same unsafe remote-script execution pattern in another installation path. Because the document targets infrastructure setup on Raspberry Pi/nodes, compromise of the fetched script could give an attacker code execution on systems that may later join the agent/network environment.

Chaining Abuse

High
Category
Tool Misuse
Content
brew install tailscale
# iPhone/Android: App Store / Play Store
# Raspberry Pi:
curl -fsSL https://tailscale.com/install.sh | sh
sudo tailscale up
```
Confidence
97% confidence
Finding
The same chaining-abuse pattern appears in the Raspberry Pi/node setup path, where users are instructed to execute remote content immediately. That is dangerous because it normalizes unaudited shell execution on devices that may have access to internal services, secrets, or management channels.

Chaining Abuse

High
Category
Tool Misuse
Content
network: "bridge",
    readOnlyRoot: false,
    user: "0:0",
    setupCommand: "apt-get update && apt-get install -y curl && curl -LsSf https://astral.sh/uv/install.sh | sh",
  },
}
```
Confidence
97% confidence
Finding
The chained setupCommand combines package installation and remote script execution in a single shell line using && and a pipe to sh. This increases risk by making review and failure isolation harder, while still culminating in arbitrary code execution from a remote source under a permissive sandbox configuration (root, writable root filesystem, network enabled).

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The skill instructions, warnings, and operational guidance are presented in German throughout the file, which effectively forces a specific language for users of the skill. The file does not state that German is optional, nor does it justify a German-only scope such as a region-specific compliance or locale-limited deployment context.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.prompt_injection_instructions, suspicious.secret_argv_exposure

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/tailscale-integration.md:71

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/memory-system.md:67

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
references/docker-setup.md:293