T03 · Remote Payload Retrieval and Execution
Error
- Location
references/installation.md:115- Finding
Unverified Remote Installers Are Executed Directly by a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Openclaw Expert
Security checks for vulnerabilities and agentic risk
Overview
This is a documentation-only OpenClaw administration skill, but it repeatedly recommends high-impact installation and permission commands that users should review carefully before running.
Install only if you want an OpenClaw sysadmin reference skill and are comfortable manually reviewing commands before execution. Do not run curl-to-shell, sudo bash, chmod -R 777, or ~/.zshrc helper commands blindly; prefer official package-manager installs, pinned/checksummed downloads, restrictive permissions, SecretRef-based credential handling, and backups before OpenClaw changes.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T03 · Remote Payload Retrieval and Execution
Error
- Location
references/docker-setup.md:349- Finding
Mutable Downloaded Shell Helper Is Persisted in the User's Shell Startup File
- Content
View full analysis
> ~/.zshrc && source ~/.zshrc ``` ### Technical Analysis The helper is retrieved from the mutable `main` branch without a checksum, signature, immutable commit pin, or review step. The next command modifies `~/.zshrc` so the downloaded file is sourced during every future interactive Zsh session. It also sources the file immediately. This creates a persistent execution path from a network-delivered script into the user's shell environment. While optional shell helpers are related to Docker administration, automatically editing a startup file is not necessary for the Skill's core functionality and creates a broader, cross-session trust boundary. ### Attack Path 1. An attacker compromises the upstream repository, maintainer account, or delivery path. 2. Malicious commands are added to `clawdock-helpers.sh` on the mutable `main` branch. 3. A user follows the download command and receives the modified helper. 4. The Skill's command appends a `source` directive to `~/.zshrc`. 5. The malicious helper executes immediately and every time a new interactive Zsh session starts. 6. The payload can inspect shell environment variables, replace commands with functions or aliases, modify user files, and establish additional persistence. A local attacker able to modify `~/.clawdock/clawdock-helpers.sh` after installation could exploit the same startup entry even without controlling the upstream repository. ### Impact Assessment The payload executes with the user's privileges in an interactive shell c ...[truncated 300 chars]- Remediation
View remediation
/scripts/shell-helpers/clawdock-helpers.sh chmod 600 ~/.clawdock/clawdock-helpers.sh ``` 4. Require the user to inspect and explicitly approve the helper. 5. Do not automatically modify `~/.zshrc`; provide a manual, reversible opt-in instruction. 6. Before adding a startup entry, validate ownership and permissions of the helper and its parent directory. 7. Document removal procedures for both the startup entry and downloaded file. ]]>
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/docker-setup.md:253- Finding
World-Writable Permissions Are Recommended for the OpenClaw Data Directory
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/installation.md:173- Finding
Sensitive API Keys and Channel Tokens Are Passed Through Command Arguments and URLs
- Content
View full analysis
/getUpdates" | jq '.result[-1].message.from.id' ``` ```bash # references/docker-setup.md:272-281 # WhatsApp (QR) docker compose run --rm openclaw-cli channels login # Telegram (Bot Token) docker compose run --rm openclaw-cli channels add --channel telegram --token "" # Discord (Bot Token) docker compose run --rm openclaw-cli channels add --channel discord --token "" ``` ```bash # references/quick-reference.md:65 and 79 openclaw channels add --channel telegram --token "" openclaw channels add --channel discord --token "" ``` ### Technical Analysis When users replace placeholders with live values, the secrets become literal command-line arguments. Commands may be retained in shell history, terminal logs, session recordings, diagnostic output, or process telemetry. On systems where process arguments are visible to other principals, a token may also be observable while the command is running. The Telegram example embeds the bot token in the request URL. URLs are commonly recorded by command history, debugging proxies, ...[truncated 1188 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/troubleshooting.md:390- Finding
Credential File Is Duplicated Without Enforcing Secure Destination Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (97)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 91% confidence
- Finding
This command chains network-derived output directly into a privileged write via a shell pipe to sudo tee. Even though the source is a DNS lookup for a legitimate service, the pattern is dangerous because it normalizes taking externally influenced command output and writing it as root without an intermediate verification step.
- Content
dig +short api.telegram.org AAAA
Fix: IPv4 erzwingen via /etc/hosts
echo "$(dig +short api.telegram.org A | head -1) api.telegram.org" | sudo tee -a /etc/hosts
Oder: proxy in Config setzen
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The recursive chown/chmod block can be misused because it modifies an entire state directory that likely contains authentication tokens, configuration, memory, and workspace files for the agent system. Combined with the later 777 fallback, this can make sensitive files writable by unintended local users or malware, enabling credential theft, configuration tampering, and persistence.
- Content
bash # Option 1 (empfohlen): Ownership auf UID 1000 sudo chown -R 1000:$(id -g) ~/.openclaw sudo chmod -R u+rwX,g+rwX,o-rwx ~/.openclaw # Option 2: Gruppe beschreibbar
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The example instructs users to pipe a remote script directly into bash, which grants immediate code execution to whatever is served by that URL at runtime. In a setup guide for an agent framework, this is especially risky because users are likely to run it verbatim on servers that will later hold tokens, channel credentials, and agent data.
- Content
Erste Schritte
bash # 1. Installieren curl -fsSL https://get.openclaw.ai | bash # 2. Wizard durchlaufen (Token, Model, Telegram-Bot) openclaw setup
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
Piping curl output directly into bash is a classic unsafe chaining pattern because it executes attacker-controlled network data without validation. In this skill's context, the resulting host may store gateway tokens and messaging credentials, increasing the real-world impact of compromise.
- Content
Erste Schritte
bash # 1. Installieren curl -fsSL https://get.openclaw.ai | bash # 2. Wizard durchlaufen (Token, Model, Telegram-Bot) openclaw setup
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
Piping the Tailscale installer directly into sh executes unreviewed network content immediately, creating a straightforward supply-chain and MITM execution risk if the distribution path is compromised. Because this config is for a VPS gateway environment, successful exploitation could expose network routing, credentials, and access to connected agent infrastructure.
- Content
VPS-Setup
bash # Tailscale installieren curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up tailscale ip -4 # z.B. 100.64.x.x
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The '| sh' chain causes immediate shell execution of remote content with no integrity or authenticity verification. On a VPS used for gateway and tailnet connectivity, exploitation could grant persistent access to both the host and attached communication channels.
- Content
VPS-Setup
bash # Tailscale installieren curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up tailscale ip -4 # z.B. 100.64.x.x
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
bash # 1. Raspberry Pi OS Lite (64-bit) installieren # 2. SSH aktivieren, Updates sudo apt update && sudo apt upgrade -y # 3. Node.js 22+ installieren curl -fsSL https://deb.nodesource.com/setup_22.x | sudo bash -
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The pipeline sends remotely fetched content straight into sudo bash, combining chaining abuse with privileged execution. This removes opportunities for inspection and turns any compromise of the upstream script or delivery path into immediate root code execution.
- Content
md sudo apt update && sudo apt upgrade -y # 3. Node.js 22+ installieren curl -fsSL https://deb.nodesource.com/setup_22.x | sudo bash - sudo apt install -y nodejs # 4. Tailscale
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
This repeats the same high-risk curl-to-sh pattern for Tailscale on the Raspberry Pi node. Since the node is intended to connect back to the gateway and may receive automation capabilities, compromise here could be leveraged into broader control of the OpenClaw environment.
- Content
md sudo apt install -y nodejs # 4. Tailscale curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up # 5. OpenClaw (nur Node-Host, kein Gateway!)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
This is the same unsafe network-to-shell chaining pattern on the Raspberry Pi node setup. Because the node is designed to participate in the OpenClaw control plane, a compromised install can become a foothold for later movement or abuse of granted capabilities.
- Content
md sudo apt install -y nodejs # 4. Tailscale curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up # 5. OpenClaw (nur Node-Host, kein Gateway!)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The
curl ... | sudo bashchain combines remote content retrieval, shell piping, and privilege escalation into a single opaque command, eliminating opportunities for user review or integrity checks. In security terms this greatly amplifies the blast radius of any compromise in the source, transport, or command substitution path.- Content
docker pull alpine/openclaw:latest
Phioranex Community-Image mit install-Script:
curl -fsSL https://raw.githubusercontent.com/phioranex/openclaw-docker/main/install.sh | sudo bash
text ### Docker-Volumes
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
bash # Index zurücksetzen (bei Provider/Modell-Wechsel) rm ~/.openclaw/memory/<agentId>.sqlite # Gateway neu starten systemctl --user restart openclaw-gateway
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
Piping a remote script directly into 'sh' executes unverified code from the network with no integrity check or review step. If the remote host, transport, DNS, or distribution path is compromised, an attacker could gain code execution during installation, which is especially dangerous because the next step uses administrative privileges and this guide targets gateway infrastructure.
- Content
Schritt 1: Tailscale auf VPS installieren
bash # Auf dem VPS: curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up # Tailscale-IP notieren: tailscale ip -4
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
The '| sh' chain is the dangerous mechanism that turns a network fetch into immediate shell execution, removing any opportunity for review or integrity enforcement. In infrastructure documentation for gateways and remote nodes, this materially increases the chance of accidental execution of attacker-controlled content.
- Content
Schritt 1: Tailscale auf VPS installieren
bash # Auf dem VPS: curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up # Tailscale-IP notieren: tailscale ip -4
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
This installation pattern again executes a remotely fetched script without validation, creating a supply-chain and remote code execution risk on a Raspberry Pi node. In this skill's context, nodes may later execute shell commands and remain always-on, so compromising the node during setup can yield durable control over a trusted device.
- Content
bash # Auf dem Pi: curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up npm install -g openclaw@latest
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Using '| sh' on the Pi setup path creates immediate execution of remote content on a device intended to be persistent and trusted within the OpenClaw environment. A compromise here could lead to long-term node takeover, abuse of exec capabilities, and pivoting within the tailnet or attached environment.
- Content
bash # Auf dem Pi: curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up npm install -g openclaw@latest
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md providers: { filemain: { source: "file", path: "~/.openclaw/secrets.json", mode: "json", // oder "singleValue" }, },
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md providers: { filemain: { source: "file", path: "~/.openclaw/secrets.json", mode: "json", // oder "singleValue" }, },
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ssh: { target: "user@gateway-host:22", workspaceRoot: "/tmp/openclaw-sandboxes", identityFile: "~/.ssh/id_ed25519", // ODER SecretRefs: identityData: { source: "env", provider: "default", id: "SSH_IDENTITY" }, certificateData: { source: "env", provider: "default", id: "SSH_CERTIFICATE" },
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The documentation instructs users to fetch and execute a remote script directly with 'curl ... | sh', which creates a supply-chain execution risk. If the remote server, transport path, or script content is compromised, arbitrary code will run immediately on the target host, likely followed by privileged operations.
- Content
1. Tailscale auf VPS installieren
bash curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up --ssh # Optional: SSH über Tailscale tailscale ip -4 # IP notieren tailscale status # Prüfen
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
Piping directly into 'sh' removes any review barrier and enables immediate command chaining from untrusted network content into shell execution. In a deployment guide for remote access tooling, this increases the likelihood of infrastructure compromise because administrators may run it on sensitive servers.
- Content
1. Tailscale auf VPS installieren
bash curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up --ssh # Optional: SSH über Tailscale tailscale ip -4 # IP notieren tailscale status # Prüfen
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
This is the same unsafe remote-script execution pattern in another installation path. Because the document targets infrastructure setup on Raspberry Pi/nodes, compromise of the fetched script could give an attacker code execution on systems that may later join the agent/network environment.
- Content
brew install tailscale
iPhone/Android: App Store / Play Store
Raspberry Pi:
curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up
text
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The same chaining-abuse pattern appears in the Raspberry Pi/node setup path, where users are instructed to execute remote content immediately. That is dangerous because it normalizes unaudited shell execution on devices that may have access to internal services, secrets, or management channels.
- Content
brew install tailscale
iPhone/Android: App Store / Play Store
Raspberry Pi:
curl -fsSL https://tailscale.com/install.sh | sh sudo tailscale up
text
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The chained setupCommand combines package installation and remote script execution in a single shell line using && and a pipe to sh. This increases risk by making review and failure isolation harder, while still culminating in arbitrary code execution from a remote source under a permissive sandbox configuration (root, writable root filesystem, network enabled).
- Content
network: "bridge", readOnlyRoot: false, user: "0:0", setupCommand: "apt-get update && apt-get install -y curl && curl -LsSf https://astral.sh/uv/install.sh | sh", }, }
text
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructions, warnings, and operational guidance are presented in German throughout the file, which effectively forces a specific language for users of the skill. The file does not state that German is optional, nor does it justify a German-only scope such as a region-specific compliance or locale-limited deployment context.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal, suspicious.prompt_injection_instructions, suspicious.secret_argv_exposure
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- references/tailscale-integration.md:71
Prompt-injection style instruction pattern detected.
Warn
- Code
- suspicious.prompt_injection_instructions
- Location
- references/memory-system.md:67
Instructions pass high-value credentials through process argv.
Critical
- Code
- suspicious.secret_argv_exposure
- Location
- references/docker-setup.md:293