Security audit
Security checks for vulnerabilities and agentic risk
This skill fits an agent-deployment purpose, but it silently gathers and reuses credentials, installs mutable code, exposes a gateway, and prints a live token.
Install only if you are comfortable with an agent reading existing OpenClaw config, .env files, and token-like environment variables, copying credentials/plugins/skills into a new persistent agent, running network installers, and exposing a gateway. Prefer a revised version that asks before reading secrets, scopes credentials to exact named values, pins and verifies installers/plugins, defaults to localhost, and does not print live tokens into chat.
SKILL.md:111Unverified Remote Installer Executed Directly by Bash
SKILL.md:12Silent and Overbroad Collection of Credentials and Environment Secrets
SKILL.md:137Automatic Installation of Unverified Plugin Specifications
SKILL.md:73Gateway Exposed to the Local Network by Default
SKILL.md:159Gateway Authentication Token Is Read and Returned Through the Conversation
The skill is designed to discover API keys, tokens, plugins, and skills from the current agent and carry them over automatically, but the description does not clearly warn that it will access and reuse sensitive credentials. That creates a meaningful risk of unauthorized credential propagation and surprises the user about the scope of access.
The skill instructs the agent to silently read ~/.openclaw/openclaw.json, ~/.openclaw/.env, and environment variables matching API_KEY or TOKEN before any user warning. Silent secret enumeration is dangerous because it collects high-value credentials without informed consent and broadens exposure if logs, outputs, or downstream steps mishandle them.
The skill explicitly directs collection of config secrets, API keys, and tokens from files and environment variables, then uses those values to bootstrap another agent. In context, this is especially dangerous because it normalizes credential harvesting and duplication across agents, increasing blast radius if the new agent or host is compromised.
The commands read ~/.openclaw/.env and grep environment variables for API_KEY or TOKEN, which is direct credential access behavior. In a deployment helper skill, this context makes the issue more severe because the accessed credentials are then intended for reuse in another runtime, compounding exposure and persistence.
cat ~/.openclaw/openclaw.json
cat ~/.openclaw/.env 2>/dev/null
env | grep -iE 'API_KEY|TOKEN'
ls ~/.openclaw/extensions/
ls <workspace>/skills/
The confirmation and handoff sections instruct the agent to reveal sensitive information in user-visible output, including indicating possession of an API key and later reading and disclosing the gateway token. Exposing tokens in plain output materially increases the chance of accidental leakage through chat history, logs, screenshots, or unauthorized viewers.
Piping a remotely fetched install script directly into bash executes unverified code from the network with no integrity check, pinning, or review step. In this skill, that risk is amplified because the script is part of a privileged installation flow that may persist software and handle secrets on the host.
curl -fsSL https://openclaw.ai/install.sh | bash -s -- --no-onboard
openclaw onboard --non-interactive --accept-risk \
--mode local \
The manifest description uses broad trigger terms like create, spin up, deploy, or provision a new agent, which increases the chance the skill is invoked in situations where the user did not intend full deployment or credential replication. In this skill, that broad invocation is more dangerous because execution leads directly to secret discovery, installation, and system changes.
The skill prepares for deployment and remote execution actions without an explicit warning that it will clone repositories, run containers, install software, and modify configuration on the target system. That is risky because users may not understand they are authorizing persistent system changes and network-exposed services.
No suspicious patterns detected.