ClawHub
Back to skill

Security audit

Claude Code CLI for OpenClaw

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned rather than malicious, but it should be reviewed because it promotes persistent plaintext storage of a long-lived Claude token and installs an unpinned global CLI package.

Install only if you are comfortable with an external Claude coding CLI reading and modifying your project files. Prefer a pinned package version, avoid running the installer as root, do not store the OAuth token in /etc/environment or shell startup files if a secret store is available, never print the full token, and review any OpenClaw backend/fallback configuration before enabling it broadly.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
scripts/install.sh:63
Finding

Unpinned npm Package Is Downloaded and Installed Globally

Content
View full analysis

Vulnerability Details

File Location: scripts/install.sh:63-70
Vulnerability Type: Unpinned third-party dependency installed with global scope
Risk Level: Medium

Complete Code Snippet

bash
# Install Claude Code CLI
install_claude_code() {
    print_info "Installing Claude Code CLI globally..."
    
    if npm install -g @anthropic-ai/claude-code; then
        print_success "Claude Code CLI installed successfully"
    else
        print_error "Failed to install Claude Code CLI"
        exit 1
    fi

The same unpinned command is recommended in SKILL.md:77-81 and README.md:54-57.

Technical Analysis

The installer downloads the package version currently associated with the npm registry's default distribution tag. Neither an exact version nor an integrity hash is specified. Consequently, the effective code executed by this Skill can change after the Skill package itself has been audited.

npm packages may execute lifecycle scripts during installation. Because the command uses -g, package files and executable links are written into the global npm prefix. If the installer is run as root—as suggested by several /root paths in the documentation—package lifecycle code executes with root privileges. Even without root, it executes with the invoking user's permissions and can access that user's files, environment, and OpenClaw workspace.

The package name appears consistent with Anthropic's documented package; there is no evidence in the audited repository that it is currently malicious. The vulnerability is the absence of version and integrity controls, which creates exposure to registry compromise, maintainer-account compromise, or an unsafe future release.

Attack Path

  1. An attacker compromises the upstream npm publisher, registry delivery path, or a future package release.
  2. The attacker publishes a malicious version under the package's default distribution tag.
  3. A user ...[truncated 951 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the package to an explicitly reviewed version, for example:
    bash
    CLAUDE_VERSION='2.1.75'
npm install -g --ignore-scripts "@anthropic-ai/claude-code@${CLAUDE_VERSION}"
  2. Verify the package tarball against a trusted, repository-maintained integrity value before installation. Do not rely only on a mutable npm distribution tag.
  3. Determine whether lifecycle scripts are necessary. Prefer --ignore-scripts; if scripts are required, review them for the pinned release before allowing execution.
  4. Avoid root execution. Install into a dedicated, user-owned npm prefix or isolated container with access only to the required workspace.
  5. Record the resolved package version and integrity digest in installation logs.
  6. Add an allowlist check for the expected npm registry and fail if npm is configured to use an untrusted registry.
  7. Update SKILL.md and README.md so their manual installation commands use the same pinned, verified process.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:135
Finding

Long-Lived OAuth Token Is Recommended for Plaintext Persistent Storage

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:135-146; additional exposure at SKILL.md:174-177
Vulnerability Type: Plaintext credential persistence and terminal disclosure
Risk Level: Medium

Complete Code Snippet

bash
The token must be available as the `CLAUDE_CODE_OAUTH_TOKEN` environment variable.

**Option 1: Shell RC Files (Recommended)**
```bash
echo "export CLAUDE_CODE_OAUTH_TOKEN=YOUR_OAUTH_TOKEN_HERE" >> /root/.bashrc
echo "export CLAUDE_CODE_OAUTH_TOKEN=YOUR_OAUTH_TOKEN_HERE" >> /root/.profile
source /root/.bashrc

Option 2: System-Wide

bash
echo "CLAUDE_CODE_OAUTH_TOKEN=YOUR_OAUTH_TOKEN_HERE" >> /etc/environment
text

The verification procedure additionally recommends displaying the complete secret:

```bash
echo $CLAUDE_CODE_OAUTH_TOKEN
# Should output: sk-ant-oat01-xxxxx

Related recommendations are printed by scripts/install.sh:113-122, and the script recommends printing the variable again at scripts/install.sh:204-207.

Technical Analysis

The Skill describes the OAuth value as a long-lived bearer token valid for one year, but recommends placing it directly in shell initialization files or /etc/environment. These are plaintext configuration files rather than purpose-built secret stores.

Storing the token in .bashrc and .profile causes it to be exported into every descendant process started from the shell, including unrelated build tools, plugins, and agent subprocesses. Duplicating the secret in multiple files also increases the number of locations requiring protection and secure deletion.

System-wide storage in /etc/environment exceeds the minimum privilege needed for a per-user coding CLI and may make the credential available to a broader set of sessions or processes, depending on host configuration. Displaying the complete token with echo can expose it through terminal capture, agent logs, support transcripts, screen sharing, o ...[truncated 1988 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove /etc/environment as a recommended storage option; system-wide exposure is unnecessary for a per-user CLI.
  2. Do not store the token directly in .bashrc or .profile. Use an operating-system keychain, dedicated secrets manager, or OpenClaw's protected secret facility.
  3. If file-based storage is unavoidable, use a dedicated file outside the repository with mode 0600, restrictive parent-directory permissions, and no backup or synchronization:
    bash
    install -m 600 /dev/null "$HOME/.config/claude/token"
    The CLI integration should read it only at execution time rather than exporting it into every shell process.
  4. Configure the OpenClaw backend to resolve the secret by reference instead of embedding the literal value in config.patch.
  5. Replace full-value verification with a presence-only check:
    bash
    if [ -n "${CLAUDE_CODE_OAUTH_TOKEN:-}" ]; then
    printf '%s\n' 'CLAUDE_CODE_OAUTH_TOKEN is configured'
fi
  6. Never print the complete bearer token to stdout or logs. If identification is necessary, display only a short, non-sensitive suffix.
  7. Document token revocation, rotation, file-permission validation, and cleanup procedures.
  8. Ensure subprocesses receive the token only when required and clear it from the environment immediately afterward.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (24)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 261)May include surrounding context.

plement the plan"

text

### Precise Specifications

"In src/pages/AuthVerify.tsx, line 42, fix the redirect bug. Expected: go to /dashboard. Current: stays on /verify."

text

## 🐛 Troubleshooting

### Authentication failed
```bash
claude setup-token  # Re-authenticate
# Update token in environment and OpenClaw config

Command not found: claude

bash
export PATH="$PATH:$(npm bin -g)"
echo 'export PATH="$PATH:$(npm bin -g)"' >> /root/.bashrc

Missing CLAUDE.md

bash
cp templates/CLAUDE.md.template /path/to/project/CLAUDE.md
# Edit with project details

See SKILL.md for complete troubleshooting guide.

🌟 Real-World Example

MissionDeck Project:

  • Created /root/.openclaw/workspace/missiondeck/CLAUDE.md
  • Documented: 24 edge functions, signup flow, all routes, coding standards
  • Result: Claude Code instantly understood project structure
  • Zero extra context needed in prompts

Task: "Remove discount banner"

  • Claude Code searched codeba

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
94% confidence
Finding

Appending CLAUDE_CODE_OAUTH_TOKEN to /root/.bashrc, /root/.profile, or /etc/environment persists a long-lived bearer token in plaintext across sessions and potentially system-wide. This materially increases exposure through shell history, filesystem reads, backups, diagnostics, image snapshots, or accidental disclosure, and the one-year token lifetime amplifies the blast radius.

Content

Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.

  1. Browser shows authorization code
  2. Paste code back into terminal at prompt: Paste code here if prompted >
  3. Success: ✓ Long-lived authentication token created successfully!
  4. Token format: sk-ant-oat01-xxxxx (valid for 1 year)

Storing the Token

The token must be available as the CLAUDE_CODE_OAUTH_TOKEN environment variable.

Option 1: Shell RC Files (Recommended)

bash
echo "export CLAUDE_CODE_OAUTH_TOKEN=YOUR_OAUTH_TOKEN_HERE" >> /root/.bashrc
echo "export CLAUDE_CODE_OAUTH_TOKEN=YOUR_OAUTH_TOKEN_HERE" >> /root/.profile
source /root/.bashrc

Option 2: System-Wide

bash
echo "CLAUDE_CODE_OAUTH_TOKEN=YOUR_OAUTH_TOKEN_HERE" >> /etc/environment

Option 3: OpenClaw Config Only

Add to your openclaw.json config patch (see next section) — the token will be available during OpenClaw backend calls but not direct CLI usage.

🔒 Security Warning

CRITICAL: Never commit your CLAUDE_CODE_OAUTH_TOKEN to version control.

  • ✅ Store in e

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 175)May include surrounding context.

Add to your .gitignore:

gitignore
.env
.env.local
.env.*.local
openclaw.json
config.patch

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

Add to your .gitignore:

gitignore
.env
.env.local
.env.*.local
openclaw.json
config.patch

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 421)May include surrounding context.

"In src/pages/AuthVerify.tsx, line 42, the redirect after magic link verification is broken. Expected behavior: redirect to /dashboard. Current behavior: stays on /verify. Fix it."

text

**Why:** Clear context = precise fixes

### 5. File-Focused Tasks

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 566)May include surrounding context.

Fix: Use --print flag for non-interactive mode (outputs to stdout)

bash
claude --print "your task"  # No approval needed, just shows output

For interactive mode (approval required):

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 592)May include surrounding context.

Force specific model:

bash
claude --model opus-4.6 --print "Complex architecture refactor"
claude --model sonnet-4.6 --print "Quick bug fix"

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 593)May include surrounding context.

bash
claude --model opus-4.6 --print "Complex architecture refactor"
claude --model sonnet-4.6 --print "Quick bug fix"

Integration with Git Workflow

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/install.sh (reported line 116)May include surrounding context.

sh
print_warning "CLAUDE_CODE_OAUTH_TOKEN not found in environment"
    echo ""
    echo -e "${YELLOW}You need to authenticate with Claude Max subscription:${NC}"
    echo -e "  1. Run: ${GREEN}claude setup-token${NC}"
    echo -e "  2. Follow the browser OAuth flow"
    echo -e "  3. Store the token persistently:"
    echo ""
    echo -e "${BLUE}Option 1 (Recommended): Shell RC files${NC}"
    echo -e "  ${GREEN}echo 'export CLAUDE_CODE_OAUTH_TOKEN=YOUR_TOKEN_HERE' >> ~/.bashrc${NC}"
    echo -e "  ${GREEN}echo 'export CLAUDE_CODE_OAUTH_TOKEN=YOUR_TOKEN_HERE' >> ~/.profile${NC}"
    echo -e "  ${GREEN}source ~/.bashrc${NC}"
    echo ""
    echo -e "${BLUE}Option 2: System-wide${NC}"
    echo -e "  ${GREEN}echo 'CLAUDE_CODE_OAUTH_TOKEN=YOUR_TOKEN_HERE' | sudo tee -a /etc/environment${NC}"
    echo ""
    echo -e "${BLUE}Option 3: OpenClaw config only${NC}"
    echo -e "  Add to ~/.openclaw/config.patch (see SKILL.md for details)"
    echo ""
    echo -e "${RED}🔒 SECURITY WARNING:$

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/install.sh (reported line 121)May include surrounding context.

sh
echo -e "  ${GREEN}source ~/.bashrc${NC}"
    echo ""
    echo -e "${BLUE}Option 2: System-wide${NC}"
    echo -e "  ${GREEN}echo 'CLAUDE_CODE_OAUTH_TOKEN=YOUR_TOKEN_HERE' | sudo tee -a /etc/environment${NC}"
    echo ""
    echo -e "${BLUE}Option 3: OpenClaw config only${NC}"
    echo -e "  Add to ~/.openclaw/config.patch (see SKILL.md for details)"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 174)May include surrounding context.

md
echo ""
    echo -e "${RED}🔒 SECURITY WARNING:${NC}"
    echo -e "  ${YELLOW}Never commit your token to git!${NC}"
    echo -e "  Add .env files to .gitignore"
    echo -e "  Store tokens in environment variables or secrets manager"
    echo ""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md
echo ""
    echo -e "${RED}🔒 SECURITY WARNING:${NC}"
    echo -e "  ${YELLOW}Never commit your token to git!${NC}"
    echo -e "  Add .env files to .gitignore"
    echo -e "  Store tokens in environment variables or secrets manager"
    echo ""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 128)May include surrounding context.

sh
echo ""
    echo -e "${RED}🔒 SECURITY WARNING:${NC}"
    echo -e "  ${YELLOW}Never commit your token to git!${NC}"
    echo -e "  Add .env files to .gitignore"
    echo -e "  Store tokens in environment variables or secrets manager"
    echo ""

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The security policy materially misrepresents the package as only documentation/templates while later acknowledging an installer script that performs software installation, modifies shell startup files, and initiates authentication setup. This kind of downplaying can cause reviewers and users to underestimate trust boundaries and consent to privileged or persistent changes without an accurate risk assessment.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This manifest/markdown description presents the skill as applicable to essentially any OpenClaw agent context, but does not define when it should or should not be invoked. That broad scope can overlap with many generic coding-related requests and increases the risk of unintended activation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

The skill instructs users to place a long-lived OAuth token directly into ~/.openclaw/config.patch, creating durable local secret persistence in plaintext. If that file is read by other local users, backups, support bundles, or accidentally committed/copied, the token can be stolen and reused for CLI access for up to a year.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

Config Patch

Create or append to ~/.openclaw/config.patch:

json
{

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The troubleshooting section states that claude --print requires no approval and 'just shows output,' implying non-mutating behavior. Elsewhere, the workflow and real-world example describe running claude --print followed by build, commit, push, and merge steps as if file changes were actually applied, which is an active contradiction in the documented intent and behavior.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 566)May include surrounding context.

Fix: Use --print flag for non-interactive mode (outputs to stdout)

bash
claude --print "your task"  # No approval needed, just shows output

For interactive mode (approval required):

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 121)May include surrounding context.

sh
echo -e "  ${GREEN}source ~/.bashrc${NC}"
    echo ""
    echo -e "${BLUE}Option 2: System-wide${NC}"
    echo -e "  ${GREEN}echo 'CLAUDE_CODE_OAUTH_TOKEN=YOUR_TOKEN_HERE' | sudo tee -a /etc/environment${NC}"
    echo ""
    echo -e "${BLUE}Option 3: OpenClaw config only${NC}"
    echo -e "  Add to ~/.openclaw/config.patch (see SKILL.md for details)"

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install.sh (reported line 170)May include surrounding context.

sh
print_info "Adding npm global bin to PATH..."
    
    # Add to .bashrc
    if [ -f "$HOME/.bashrc" ]; then
        if ! grep -q "npm bin -g" "$HOME/.bashrc"; then
            echo 'export PATH="$PATH:$(npm bin -g)"' >> "$HOME/.bashrc"

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install.sh (reported line 178)May include surrounding context.

sh
fi
    fi
    
    # Add to .profile
    if [ -f "$HOME/.profile" ]; then
        if ! grep -q "npm bin -g" "$HOME/.profile"; then
            echo 'export PATH="$PATH:$(npm bin -g)"' >> "$HOME/.profile"

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script explicitly recommends echo $CLAUDE_CODE_OAUTH_TOKEN as a verification step, which exposes a sensitive bearer token in terminal output. Tokens displayed on screen can be captured by shell history helpers, terminal logging, screenshots, screen sharing, or shoulder surfing, making credential compromise plausible.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

This section characterizes SKILL.md as inert documentation with zero risk, but the skill's stated purpose is to install, authenticate, and use a CLI tool. While documentation itself is non-executing, the blanket 'ZERO' risk framing understates that the skill package is intended to drive installation/authentication actions elsewhere in the package, creating intent-level inconsistency in the documentation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest describes a skill focused on installing, authenticating, and using Claude Code CLI as a native coding tool. At L065 and again in the references/marketing sections, the document introduces MissionDeck live session tracking and related cloud integration, which is not necessary to the core Claude Code CLI setup purpose and represents an extra capability domain.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.