ClawTime Setup

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:09 PM UTC
• Version: 1.2.0

Overview

The skill mostly matches its stated ClawTime setup purpose, but its installer can run mutable remote code and writes startup scripts unsafely.

Review the installer before running it, only use configuration values you control, and prefer a pinned reviewed ClawTime commit with audited npm dependencies. Treat token display, passkey resets, device-key deletion, launchd persistence, and generated startup scripts as sensitive operations.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install.sh:199

Finding

Command Injection Through Generated Startup Scripts

Content

View full analysis

> "$START_SERVER" <> "$START_ALL" </tmp/clawtime.log & ``` ### Technical Analysis The installer constructs executable shell source using values supplied interactively by the user. `PUBLIC_URL` is emitted without quoting, while `BOT_NAME` and `BOT_EMOJI` are placed inside double quotes without escaping embedded quotation marks, command substitutions, backticks, line breaks, or shell control operators. Here-document expansion occurs while the installer generates each file, and the resulting file is later parsed again as shell syntax. Consequently, input that changes the syntactic structure of an assignment can add arbitrary commands to `start-server.sh` or `start.sh`. This is a code-generation ...[truncated 2095 chars]

Remediation

View remediation

> "$START_SERVER" printf 'BOT_NAME=%q\n' "$BOT_NAME" >> "$START_SERVER" printf 'BOT_EMOJI=%q\n' "$BOT_EMOJI" >> "$START_SERVER" ``` 4. Validate `PUBLIC_URL` using a URL parser and require: - The `https` scheme. - A valid hostname. - No credentials, control characters, whitespace, shell syntax, or unexpected path/query components. 5. Apply explicit length and character restrictions to `BOT_NAME` and `BOT_EMOJI`. 6. Prefer passing configuration as fixed argument-array elements or through a securely generated environment file parsed without shell evaluation. 7. Add automated tests using quotation marks, command substitutions, backticks, newlines, semicolons, pipes, and redirection characters to verify that generated configuration cannot change shell syntax. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/install.sh:95

Finding

Unpinned Remote Repository Retrieval and Dependency Execution

Content

View full analysis

/dev/null || echo " (up to date or local changes present)" else echo "→ Cloning ClawTime to $INSTALL_DIR..." mkdir -p "$HOME/Projects" git clone "$REPO_URL" "$INSTALL_DIR" fi # ── 4. Install npm dependencies ─────────────────────────────────────────────── echo "→ Installing npm dependencies..." cd "$INSTALL_DIR" npm install --legacy-peer-deps --silent ``` The remote source is configured as: ```bash REPO_URL="https://github.com/youngkent/clawtime.git" ``` The same unsafe installation pattern is also recommended in `SKILL.md:63-67`: ```bash cd ~/Projects git clone https://github.com/youngkent/clawtime.git cd clawtime npm install --legacy-peer-deps ``` ### Technical Analysis The installer clones the current state of a remote repository or performs `git pull --ff-only` against its configured branch without pinning a reviewed commit, verifying a signed release, or checking an expected digest. It then immediately runs `npm install`. This means the effective code executed by the Skill can change after the audited package has been reviewed. The audited artifact does not contain the remotely retrieved `server.js`, `package.json`, package lockfile, or dependency code, so their security properties cannot be established from this package. `npm install` may execute lifecycle scripts from the cloned project and its dependencies, including `preinstall`, `install`, `postinstall`, and `prepare`. The use of `--legacy-peer-deps` also relaxes dependency resolution and can produce dependency trees that differ across installation times or registry state. ### Attack Path 1. An attacker compromises the upstream GitHub repository ...[truncated 1527 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (64)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 74% confidence

Finding

The skill includes direct commands to retrieve the gateway token from Keychain or config and print it to stdout. While useful for administration, exposing secrets in terminal output increases the chance of leakage through shell history capture, shoulder-surfing, logs, recordings, or accidental copy/paste, especially in an agent-assisted workflow.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

Getting the Gateway Token

bash

# From macOS Keychain
security find-generic-password -s "openclaw-gateway-token" -a "$(whoami)" -w

# From config file

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 244)May include surrounding context.

bash

# Reset passkeys (re-register from scratch)
echo '[]' > ~/.clawtime/credentials.json
# Restart server, then visit /?setup=<token>

# Reset device key (new keypair on next restart)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 248)May include surrounding context.

Restart server, then visit /?setup=

Reset device key (new keypair on next restart)

rm ~/.clawtime/device-key.json

text

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

The documented command rm ~/.clawtime/device-key.json is a destructive action that removes the device authentication key material, and in context it is paired with pkill -f "node server.js", which can terminate processes based on a loose pattern. In an agent skill intended for setup and troubleshooting, this is especially dangerous because users or downstream automation may execute it verbatim, leading to account/device lockout, service disruption, and accidental impact on unrelated processes.

Content

Scanner excerpt · references/device-auth.md (reported line 95)May include surrounding context.

Nuclear reset

bash

rm ~/.clawtime/device-key.json
pkill -f "node server.js"; sleep 2
# Restart — fresh keypair generated

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

## Important: Token Security

**Do NOT put tokens directly in plist files** — plists are plaintext XML on disk.
Instead, store tokens in macOS Keychain and use a wrapper script to load them at launch.

### Store tokens in Keychain (one-time setup)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/launchd.md (reported line 9)May include surrounding context.

md

## Important: Token Security

**Do NOT put tokens directly in plist files** — plists are plaintext XML on disk.
Instead, store tokens in macOS Keychain and use a wrapper script to load them at launch.

### Store tokens in Keychain (one-time setup)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/launchd.md (reported line 11)May include surrounding context.

md

## Important: Token Security

**Do NOT put tokens directly in plist files** — plists are plaintext XML on disk.
Instead, store tokens in macOS Keychain and use a wrapper script to load them at launch.

### Store tokens in Keychain (one-time setup)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/launchd.md (reported line 29)May include surrounding context.

md

## Important: Token Security

**Do NOT put tokens directly in plist files** — plists are plaintext XML on disk.
Instead, store tokens in macOS Keychain and use a wrapper script to load them at launch.

### Store tokens in Keychain (one-time setup)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/launchd.md (reported line 80)May include surrounding context.

md

## Important: Token Security

**Do NOT put tokens directly in plist files** — plists are plaintext XML on disk.
Instead, store tokens in macOS Keychain and use a wrapper script to load them at launch.

### Store tokens in Keychain (one-time setup)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/launchd.md (reported line 148)May include surrounding context.

md

## Important: Token Security

**Do NOT put tokens directly in plist files** — plists are plaintext XML on disk.
Instead, store tokens in macOS Keychain and use a wrapper script to load them at launch.

### Store tokens in Keychain (one-time setup)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 169)May include surrounding context.

sh

## Important: Token Security

**Do NOT put tokens directly in plist files** — plists are plaintext XML on disk.
Instead, store tokens in macOS Keychain and use a wrapper script to load them at launch.

### Store tokens in Keychain (one-time setup)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 170)May include surrounding context.

sh

## Important: Token Security

**Do NOT put tokens directly in plist files** — plists are plaintext XML on disk.
Instead, store tokens in macOS Keychain and use a wrapper script to load them at launch.

### Store tokens in Keychain (one-time setup)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 172)May include surrounding context.

sh

## Important: Token Security

**Do NOT put tokens directly in plist files** — plists are plaintext XML on disk.
Instead, store tokens in macOS Keychain and use a wrapper script to load them at launch.

### Store tokens in Keychain (one-time setup)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 173)May include surrounding context.

sh

## Important: Token Security

**Do NOT put tokens directly in plist files** — plists are plaintext XML on disk.
Instead, store tokens in macOS Keychain and use a wrapper script to load them at launch.

### Store tokens in Keychain (one-time setup)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 175)May include surrounding context.

sh

## Important: Token Security

**Do NOT put tokens directly in plist files** — plists are plaintext XML on disk.
Instead, store tokens in macOS Keychain and use a wrapper script to load them at launch.

### Store tokens in Keychain (one-time setup)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 176)May include surrounding context.

sh

## Important: Token Security

**Do NOT put tokens directly in plist files** — plists are plaintext XML on disk.
Instead, store tokens in macOS Keychain and use a wrapper script to load them at launch.

### Store tokens in Keychain (one-time setup)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 192)May include surrounding context.

sh

## Important: Token Security

**Do NOT put tokens directly in plist files** — plists are plaintext XML on disk.
Instead, store tokens in macOS Keychain and use a wrapper script to load them at launch.

### Store tokens in Keychain (one-time setup)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 224)May include surrounding context.

sh

## Important: Token Security

**Do NOT put tokens directly in plist files** — plists are plaintext XML on disk.
Instead, store tokens in macOS Keychain and use a wrapper script to load them at launch.

### Store tokens in Keychain (one-time setup)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 79% confidence

Finding

The wrapper script retrieves secrets from Keychain and exports them as environment variables before launching Node. Environment variables can be inherited by child processes and may be exposed to local inspection, crash reports, diagnostics, or accidental logging by the application, so this weakens secret isolation even though the source is Keychain.

Content

Scanner excerpt · references/launchd.md (reported line 24)May include surrounding context.

bash

#!/usr/bin/env bash
# Wrapper script for launchd — loads tokens from Keychain securely
export GATEWAY_TOKEN=$(security find-generic-password -s "clawtime-gateway-token" -a "$(whoami)" -w)
export SETUP_TOKEN=$(security find-generic-password -s "clawtime-setup-token" -a "$(whoami)" -w)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 96% confidence

Finding

rm ~/.clawtime/device-key.json is a destructive command against security-relevant key material. In a skill that users may follow verbatim, this can be abused or accidentally triggered to rotate identity, break trust relationships, and disrupt access, especially without a warning about operational consequences.

Content

Scanner excerpt · references/troubleshooting.md (reported line 15)May include surrounding context.

"device signature invalid"

Signature payload format mismatch. Delete the keypair and restart (new one auto-generates):

bash

rm ~/.clawtime/device-key.json
pkill -f "node server.js"; sleep 2
# Restart with start command

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

Directly overwriting the credentials store destroys stored authentication material and can immediately revoke the user's ability to authenticate until passkeys are re-registered. Because this file contains credential state, a destructive write is security-sensitive and should not be offered casually in an agent troubleshooting flow.

Content

Scanner excerpt · references/troubleshooting.md (reported line 52)May include surrounding context.

Reset all passkeys (start fresh)

bash

echo '[]' > ~/.clawtime/credentials.json
pkill -f "node server.js"; sleep 2
# Restart, then re-register

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install.sh (reported line 119)May include surrounding context.

sh

GATEWAY_TOKEN=$(cat ~/.openclaw/openclaw.json 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('gateway',{}).get('token',''))" 2>/dev/null)

if [ -z "$GATEWAY_TOKEN" ]; then
  # Try keychain
  GATEWAY_TOKEN=$(security find-generic-password -s "openclaw-gateway-token" -a "$(whoami)" -w 2>/dev/null || true)
fi

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/install.sh (reported line 173)May include surrounding context.

sh

echo "→ Storing tokens securely in macOS Keychain..."
security add-generic-password -U -s "clawtime-gateway-token" -a "$(whoami)" -w "$GATEWAY_TOKEN" 2>/dev/null && \
  echo "  ✓ Gateway token stored in Keychain" || \
  echo "  ⚠️  Could not store gateway token in Keychain"
security add-generic-password -U -s "clawtime-setup-token" -a "$(whoami)" -w "$SETUP_TOKEN" 2>/dev/null && \
  echo "  ✓ Setup token stored in Keychain" || \
  echo "  ⚠️  Could not store setup token in Keychain"

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/install.sh (reported line 176)May include surrounding context.

sh

echo "→ Storing tokens securely in macOS Keychain..."
security add-generic-password -U -s "clawtime-gateway-token" -a "$(whoami)" -w "$GATEWAY_TOKEN" 2>/dev/null && \
  echo "  ✓ Gateway token stored in Keychain" || \
  echo "  ⚠️  Could not store gateway token in Keychain"
security add-generic-password -U -s "clawtime-setup-token" -a "$(whoami)" -w "$SETUP_TOKEN" 2>/dev/null && \
  echo "  ✓ Setup token stored in Keychain" || \
  echo "  ⚠️  Could not store setup token in Keychain"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 75% confidence

Finding

The generated startup script retrieves secrets from Keychain and then passes them to node server.js as environment variables. While common, this increases exposure because same-user processes, crash reports, child processes, or debugging tools may read process environment data, and the script normalizes repeated secret access into an easily callable wrapper.

Content

Scanner excerpt · scripts/install.sh (reported line 186)May include surrounding context.

sh

cat > "$START_SERVER" <<'STARTSCRIPT'
#!/usr/bin/env bash
# ClawTime server start script — tokens loaded from Keychain
cd "$(dirname "$0")"
GATEWAY_TOKEN=$(security find-generic-password -s "clawtime-gateway-token" -a "$(whoami)" -w 2>/dev/null)
SETUP_TOKEN=$(security find-generic-password -s "clawtime-setup-token" -a "$(whoami)" -w 2>/dev/null)

Static analysis

No suspicious patterns detected.