ClawHub
Back to skill

Security audit

Research

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent research workflow, but its setup asks users to make risky persistent credential and installer changes that deserve review before installation.

Install only if you are comfortable with a research skill saving prompts and findings under ~/.openclaw/workspace/research and sending deep-research prompts to Parallel AI. Avoid copying the .bashrc API-key export and curl-to-sh installer as written; prefer a scoped secret manager or per-command environment variable and a verified package-manager install path.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SETUP.md:62
Finding

Unverified Remote Installer Is Executed Directly by the Shell

Content
View full analysis

Vulnerability Details

File Location: SETUP.md, line 62
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

Technical Analysis

The setup instructions retrieve a mutable script from an external URL and pipe the response directly into sh. The script is executed before the user can inspect it, and the command does not pin a release, verify a cryptographic signature, or validate a checksum.

HTTPS provides transport protection but does not establish that the current remote script is immutable or safe. The effective code executed during installation can change after this skill has been audited. Compromise of the upstream website, hosting environment, DNS resolution, certificate issuance, or release process could therefore convert this installation command into arbitrary code execution.

Installing uv may be necessary for the documented PDF export workflow, but executing an unverified network response is not the minimum privilege or safest installation mechanism needed to obtain that dependency.

Attack Path

  1. An attacker compromises or gains control over the remote installer delivery path.
  2. The attacker modifies the response served from https://astral.sh/uv/install.sh.
  3. A user follows the setup instructions and runs the documented command.
  4. curl downloads the attacker-controlled response and sends it directly to sh.
  5. The shell executes the payload with the privileges of the user running setup.
  6. The payload can read or modify files accessible to that user, including workspace data, shell configuration, and user-readable credentials.

Impact Assessment

Successful exploitation provides arbitrary command execution under the installing user's account. The payload could access the user's files and environment, steal credentials available to that account, alter shell startup fil ...[truncated 160 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not pipe network responses directly into a shell.
  • Prefer a trusted operating-system package manager with a pinned package version.
  • If an upstream installer is required, download a version-specific artifact to a local file first.
  • Verify the artifact using a cryptographic signature or a checksum obtained through an independently authenticated channel.
  • Present the downloaded script for inspection before execution.
  • Execute installation with ordinary user privileges and avoid sudo unless a specific system-level operation requires it.
  • Document the exact expected version, hash, source, and verification commands so the installed dependency is reproducible and auditable.

T09 · Insecure Skill Coding Practices

Warning
Location
SETUP.md:27
Finding

API Key Is Persistently and Unsafely Exported Through Shell Startup Configuration

Content
View full analysis

Vulnerability Details

File Location: SETUP.md, lines 27-35
Vulnerability Type: Insecure credential loading and excessive environment exposure
Risk Level: Medium

Vulnerable Code:

bash
# Create secrets directory
mkdir -p ~/.secrets/parallel_ai

# Save your API key
echo "PARALLEL_API_KEY=your_key_here" > ~/.secrets/parallel_ai/.env
chmod 600 ~/.secrets/parallel_ai/.env

# Add to your shell profile (~/.bashrc or ~/.zshrc)
echo 'export $(cat ~/.secrets/parallel_ai/.env | xargs)' >> ~/.bashrc
source ~/.bashrc

Technical Analysis

The credential file is protected with mode 600, which appropriately restricts direct file access after chmod completes. However, the instructions append a permanent command to .bashrc that reads the file through command substitution and xargs, then exports the resulting values into every subsequently started interactive Bash environment.

This approach has several security and reliability problems:

  • The API key is inherited by every child process launched from the shell, even though only parallel-research requires it.
  • Persistent modification of .bashrc exceeds the minimum scope needed to authenticate one CLI.
  • xargs performs whitespace and quote parsing that is not a safe or robust environment-file parser. Values containing spaces, quotes, backslashes, or other unusual characters may be altered or split.
  • Repeating the setup appends duplicate startup commands.
  • source ~/.bashrc immediately executes the entire startup file, including any unrelated or previously compromised commands already present in it.
  • The directory is created without explicitly setting a restrictive mode. Although the file is later changed to mode 600, restrictive permissions should be established before writing secret material.

No direct credential exfiltration is present in the audited files. The confirmed issue is unnecessarily broad and persistent credential expo ...[truncated 1264 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not automatically append secret-loading commands to .bashrc or other global shell startup files.
  • Scope the API key to the parallel-research invocation, for example through a dedicated wrapper that reads only the expected variable immediately before execution.
  • Prefer an operating-system credential store, service-specific secret manager, or CLI-native authentication mechanism.
  • If a file must be used, create the directory with restrictive permissions before writing:
    bash
    install -d -m 700 ~/.secrets/parallel_ai
umask 077
printf '%s\n' 'PARALLEL_API_KEY=your_key_here' > ~/.secrets/parallel_ai/.env
chmod 600 ~/.secrets/parallel_ai/.env
  • Parse only the explicitly expected PARALLEL_API_KEY entry rather than exporting every token from the file.
  • Avoid xargs as an environment-file parser.
  • Do not run source ~/.bashrc as part of installation; instruct users to open a new shell only if a profile change is genuinely necessary.
  • Document key rotation and revocation procedures in case the credential is exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (18)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Creating a plaintext .env file containing an API key introduces credential exposure risk if the home directory is backed up, synced, indexed, or read by local processes under the same account. In the context of setup docs, this is not active credential theft, but it does normalize insecure secret storage.

Content

Scanner excerpt · SETUP.md (reported line 31)May include surrounding context.

md
mkdir -p ~/.secrets/parallel_ai

# Save your API key
echo "PARALLEL_API_KEY=your_key_here" > ~/.secrets/parallel_ai/.env
chmod 600 ~/.secrets/parallel_ai/.env

# Add to your shell profile (~/.bashrc or ~/.zshrc)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SETUP.md (reported line 32)May include surrounding context.

md
# Save your API key
echo "PARALLEL_API_KEY=your_key_here" > ~/.secrets/parallel_ai/.env
chmod 600 ~/.secrets/parallel_ai/.env

# Add to your shell profile (~/.bashrc or ~/.zshrc)
echo 'export $(cat ~/.secrets/parallel_ai/.env | xargs)' >> ~/.bashrc

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

Appending export $(cat ~/.secrets/parallel_ai/.env | xargs) to ~/.bashrc causes automatic loading of secrets into every future shell session, increasing persistence and the blast radius of accidental leaks through subprocess environments, shell dumps, or troubleshooting commands. It also encourages brittle parsing of secret material via xargs, which can mis-handle special characters.

Content

Scanner excerpt · SETUP.md (reported line 35)May include surrounding context.

chmod 600 ~/.secrets/parallel_ai/.env

Add to your shell profile (~/.bashrc or ~/.zshrc)

echo 'export $(cat ~/.secrets/parallel_ai/.env | xargs)' >> ~/.bashrc source ~/.bashrc

text

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SETUP.md (reported line 35)May include surrounding context.

esearch/scripts/parallel-research /usr/local/bin/parallel-research

text

**Verify it works:**
```bash
parallel-research --help

Set your API key:

bash
# Create secrets directory
mkdir -p ~/.secrets/parallel_ai

# Save your API key
echo "PARALLEL_API_KEY=your_key_here" > ~/.secrets/parallel_ai/.env
chmod 600 ~/.secrets/parallel_ai/.env

# Add to your shell profile (~/.bashrc or ~/.zshrc)
echo 'export $(cat ~/.secrets/parallel_ai/.env | xargs)' >> ~/.bashrc
source ~/.bashrc

2. Install export-pdf CLI

Symlink alongside parallel-research:

bash
ln -sf ~/.openclaw/skills/research/scripts/export-pdf ~/.local/bin/export-pdf

Dependencies

pandoc (required):

bash
# macOS
brew install pandoc

# Linux
sudo apt-get install pandoc

uv (required — handles PyMuPDF automatically):

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

The script uses uvx --with pymupdf so you don't need to manually install PyMuPDF or manage a venv.

Verif

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The | sh construct chains network retrieval directly into shell execution, eliminating the opportunity for review and making compromise of the remote source immediately exploitable. This pattern is broadly unsafe in setup documentation and amplifies the impact of any transient network or upstream breach.

Content

Scanner excerpt · SETUP.md (reported line 62)May include surrounding context.

uv (required — handles PyMuPDF automatically):

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

The script uses uvx --with pymupdf so you don't need to manually install PyMuPDF or manage a venv.

Context Leakage

High
Category
Data Exfiltration
Confidence
75% confidence
Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

md
- **Atomic findings** - One insight per bullet
- **Link everything** - Sources, docs, repos
- **Capture context** - Why did we look at this?
- **Note confidence** - Use qualifiers when uncertain
- **Date important findings** - Especially for fast-moving topics

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SETUP.md (reported line 13)May include surrounding context.

bash
# Option A: Symlink to ~/.local/bin (recommended, usually in PATH)
mkdir -p ~/.local/bin
ln -sf ~/.openclaw/skills/research/scripts/parallel-research ~/.local/bin/parallel-research

# Option B: Symlink to /usr/local/bin (system-wide, needs sudo)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SETUP.md (reported line 17)May include surrounding context.

ln -sf ~/.openclaw/skills/research/scripts/parallel-research ~/.local/bin/parallel-research

Option B: Symlink to /usr/local/bin (system-wide, needs sudo)

sudo ln -sf ~/.openclaw/skills/research/scripts/parallel-research /usr/local/bin/parallel-research

text

**Verify it works:**

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SETUP.md (reported line 57)May include surrounding context.

ln -sf ~/.openclaw/skills/research/scripts/parallel-research ~/.local/bin/parallel-research

Option B: Symlink to /usr/local/bin (system-wide, needs sudo)

sudo ln -sf ~/.openclaw/skills/research/scripts/parallel-research /usr/local/bin/parallel-research

text

**Verify it works:**

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The instructions store an API key in a plaintext .env file and automatically append a command to load it from ~/.bashrc, increasing the chance of accidental disclosure through shell history, debugging output, process inspection, or later profile reuse. While chmod 600 helps, the credential remains broadly accessible to any process running as the user and is persisted without warning about operational risks.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SETUP.md (reported line 32)May include surrounding context.

md
# Save your API key
echo "PARALLEL_API_KEY=your_key_here" > ~/.secrets/parallel_ai/.env
chmod 600 ~/.secrets/parallel_ai/.env

# Add to your shell profile (~/.bashrc or ~/.zshrc)
echo 'export $(cat ~/.secrets/parallel_ai/.env | xargs)' >> ~/.bashrc

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Piping a remote script directly into sh executes unreviewed network content immediately, creating a direct remote code execution path if the hosting site, transport, or downloaded script is compromised. The lack of any integrity verification or warning materially increases the danger in a setup guide.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

Using uvx --with pymupdf without pinning an exact package version makes builds non-reproducible and exposes users to unexpected upstream changes or a compromised future release. In setup documentation, this is a real supply-chain risk because the command causes live dependency resolution at execution time.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SETUP.md (reported line 81)May include surrounding context.

~/.openclaw/workspace/research/

text

Create it if needed:
```bash
mkdir -p ~/.openclaw/workspace/research

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill directs the agent to create folders and write multiple files in a persistent workspace, but the top-level description and trigger section do not clearly warn the user that their request will modify the filesystem. This creates a consent and transparency problem and may result in unintended persistence of potentially sensitive prompts and findings.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger conditions are very broad and overlap with ordinary user requests such as exploring ideas, investigating options, or asking for research. This can cause the skill to activate when the user did not intend to start a persistent research workflow, leading to unexpected tool use and document creation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

The skill is explicitly designed to persist session-derived content into a long-lived research directory, including the original prompt and subsequent findings. This increases the risk that sensitive user data, proprietary ideas, or regulated information remains stored beyond the session without explicit retention controls.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
- Research a topic, idea, or question
- Explore something before committing to building it
- Investigate options, patterns, or approaches
- Create a "research doc" or "investigation"
- Run deep async research on a complex topic

## Research Directory

External Script Fetching

Low
Category
Supply Chain
Confidence
97% confidence
Finding

Fetching and executing an installer from the internet without integrity verification exposes users to supply-chain compromise and arbitrary code execution. In a setup guide, this is particularly risky because users may copy-paste the command without review.

Content

Scanner excerpt · SETUP.md (reported line 62)May include surrounding context.

uv (required — handles PyMuPDF automatically):

bash
curl -LsSf https://astral.sh/uv/install.sh | sh

The script uses uvx --with pymupdf so you don't need to manually install PyMuPDF or manage a venv.

Static analysis

No suspicious patterns detected.