Security audit

Agent Spawner

Security checks for vulnerabilities and agentic risk

Overview

This skill fits an agent-deployment purpose, but it silently gathers and reuses credentials, installs mutable code, exposes a gateway, and prints a live token.

Install only if you are comfortable with an agent reading existing OpenClaw config, .env files, and token-like environment variables, copying credentials/plugins/skills into a new persistent agent, running network installers, and exposing a gateway. Prefer a revised version that asks before reading secrets, scopes credentials to exact named values, pins and verifies installers/plugins, defaults to localhost, and does not print live tokens into chat.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:111
Finding: Unverified Remote Installer Executed Directly by Bash<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:111` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard ``` ### Technical Analysis The bare-metal installation procedure downloads a mutable shell script from an external URL and passes it directly to Bash. No release version is pinned, and no cryptographic signature or checksum is verified before execution. HTTPS protects the connection in transit but does not guarantee that the content hosted at the URL remains identical to the content reviewed during this audit. Compromise of the domain, hosting infrastructure, publishing credentials, or installer distribution process could change the effective payload at any time. Piping the response directly into Bash also prevents meaningful review of the retrieved script before execution. The behavior is unnecessary at this privilege level: a versioned installer can be downloaded, verified, and then executed separately. ### Attack Path 1. An attacker compromises the installer hosting service, domain, release process, or associated publishing credentials. 2. The attacker replaces `install.sh` with a malicious shell payload. 3. A user requests a bare-metal agent deployment. 4. The Skill downloads the current remote response and immediately executes it with Bash. 5. The malicious script runs with all privileges available to the account invoking the Skill. 6. The payload can read or alter user files, steal OpenClaw credentials, modify shell configuration, install additional software, or establish persistence where permissions allow. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's identity. This includes access to that user's OpenClaw configuration, environment secrets, workspace data, SSH material, and other readable files. If the command is invoked from a privileged ...[truncated 62 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the mutable installer URL with a version-pinned release artifact. 2. Download the artifact to a local file rather than piping it into a shell. 3. Verify a publisher-provided cryptographic signature or a checksum obtained through a separately trusted channel. 4. Display the source, version, and verified digest in the deployment plan. 5. Require explicit user confirmation after verification and before execution. 6. Run the installer as an unprivileged account and avoid `sudo` unless a specific operation requires it. 7. Prefer a package manager or reproducible installation method with signed metadata. Example hardened flow: ```bash curl -fL -o openclaw-install.sh \ "https://example.invalid/releases/<pinned-version>/install.sh" echo "<trusted-sha256> openclaw-install.sh" | sha256sum -c - bash openclaw-install.sh --no-onboard ``` ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:12
Finding: Silent and Overbroad Collection of Credentials and Environment Secrets<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:12-17` **Vulnerability Type**: Excessive access to credential-bearing files and environment variables **Risk Level**: High ### Vulnerable Code ```bash ```bash cat ~/.openclaw/openclaw.json cat ~/.openclaw/.env 2>/dev/null env | grep -iE 'API_KEY|TOKEN' ls ~/.openclaw/extensions/ ls <workspace>/skills/ ``` ``` ### Technical Analysis The Skill instructs the agent to read the complete OpenClaw configuration, the complete `.env` file, and every environment variable whose name contains `API_KEY` or `TOKEN`. It explicitly labels this operation as silent. This exceeds the minimum access required to determine the configured model provider and obtain the single credential needed for the selected deployment. The broad environment-variable search can collect unrelated database tokens, CI/CD credentials, cloud credentials, source-control tokens, search-service keys, or credentials belonging to other applications. Although the audited file does not contain a direct exfiltration destination, values read through these commands may enter model context, command transcripts, tool logs, or later generated deployment commands. Suppressing errors with `2>/dev/null` does not protect the contents of the file. ### Attack Path 1. The Skill is activated to provision a new agent. 2. It silently reads the entire OpenClaw configuration and `.env` file. 3. It enumerates all environment variables with names matching `API_KEY` or `TOKEN`. 4. Unrelated credentials become available in the agent's context or execution transcript. 5. A subsequently installed plugin, copied skill, compromised remote installer, logging system, or accidental assistant response can capture or disclose those credentials. 6. An attacker uses the exposed credentials against the corresponding external services. ### Impact Assessment The accessible scope includes all secrets stored in `~/.openclaw/openclaw.json`, `~/.openclaw/.env`, and matching envi ...[truncated 407 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Obtain explicit user consent before accessing any credential-bearing file or environment variable. 2. Parse only the required configuration fields instead of displaying complete files. 3. Determine the provider first, then access only the exact environment variable associated with that provider, such as `OPENAI_API_KEY`. 4. Remove the general `env | grep -iE 'API_KEY|TOKEN'` enumeration. 5. Never include secret values in confirmation summaries, chat responses, logs, or command output. 6. Pass credentials through Docker secrets, protected files, or process-local input rather than command-line arguments where possible. 7. Clearly list which credentials will be copied and require explicit approval. 8. Ensure temporary values are unset after deployment and use restrictive file permissions for generated configuration. ]]>

T08 · Insecure Dependencies

Error

Location: SKILL.md:137
Finding: Automatic Installation of Unverified Plugin Specifications<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:137-141` **Vulnerability Type**: Unsafe third-party dependency installation **Risk Level**: High ### Vulnerable Code ```bash **Plugins** (from `plugins.installs` in current config): ```bash $OC plugins install <npm-spec> # Repeat for each plugin ``` ``` ### Technical Analysis The Skill automatically carries plugin npm specifications from the existing configuration into the new agent. It does not require an allowlisted registry, an exact immutable version, an integrity hash, or individual user review. An npm specification may reference a mutable version range, tag, remote repository, archive URL, or attacker-controlled package. Package installation can execute lifecycle scripts, and the resulting plugin code may execute with access to the new agent's configuration, credentials, tools, and workspace. A plugin present in the source configuration is not necessarily safe to reinstall from the network. The package may have changed since its original installation, or the existing configuration may already have been modified by an attacker. ### Attack Path 1. An attacker publishes or compromises a package referenced by `plugins.installs`, or modifies the source configuration to include an attacker-controlled npm specification. 2. The user asks the Skill to deploy a new agent. 3. The Skill reads the existing plugin specifications and carries them over by default. 4. `$OC plugins install <npm-spec>` retrieves and installs the current package content. 5. Malicious lifecycle or plugin code executes in the new agent environment. 6. The package accesses copied API credentials, modifies agent behavior, reads workspace data, or communicates with attacker-controlled infrastructure. ### Impact Assessment The installed package can obtain the privileges granted to the OpenClaw process. Its potential scope includes the agent configuration, copied API credentials, plugin directories, workspace files, enabled to ...[truncated 113 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Present every plugin name, source, version, and integrity value to the user before installation. 2. Require explicit approval for each plugin rather than carrying all plugins over automatically. 3. Permit only trusted registries and allowlisted packages. 4. Pin exact versions; do not use mutable tags or version ranges. 5. Verify package integrity using a trusted lockfile or cryptographic digest. 6. Reject Git URLs, local paths, arbitrary archive URLs, and unsupported registries unless separately reviewed. 7. Disable lifecycle scripts during installation unless a reviewed plugin explicitly requires them. 8. Run plugins in a sandbox with limited filesystem, network, tool, and credential access. 9. Audit copied plugin configuration so that secrets are not automatically exposed to every installed plugin. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:73
Finding: Gateway Exposed to the Local Network by Default<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:73-81` **Vulnerability Type**: Insecure network binding configuration **Risk Level**: Medium ### Vulnerable Code ```bash export OPENCLAW_IMAGE=alpine/openclaw:latest export OPENCLAW_CONFIG_DIR=~/.openclaw-<agent-name> export OPENCLAW_WORKSPACE_DIR=~/.openclaw-<agent-name>/workspace export OPENCLAW_GATEWAY_PORT=<unused port, default 18789> export OPENCLAW_GATEWAY_BIND=lan mkdir -p $OPENCLAW_CONFIG_DIR/workspace ``` The same LAN binding is passed to onboarding at `SKILL.md:98` and `SKILL.md:118`: ```bash --gateway-bind lan ``` ### Technical Analysis The Skill selects `lan` as the default gateway binding rather than limiting the gateway to the loopback interface. This makes the service reachable from other systems on the same network, subject to host firewall and network configuration. A new deployment has no demonstrated requirement for network-wide exposure. Localhost binding is the least-privileged default, particularly while plugins, copied skills, authentication configuration, and gateway behavior have not yet been validated. Authentication reduces but does not eliminate the risk. Network exposure enables service fingerprinting, authentication attacks, exploitation of gateway vulnerabilities, and use of any token disclosed through chat history or logs. ### Attack Path 1. A user deploys an agent using the documented defaults. 2. The gateway binds to a LAN-accessible interface. 3. Another system on the same network discovers the exposed port. 4. The remote party probes the gateway or obtains the gateway token from an exposed transcript, log, or user error. 5. The remote party accesses gateway functionality or exploits a vulnerability in the exposed service. ### Impact Assessment The exposure expands the attack surface from local processes to systems capable of reaching the host over the network. The ultimate privilege depends on gateway functionality and authentication, but compromise m ...[truncated 134 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Bind to loopback by default. 2. Ask separately whether remote network access is required. 3. Show the exposure scope and security implications in the confirmation plan. 4. If LAN access is approved, restrict access with host firewall rules and network allowlists. 5. Use TLS for non-loopback access. 6. Require strong authentication and support token rotation. 7. Avoid exposing the service until onboarding, plugin installation, and security validation are complete. 8. Document secure reverse-proxy or VPN-based access as the preferred remote-access method. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:159
Finding: Gateway Authentication Token Is Read and Returned Through the Conversation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:159-166` **Vulnerability Type**: Plaintext credential disclosure **Risk Level**: High ### Vulnerable Code ```bash Read the gateway token: ```bash grep -A1 '"token"' $OPENCLAW_CONFIG_DIR/openclaw.json ``` Tell the user: - **URL:** `http://<host>:<port>/` - **Token:** (from config — onboard auto-generates one) - "Say hello — it'll bootstrap itself." ``` ### Technical Analysis The Skill reads the gateway authentication token from the configuration and instructs the agent to include it in the user-facing response. This places a live credential into conversation history and potentially into model-provider logs, orchestration logs, observability systems, browser history, screenshots, or copied transcripts. The use of `grep -A1` is also imprecise because it prints the matching line and the following line. Depending on configuration layout, the extra line could contain unrelated sensitive information. This behavior is particularly risky in combination with the default LAN binding, because possession of the token may allow a party with network reachability to authenticate to the gateway. ### Attack Path 1. Onboarding generates a gateway token in `openclaw.json`. 2. The Skill extracts the token and an adjacent line with `grep -A1`. 3. The agent writes the plaintext token into the conversation. 4. The conversation or associated logs are viewed by another person, service operator, compromised plugin, or logging integration. 5. The observer uses the token against the LAN-accessible gateway. 6. The observer gains whatever actions and data the authenticated gateway session permits. ### Impact Assessment The disclosed value is an authentication credential for the newly deployed gateway. Its exact privileges depend on gateway authorization behavior, but exposure may permit authenticated access to the agent, conversations, tools, or configured integrations. The credential remains usable until revoked or ro ...[truncated 10 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not place the complete gateway token in model-generated messages or persistent conversation history. 2. Provide the token through a secure local mechanism, such as a restrictive file, secret manager, one-time local command, or protected terminal output. 3. If display is unavoidable, require explicit consent and warn that the value is sensitive. 4. Redact tokens from logs and display only a short fingerprint in summaries. 5. Replace `grep -A1` with structured JSON parsing that retrieves exactly the intended field. 6. Rotate the token after initial setup or support a short-lived, one-time onboarding credential. 7. Default the gateway to loopback so token exposure alone does not enable remote network access. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill is designed to discover API keys, tokens, plugins, and skills from the current agent and carry them over automatically, but the description does not clearly warn that it will access and reuse sensitive credentials. That creates a meaningful risk of unauthorized credential propagation and surprises the user about the scope of access.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill instructs the agent to silently read ~/.openclaw/openclaw.json, ~/.openclaw/.env, and environment variables matching API_KEY or TOKEN before any user warning. Silent secret enumeration is dangerous because it collects high-value credentials without informed consent and broadens exposure if logs, outputs, or downstream steps mishandle them.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill explicitly directs collection of config secrets, API keys, and tokens from files and environment variables, then uses those values to bootstrap another agent. In context, this is especially dangerous because it normalizes credential harvesting and duplication across agents, increasing blast radius if the new agent or host is compromised.

Credential Access

High

Category: Privilege Escalation
Content: ```bash cat ~/.openclaw/openclaw.json cat ~/.openclaw/.env 2>/dev/null env | grep -iE 'API_KEY|TOKEN' ls ~/.openclaw/extensions/ ls <workspace>/skills/
Confidence: 99% confidence
Finding: The commands read ~/.openclaw/.env and grep environment variables for API_KEY or TOKEN, which is direct credential access behavior. In a deployment helper skill, this context makes the issue more severe because the accessed credentials are then intended for reuse in another runtime, compounding exposure and persistence.

Ssd 3

High

Confidence: 98% confidence
Finding: The confirmation and handoff sections instruct the agent to reveal sensitive information in user-visible output, including indicating possession of an API key and later reading and disclosing the gateway token. Exposing tokens in plain output materially increases the chance of accidental leakage through chat history, logs, screenshots, or unauthorized viewers.

External Script Fetching

High

Category: Supply Chain
Content: ### Bare metal ```bash curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard openclaw onboard --non-interactive --accept-risk \ --mode local \
Confidence: 97% confidence
Finding: Piping a remotely fetched install script directly into bash executes unverified code from the network with no integrity check, pinning, or review step. In this skill, that risk is amplified because the script is part of a privileged installation flow that may persist software and handle secrets on the host.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The manifest description uses broad trigger terms like create, spin up, deploy, or provision a new agent, which increases the chance the skill is invoked in situations where the user did not intend full deployment or credential replication. In this skill, that broad invocation is more dangerous because execution leads directly to secret discovery, installation, and system changes.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The skill prepares for deployment and remote execution actions without an explicit warning that it will clone repositories, run containers, install software, and modify configuration on the target system. That is risky because users may not understand they are authorizing persistent system changes and network-exposed services.

Static analysis

No suspicious patterns detected.