ClawHub
Back to skill

Security audit

Deerflow

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it submits and checks DeerFlow research jobs, with network and Docker-related risks disclosed as part of that integration.

Install this only if you intend to connect OpenClaw to a DeerFlow instance you trust. Keep DeerFlow on localhost or behind authenticated TLS, avoid sending sensitive prompts to an untrusted remote endpoint, and review or pin the upstream DeerFlow Docker deployment before running it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:53
Finding

Unpinned External DeerFlow Source and Container Supply Chain

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:53-69
Vulnerability Type: Unpinned third-party source and container deployment
Risk Level: Medium

Vulnerable Code

bash
git clone https://github.com/bytedance/deer-flow.git
cd deer-flow
cp .env.example .env

The cloned repository is subsequently used to start services:

bash
# No nginx, no frontend — just gateway + langgraph
docker compose up -d deer-flow-gateway deer-flow-langgraph

Technical Analysis

The deployment instructions clone the mutable default branch of an external repository and then run services defined by that repository. No reviewed release tag, commit hash, signed artifact, checksum, or immutable container digest is specified.

Because the effective source and container definitions can change after this skill has been reviewed, following these instructions at different times may execute materially different third-party components. The referenced repository is the declared official DeerFlow project, and the documentation warns users to review it, so this is an insecure supply-chain configuration rather than evidence that the skill itself is malicious.

Attack Path

  1. An attacker compromises the upstream repository, a maintainer account, a referenced dependency, or a mutable container tag.
  2. The attacker modifies the default branch, Compose configuration, build context, or referenced image.
  3. A user follows the documented git clone and docker compose up instructions without verifying a known-good revision.
  4. Docker builds or retrieves the modified components and starts them.
  5. The malicious component gains access to data and resources exposed to its container. Host impact depends on container privileges, mounted paths, network access, secrets, and the security of the Docker environment.

Impact Assessment

A compromised component could access DeerFlow model credentials, research prompts, generate ...[truncated 392 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin DeerFlow to a reviewed release and immutable commit hash instead of cloning the mutable default branch.
  • Pin all container images by cryptographic digest, for example image@sha256:....
  • Verify release signatures, provenance attestations, or published checksums before deployment.
  • Document the exact reviewed DeerFlow version compatible with this skill.
  • Review the Compose file for privileged mode, host networking, sensitive volume mounts, excessive Linux capabilities, and Docker socket access.
  • Run containers as non-root users with read-only filesystems, dropped capabilities, restricted egress, and narrowly scoped secrets where supported.
  • Add a controlled upgrade procedure requiring review before changing the pinned revision or image digest.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/submit_task.py:21
Finding

Research Prompts and Results May Be Transmitted over Unauthenticated Plaintext HTTP

Content
View full analysis

Vulnerability Details

File Location: scripts/submit_task.py:21-77; additional affected code in scripts/check_status.py:4-15
Vulnerability Type: Missing transport-security and API-authentication enforcement
Risk Level: Medium

Vulnerable Code

From scripts/submit_task.py:

python
DEERFLOW_URL = os.environ.get("DEERFLOW_URL", "http://localhost:2026")
LANGGRAPH_URL = os.environ.get("DEERFLOW_LANGGRAPH", "http://localhost:2024")
ASSISTANT_ID = os.environ.get("DEERFLOW_ASSISTANT_ID", "lead_agent")
MODEL_NAME = os.environ.get("DEERFLOW_MODEL", "minimax-m2.7")
RECURSION_LIMIT = int(os.environ.get("DEERFLOW_RECURSION", "200"))


def create_thread() -> str | None:
    """Create a new LangGraph thread. Returns thread_id or None on failure."""
    url = f"{LANGGRAPH_URL}/threads"
    data = json.dumps({}).encode("utf-8")
    req = urllib.request.Request(
        url, data=data, headers={"Content-Type": "application/json"}
    )
    try:
        with urllib.request.urlopen(req) as response:
            result = json.loads(response.read().decode("utf-8"))

The user-supplied research prompt is sent to the configured endpoint without an authorization header or HTTPS requirement:

python
def submit_task(thread_id: str, task_description: str) -> str | None:
    """Submit a task to an existing thread. Returns run_id or None on failure."""
    url = f"{LANGGRAPH_URL}/threads/{thread_id}/runs"
    payload = {
        "assistant_id": ASSISTANT_ID,
        "input": {
            "messages": [
                {
                    "type": "human",
                    "content": [{"type": "text", "text": task_description}],
                }
            ]
        },
        "config": {
            "recursion_limit": RECURSION_LIMIT,
            "configurable": {
                "model_name": MODEL_NAME,
                "thinking_enabled": True,
                "is_pl
...[truncated 3100 chars]
Remediation
View remediation

Remediation Suggestions

  • Reject non-HTTPS URLs unless the hostname is explicitly verified as a loopback address.
  • Support an API token through a dedicated environment variable and send it using an Authorization: Bearer ... header.
  • Require server-side authentication and authorization for thread creation, run submission, status retrieval, and history access.
  • Use certificates issued by a trusted authority or a carefully managed private CA; do not disable certificate validation.
  • For private deployments, bind LangGraph to loopback or a private network and place it behind an authenticated TLS reverse proxy.
  • Avoid placing tokens in URLs, logs, command-line arguments, or printed diagnostic output.
  • Add explicit connection and read timeouts and enforce a maximum response size to reduce denial-of-service exposure from faulty or hostile endpoints.
  • Document that plaintext HTTP is supported only for strictly local loopback communication.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)

Tainted flow: 'req' from os.environ.get (line 14, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/check_status.py (reported line 16)May include surrounding context.

python
req = urllib.request.Request(url, headers={"Content-Type": "application/json"})
    try:
        with urllib.request.urlopen(req) as response:
            return json.loads(response.read().decode("utf-8"))
    except urllib.error.URLError as e:
        print(f"Error: {e}")

Tainted flow: 'req' from os.environ.get (line 74, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/submit_task.py (reported line 36)May include surrounding context.

python
url, data=data, headers={"Content-Type": "application/json"}
    )
    try:
        with urllib.request.urlopen(req) as response:
            result = json.loads(response.read().decode("utf-8"))
            thread_id = result.get("thread_id")
            if not thread_id:

Tainted flow: 'req' from os.environ.get (line 74, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/submit_task.py (reported line 78)May include surrounding context.

python
url, data=data, headers={"Content-Type": "application/json"}
    )
    try:
        with urllib.request.urlopen(req) as response:
            result = json.loads(response.read().decode("utf-8"))
            thread_id = result.get("thread_id")
            if not thread_id:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

md
# DeerFlow Service Configuration
# Note: Model API keys are managed by the DeerFlow deployment,
# not by this skill. Configure them in DeerFlow's own .env file.

deerflow:
  # DeerFlow service URL (Nginx public gateway)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/config.yaml (reported line 3)May include surrounding context.

yaml
# DeerFlow Service Configuration
# Note: Model API keys are managed by the DeerFlow deployment,
# not by this skill. Configure them in DeerFlow's own .env file.

deerflow:
  # DeerFlow service URL (Nginx public gateway)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill declares no explicit tool scope or permission boundaries even though its documented behavior requires environment-variable access and outbound HTTP communication. In agent platforms, missing scope declarations can cause the skill to be invoked with broader capabilities than intended, reducing reviewability and increasing the chance of unintended data access or network actions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrases include broad natural-language activators like 'deep research', 'async research', and 'deerflow', which may match ordinary conversation and cause the skill to run unexpectedly. Because this skill submits prompts to an external HTTP service, accidental activation can lead to unintended data transmission and task execution.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

bash
curl http://localhost:2024/openapi.json | head   # should return OpenAPI spec
curl http://localhost:8001/health               # should return 200

3. Test with a manual task

Static analysis

No suspicious patterns detected.