ClawHub
Back to skill

Security audit

agentauth

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real approval workflow, but it grants very broad command execution authority and persistently changes OpenClaw configuration in ways that are under-scoped and not fully undone by cleanup.

Install only if you are comfortable with this skill becoming a broad local command executor after passkey approval, storing credentials in the shared OpenClaw .env file, contacting AgentAuth-hosted services with command metadata, and persistently changing AGENTS.md. Review cleanup manually because the inspected cleanup path does not fully remove the AgentAuth instruction block or restore the original policy file byte-for-byte.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T02 · Agent Memory Poisoning

Error
Location
scripts/cli.cjs:7240
Finding

Persistent Agent instruction modification survives cleanup

Content
View full analysis
## Security (AgentAuth) ### Red Lines If a dangerous action is requested (delete files, send email, modify config, purchases, production changes), use the agentauth skill for passkey approval before executing. ### Dangerous Operations Definition ... If unsure → **assume dangerous** ### Tool * **agentauth** — Human consent gate using passkeys to authorize sensitive actions. `; ``` ```js async updateAgentMarkdown() { const agentMdPath = import_path3.default.join( this.#openClawDir, "workspace", "AGENTS.md" ); // Existing or new AgentAuth rules are written into AGENTS.md. ... newContent = this.#removeAskFirstBlock(newContent); if (originalContent !== newContent) { await import_promises3.default.writeFile( agentMdPath, newContent.trimEnd() + "\n", "utf8" ); } } ``` ```js #removeAskFirstBlock(content) { const askFirstIndex = content.indexOf(ASK_FIRST_HEADER); if (askFirstIndex === -1) { return content; } const bodyStart = askFirstIndex + ASK_FIRST_HEADER.length; const nextHeadingMatch = content.slice(bodyStart).match(/\n##\s+/); let blockEndIndex; if (nextHeadingMatch) { blockEndIndex = bodyStart + nextHeadingMatch.index; } else { blockEndIndex = content.length; } const before = content.slice(0, askFirstIndex).trimEnd(); const after = content.slice(blockEndIndex).trimStart(); return [before, after].filter(Boolean).join("\n\n"); } ``` ```js async restoreAgentMarkdown() { const agentMdPath = import_path3 ...[truncated 2627 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/cli.cjs:6285
Finding

The user approves a redacted representation but the original shell command is executed

Content
View full analysis
{ (0, import_child_process2.exec)( command, (error, stdout, stderr) => { if (error) { resolve({ error, stdout, stderr }); } else { resolve({ error: null, stdout, stderr }); } } ); }); } }; ``` Relevant redaction includes: ```js [/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASSWD|PWD|API_KEY|ACCESS_KEY)[A-Z0-9_]*)=([^\s]+)/g, "$1=[REDACTED]"] ``` ### Technical Analysis The approval request is generated from `redactedToolCall`, while execution uses the original `toolCall`. The cryptographically approved representation is therefore not necessarily identical to the command passed to the shell. Redaction can hide security-significant argument values, shell substitutions, endpoints, or credential-bearing syntax. For example, a value such as `PASSWORD=$(...)` can be replaced with `PASSWORD=[REDACTED]` in the approval interface, while the original command substitution remains present when `child_process.exec()` exec ...[truncated 1472 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/cli.cjs:6980
Finding

Incomplete AgentAuth origin validation permits attacker-controlled lookalike domains

Content
View full analysis
pattern.test(baseUrl) ); if (!isAllowed) { throw new Error( `IDGW_BASE_URL "${baseUrl}" is not in the list of allowed origins.` ); } return baseUrl; } ``` ```js async approvalInit(toolCall, displayString) { const requestPayload = { operationName: "approvalInit", query: APPROVAL_INIT_QUERY, variables: { permissions: [{ id: randomUUID(), title: toolCall, description: displayString }] } }; const headers = {}; if (this.#apiKey) { headers["X-Api-Key"] = this.#apiKey; } if (this.#keyId) { headers["X-Api-Key-Id"] = this.#keyId; } const { data } = await this.#httpClient.post( this.#gqlUrl, requestPayload, { headers } ); ... } ``` ```js async waitForSession(topic) { const url = `${this.#eventsUrl}?topic=${topic}`; return await this.#sseClient.waitForEvent( url, { eventName: "session", timeout: 6e4 * 5 } ); } ``` ### Technical Analysis The regular expression intended to restrict production traffic to `agentauth.id` does not require a hostname or URL boundary after `agentauth.id`. A URL such as: ```text https://agentauth.id.attacker.example ``` matches the expression because it begins with the accepted prefix. The same attacker-controlled base URL is used for the GraphQL endpoint and SSE event endpoint. Approval initialization sends the AgentAuth API key, key identifier, and command metadata to that destination. The resulting ...[truncated 1270 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/cli.cjs:7215
Finding

AgentAuth credentials may be created with permissive filesystem permissions

Content
View full analysis
!line.startsWith("AGENTAUTH_AGENT_KEY_ID=") && !line.startsWith("AGENTAUTH_API_KEY=") && line.trim() !== "" ); const newLines = [ ...otherLines, `AGENTAUTH_AGENT_KEY_ID="${keyId}"`, `AGENTAUTH_API_KEY="${apiKey}"` ]; try { await import_promises3.default.writeFile( envPath, newLines.join("\n") + "\n", { encoding: "utf8" } ); } catch (error) { throw new Error( `Could not save credentials to OpenClaw environment file at ${envPath}: ${error.message}` ); } } ``` ### Technical Analysis The CLI writes the AgentAuth API key into the shared OpenClaw `.env` file without specifying restrictive file permissions. If the file does not already exist, its mode is determined by the process umask. A permissive umask can result in credentials being readable by other local users. The method also rewrites the complete environment file directly. It does not write to a protected temporary file, flush the data, or atomically rename it into place. Interruption, process termination, or filesystem failure can therefore truncate or partially replace unrelated OpenClaw configuration and credentials. Reading the `.env` file is functionally related to credential setup, and no direct transmission of unrelated `.env` values was identified. The issue is the insecure storage and upda ...[truncated 868 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (39)

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The cleanup instruction uses a vague phrase for a workflow that alters configuration and removes integrations, making accidental or induced invocation more dangerous. Because cleanup is effectively a destructive administrative action, a natural-language trigger like "Cleanup my AgentAuth" could be abused through prompt injection, quoted text, or conversational ambiguity to cause removal or rollback of security controls.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md
compatibility: Requires agentauth CLI (`./scripts/cli.cjs`)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 337)May include surrounding context.

md
compatibility: Requires agentauth CLI (`./scripts/cli.cjs`)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The documented pattern passes a raw command string into an approval-flow wrapper, illustrated with a destructive rm command. Using unstructured shell strings as parameters creates command-injection and parameter-abuse risk, especially if any part of the command or display text can be influenced by user input or prompt injection before reaching the sub-agent.

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

Main Agent Example Call

js
const dangerous_command = "rm ~/.openclaw/important.txt";
const display_string = "Delete the important notes file";
const notification_target = "slack:U12345"; // Example target

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/cli.cjs (reported line 2633)May include surrounding context.

js
* Parse options from `argv` removing known options,
       * and return argv split into operands and unknown arguments.
       *
       * Side effects: modifies command by storing options. Does not reset state if called again.
       *
       * Examples:
       *

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cli.cjs (reported line 5079)May include surrounding context.

js
module2.exports = {
      name: "dotenv",
      version: "17.3.1",
      description: "Loads environment variables from .env file",
      main: "lib/main.js",
      types: "lib/main.d.ts",
      exports: {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cli.cjs (reported line 5152)May include surrounding context.

js
module2.exports = {
      name: "dotenv",
      version: "17.3.1",
      description: "Loads environment variables from .env file",
      main: "lib/main.js",
      types: "lib/main.d.ts",
      exports: {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cli.cjs (reported line 5153)May include surrounding context.

js
module2.exports = {
      name: "dotenv",
      version: "17.3.1",
      description: "Loads environment variables from .env file",
      main: "lib/main.js",
      types: "lib/main.d.ts",
      exports: {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cli.cjs (reported line 5158)May include surrounding context.

js
module2.exports = {
      name: "dotenv",
      version: "17.3.1",
      description: "Loads environment variables from .env file",
      main: "lib/main.js",
      types: "lib/main.d.ts",
      exports: {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cli.cjs (reported line 5163)May include surrounding context.

js
module2.exports = {
      name: "dotenv",
      version: "17.3.1",
      description: "Loads environment variables from .env file",
      main: "lib/main.js",
      types: "lib/main.d.ts",
      exports: {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cli.cjs (reported line 7021)May include surrounding context.

js
module2.exports = {
      name: "dotenv",
      version: "17.3.1",
      description: "Loads environment variables from .env file",
      main: "lib/main.js",
      types: "lib/main.d.ts",
      exports: {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cli.cjs (reported line 7037)May include surrounding context.

js
module2.exports = {
      name: "dotenv",
      version: "17.3.1",
      description: "Loads environment variables from .env file",
      main: "lib/main.js",
      types: "lib/main.d.ts",
      exports: {

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cli.cjs (reported line 5114)May include surrounding context.

js
keywords: [
        "dotenv",
        "env",
        ".env",
        "environment",
        "variables",
        "config",

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cli.cjs (reported line 5316)May include surrounding context.

js
keywords: [
        "dotenv",
        "env",
        ".env",
        "environment",
        "variables",
        "config",

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cli.cjs (reported line 5158)May include surrounding context.

js
"\u26A1\uFE0F secrets for agents: https://dotenvx.com/as2",
      "\u{1F6E1}\uFE0F auth for agents: https://vestauth.com",
      "\u{1F6E0}\uFE0F  run anywhere with `dotenvx run -- yourcommand`",
      "\u2699\uFE0F  specify custom .env file path with { path: '/custom/path/.env' }",
      "\u2699\uFE0F  enable debug logging with { debug: true }",
      "\u2699\uFE0F  override existing env vars with { override: true }",
      "\u2699\uFE0F  suppress all logs with { quiet: true }",

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cli.cjs (reported line 5163)May include surrounding context.

js
"\u26A1\uFE0F secrets for agents: https://dotenvx.com/as2",
      "\u{1F6E1}\uFE0F auth for agents: https://vestauth.com",
      "\u{1F6E0}\uFE0F  run anywhere with `dotenvx run -- yourcommand`",
      "\u2699\uFE0F  specify custom .env file path with { path: '/custom/path/.env' }",
      "\u2699\uFE0F  enable debug logging with { debug: true }",
      "\u2699\uFE0F  override existing env vars with { override: true }",
      "\u2699\uFE0F  suppress all logs with { quiet: true }",

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/cli.cjs (reported line 5163)May include surrounding context.

js
"\u2699\uFE0F  override existing env vars with { override: true }",
      "\u2699\uFE0F  suppress all logs with { quiet: true }",
      "\u2699\uFE0F  write to custom object with { processEnv: myObject }",
      "\u2699\uFE0F  load multiple .env files with { path: ['.env.local', '.env'] }"
    ];
    function _getRandomTip() {
      return TIPS[Math.floor(Math.random() * TIPS.length)];

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

After approval, the skill does not merely attest or gate an action; it directly executes the provided toolCall string. Because this is a generic shell string coming from the caller, the skill becomes an arbitrary command execution primitive, which is far broader and riskier than a human-approval control.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The skill explicitly targets ~/.openclaw/.env for loading and overriding runtime configuration, which includes secrets. In this skill context, handling OpenClaw credential material is expected, but it still increases sensitivity because the tool both reads and later persists auth data in a predictable plaintext location.

Content

Scanner excerpt · scripts/cli.cjs (reported line 6975)May include surrounding context.

js
// src/utils/paths.mjs
var import_os = __toESM(require("os"), 1);
var import_path = __toESM(require("path"), 1);
var AGENTAUTH_ENV_PATH = import_path.default.join(import_os.default.homedir(), ".openclaw", ".env");

// src/utils/env.mjs
(0, import_dotenv.config)({ quiet: true });

Hidden Instructions

High
Category
Prompt Injection
Confidence
98% confidence
Finding

The skill injects hidden instruction text into AGENTS.md, including behavioral rules and references to protecting its own files. This is a powerful persistence and policy-manipulation mechanism that changes future agent behavior outside the immediate approval operation, making the skill substantially more dangerous than its manifest suggests.

Content

Scanner excerpt · scripts/cli.cjs (reported line 7174)May include surrounding context.

js
// src/utils/agentMarkdown.mjs
var AGENTAUTH_PROMPT_VERSION = "1.0.0";
var AGENTAUTH_MD_ADDITION = `<!-- AGENTAUTH-START -->
<!-- AGENTAUTH-PROMPT-VERSION: ${AGENTAUTH_PROMPT_VERSION} -->
## Security (AgentAuth)

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

This code reads and writes the OpenClaw .env file to persist authentication credentials. While not exfiltration, it is sensitive credential handling in plaintext, and in this skill's context it materially affects the user's local trust and secret-storage posture.

Content

Scanner excerpt · scripts/cli.cjs (reported line 7216)May include surrounding context.

js
this.#openClawDir = openClawDir;
  }
  async saveCredentials(keyId, apiKey) {
    const envPath = import_path3.default.join(this.#openClawDir, ".env");
    let envContent = "";
    try {
      envContent = await import_promises3.default.readFile(envPath, "utf8");

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The CommandExecutor uses child_process.exec, which invokes a shell and interprets metacharacters, pipelines, substitutions, and chaining. In a skill whose advertised purpose is approval/signing, this creates an unnecessary and dangerous arbitrary shell-execution capability that can run destructive local commands once invoked.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Arbitrary shell command execution occurs as a runtime side effect without a direct warning immediately before execution. In practice, users may believe they are only approving an authorization step, while the tool actually performs the sensitive action locally.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 64)May include surrounding context.

  1. Package and install the skill
bash
mkdir agentauth
cp SKILL.md agentauth
cp -r scripts agentauth
mv agentauth ~/.openclaw/skills

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The initialization instruction uses a broad natural-language phrase, "Initialize my AgentAuth," which can overlap with ordinary user conversation and be unintentionally triggered by an LLM-driven agent. In an agent environment, vague trigger phrases increase the risk of unauthorized setup flows, social-engineering prompts, or prompt-injection text causing the agent to invoke initialization without clear, explicit user intent.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/cli.cjs:1819

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/cli.cjs:5240

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
scripts/cli.cjs:7018