Caddy Reverse Proxy

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:49 PM UTC
• Version: 1.0.0

Overview

This skill is coherent Caddy setup guidance, but it needs Review because it recommends weakened gateway authentication and privileged persistent proxy setup without enough hardening.

Review before installing. Prefer loopback-only backend bindings, keep OpenClaw device authentication enabled unless you add strong compensating access controls, pin and verify the Caddy/plugin build, avoid running user-writable binaries as root, and store Vercel tokens with restrictive permissions and limited scope.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: reference.md:5

Finding

Root LaunchDaemon Executes User-Writable Caddy Binary and Configuration

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: OPENCLAW.md:14

Finding

OpenClaw Device Authentication Is Explicitly Disabled

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: reference.md:68

Finding

Backend Applications Are Unnecessarily Exposed on All Network Interfaces

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: reference.md:176

Finding

Unpinned External Dependencies Are Incorporated into a Privileged Proxy Binary

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: reference.md:253

Finding

Long-Lived Vercel DNS Credentials Are Stored Without Required File-Permission Hardening

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (35)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The service is configured to load secrets from a plain-text environment file, and the broader guide centers DNS API credentials needed for certificate automation. If that file is readable by other users, backed up insecurely, or accidentally committed, an attacker could gain control over DNS challenge operations and potentially broader Vercel resources depending on token scope.

Content

Scanner excerpt · reference.md (reported line 226)May include surrounding context.

md

[Service]
Type=simple
EnvironmentFile=%h/.secrets/vercel/.env
ExecStart=%h/.local/bin/caddy run --config %h/.config/caddy/Caddyfile
ExecReload=%h/.local/bin/caddy reload --config %h/.config/caddy/Caddyfile
Restart=always

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly instructs users to set allowInsecureAuth: true, which weakens authentication for the control UI by allowing token-only access in place of stronger device-key authentication. Although the file explains why this is needed for certain proxy setups, it does not clearly warn that this reduces security and may expose the gateway to unauthorized access if origins, tokens, or proxy boundaries are misconfigured.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

Add a New App

1. Create a background service (LaunchAgent on macOS, systemd on Linux) — see reference.md for templates
2. Add to Caddyfile (~/.config/caddy/Caddyfile):

   caddy

   appname.YOUR_DOMAIN {
   

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

Full restart

macOS:

sudo launchctl unload /Library/LaunchDaemons/com.caddyserver.caddy.plist sudo launchctl load /Library/LaunchDaemons/com.caddyserver.caddy.plist

Linux:

systemctl --user restart caddy

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · reference.md (reported line 160)May include surrounding context.

Full restart

macOS:

sudo launchctl unload /Library/LaunchDaemons/com.caddyserver.caddy.plist sudo launchctl load /Library/LaunchDaemons/com.caddyserver.caddy.plist

Linux:

systemctl --user restart caddy

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · reference.md (reported line 193)May include surrounding context.

Full restart

macOS:

sudo launchctl unload /Library/LaunchDaemons/com.caddyserver.caddy.plist sudo launchctl load /Library/LaunchDaemons/com.caddyserver.caddy.plist

Linux:

systemctl --user restart caddy

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · reference.md (reported line 202)May include surrounding context.

Full restart

macOS:

sudo launchctl unload /Library/LaunchDaemons/com.caddyserver.caddy.plist sudo launchctl load /Library/LaunchDaemons/com.caddyserver.caddy.plist

Linux:

systemctl --user restart caddy

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · reference.md (reported line 206)May include surrounding context.

Full restart

macOS:

sudo launchctl unload /Library/LaunchDaemons/com.caddyserver.caddy.plist sudo launchctl load /Library/LaunchDaemons/com.caddyserver.caddy.plist

Linux:

systemctl --user restart caddy

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · reference.md (reported line 214)May include surrounding context.

Full restart

macOS:

sudo launchctl unload /Library/LaunchDaemons/com.caddyserver.caddy.plist sudo launchctl load /Library/LaunchDaemons/com.caddyserver.caddy.plist

Linux:

systemctl --user restart caddy

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

Full restart

macOS:

sudo launchctl unload /Library/LaunchDaemons/com.caddyserver.caddy.plist sudo launchctl load /Library/LaunchDaemons/com.caddyserver.caddy.plist

Linux:

systemctl --user restart caddy

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · reference.md (reported line 113)May include surrounding context.

Full restart

macOS:

sudo launchctl unload /Library/LaunchDaemons/com.caddyserver.caddy.plist sudo launchctl load /Library/LaunchDaemons/com.caddyserver.caddy.plist

Linux:

systemctl --user restart caddy

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · reference.md (reported line 200)May include surrounding context.

Full restart

macOS:

sudo launchctl unload /Library/LaunchDaemons/com.caddyserver.caddy.plist sudo launchctl load /Library/LaunchDaemons/com.caddyserver.caddy.plist

Linux:

systemctl --user restart caddy

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

**Port 443 on macOS:** Non-root processes can't bind ports <1024. Use a system LaunchDaemon (runs as root) with HOME/XDG_DATA_HOME/XDG_CONFIG_HOME env vars so Caddy can find cert storage.

**Port 443 on Linux:** Grant the capability once: `sudo setcap 'cap_net_bind_service=+ep' ~/.local/bin/caddy` — then a user service works fine.

## Example Apps

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · reference.md (reported line 16)May include surrounding context.

md

**Port 443 on macOS:** Non-root processes can't bind ports <1024. Use a system LaunchDaemon (runs as root) with HOME/XDG_DATA_HOME/XDG_CONFIG_HOME env vars so Caddy can find cert storage.

**Port 443 on Linux:** Grant the capability once: `sudo setcap 'cap_net_bind_service=+ep' ~/.local/bin/caddy` — then a user service works fine.

## Example Apps

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · reference.md (reported line 199)May include surrounding context.

md

**Port 443 on macOS:** Non-root processes can't bind ports <1024. Use a system LaunchDaemon (runs as root) with HOME/XDG_DATA_HOME/XDG_CONFIG_HOME env vars so Caddy can find cert storage.

**Port 443 on Linux:** Grant the capability once: `sudo setcap 'cap_net_bind_service=+ep' ~/.local/bin/caddy` — then a user service works fine.

## Example Apps

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · reference.md (reported line 200)May include surrounding context.

md

**Port 443 on macOS:** Non-root processes can't bind ports <1024. Use a system LaunchDaemon (runs as root) with HOME/XDG_DATA_HOME/XDG_CONFIG_HOME env vars so Caddy can find cert storage.

**Port 443 on Linux:** Grant the capability once: `sudo setcap 'cap_net_bind_service=+ep' ~/.local/bin/caddy` — then a user service works fine.

## Example Apps

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

**Port convention:** Permanent apps in the 3100 range, dev servers at 5200+ (managed by [dev-serve](https://clawhub.com/skills/dev-serve)).

**Vercel API Token:** Create a long-lived `vcp_*` token at https://vercel.com/account/tokens (no expiration — must be revoked if exposed). On macOS, store it in the LaunchDaemon plist env vars. On Linux, store it in an env file loaded by systemd (see Service Management below). You can push a new token to the live config without restart via `curl -X POST http://localhost:2019/load` with the token in the JSON config.

## Quick Dev Servers

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

**Port convention:** Permanent apps in the 3100 range, dev servers at 5200+ (managed by [dev-serve](https://clawhub.com/skills/dev-serve)).

**Vercel API Token:** Create a long-lived `vcp_*` token at https://vercel.com/account/tokens (no expiration — must be revoked if exposed). On macOS, store it in the LaunchDaemon plist env vars. On Linux, store it in an env file loaded by systemd (see Service Management below). You can push a new token to the live config without restart via `curl -X POST http://localhost:2019/load` with the token in the JSON config.

## Quick Dev Servers

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · reference.md (reported line 30)May include surrounding context.

md

**Port convention:** Permanent apps in the 3100 range, dev servers at 5200+ (managed by [dev-serve](https://clawhub.com/skills/dev-serve)).

**Vercel API Token:** Create a long-lived `vcp_*` token at https://vercel.com/account/tokens (no expiration — must be revoked if exposed). On macOS, store it in the LaunchDaemon plist env vars. On Linux, store it in an env file loaded by systemd (see Service Management below). You can push a new token to the live config without restart via `curl -X POST http://localhost:2019/load` with the token in the JSON config.

## Quick Dev Servers

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · reference.md (reported line 59)May include surrounding context.

md

**Port convention:** Permanent apps in the 3100 range, dev servers at 5200+ (managed by [dev-serve](https://clawhub.com/skills/dev-serve)).

**Vercel API Token:** Create a long-lived `vcp_*` token at https://vercel.com/account/tokens (no expiration — must be revoked if exposed). On macOS, store it in the LaunchDaemon plist env vars. On Linux, store it in an env file loaded by systemd (see Service Management below). You can push a new token to the live config without restart via `curl -X POST http://localhost:2019/load` with the token in the JSON config.

## Quick Dev Servers

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · reference.md (reported line 60)May include surrounding context.

md

**Port convention:** Permanent apps in the 3100 range, dev servers at 5200+ (managed by [dev-serve](https://clawhub.com/skills/dev-serve)).

**Vercel API Token:** Create a long-lived `vcp_*` token at https://vercel.com/account/tokens (no expiration — must be revoked if exposed). On macOS, store it in the LaunchDaemon plist env vars. On Linux, store it in an env file loaded by systemd (see Service Management below). You can push a new token to the live config without restart via `curl -X POST http://localhost:2019/load` with the token in the JSON config.

## Quick Dev Servers

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · reference.md (reported line 79)May include surrounding context.

md

**Port convention:** Permanent apps in the 3100 range, dev servers at 5200+ (managed by [dev-serve](https://clawhub.com/skills/dev-serve)).

**Vercel API Token:** Create a long-lived `vcp_*` token at https://vercel.com/account/tokens (no expiration — must be revoked if exposed). On macOS, store it in the LaunchDaemon plist env vars. On Linux, store it in an env file loaded by systemd (see Service Management below). You can push a new token to the live config without restart via `curl -X POST http://localhost:2019/load` with the token in the JSON config.

## Quick Dev Servers

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · reference.md (reported line 80)May include surrounding context.

md

**Port convention:** Permanent apps in the 3100 range, dev servers at 5200+ (managed by [dev-serve](https://clawhub.com/skills/dev-serve)).

**Vercel API Token:** Create a long-lived `vcp_*` token at https://vercel.com/account/tokens (no expiration — must be revoked if exposed). On macOS, store it in the LaunchDaemon plist env vars. On Linux, store it in an env file loaded by systemd (see Service Management below). You can push a new token to the live config without restart via `curl -X POST http://localhost:2019/load` with the token in the JSON config.

## Quick Dev Servers

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · reference.md (reported line 109)May include surrounding context.

md

**Port convention:** Permanent apps in the 3100 range, dev servers at 5200+ (managed by [dev-serve](https://clawhub.com/skills/dev-serve)).

**Vercel API Token:** Create a long-lived `vcp_*` token at https://vercel.com/account/tokens (no expiration — must be revoked if exposed). On macOS, store it in the LaunchDaemon plist env vars. On Linux, store it in an env file loaded by systemd (see Service Management below). You can push a new token to the live config without restart via `curl -X POST http://localhost:2019/load` with the token in the JSON config.

## Quick Dev Servers

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · reference.md (reported line 113)May include surrounding context.

md

**Port convention:** Permanent apps in the 3100 range, dev servers at 5200+ (managed by [dev-serve](https://clawhub.com/skills/dev-serve)).

**Vercel API Token:** Create a long-lived `vcp_*` token at https://vercel.com/account/tokens (no expiration — must be revoked if exposed). On macOS, store it in the LaunchDaemon plist env vars. On Linux, store it in an env file loaded by systemd (see Service Management below). You can push a new token to the live config without restart via `curl -X POST http://localhost:2019/load` with the token in the JSON config.

## Quick Dev Servers