vps-bootstrap

• Outcome: Review
• Latest audit: Jul 28, 2026 · 2:20 PM UTC
• Version: 1.1.0

Overview

This VPS recovery skill is broadly aligned with its stated purpose, but it performs high-impact system and credential restoration actions with insufficient safeguards.

Install only on a fresh, disposable, or fully backed-up VPS after reading the scripts. Do not run restore.sh with an untrusted or unverified backup tarball, and be prepared for SSH/firewall changes that could lock you out or overwrite existing credentials.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill metadata declares only name/description while the content clearly instructs execution of shell scripts that perform privileged system changes. Missing explicit permission declarations reduces informed consent and makes it easier for an agent or operator to run a high-risk skill without understanding that it will execute shell commands affecting the host.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The documented purpose sounds like generic VPS bootstrap and recovery, but the described behaviors include restoring sensitive credentials, modifying SSH authentication, generating GPG material, and enabling persistent services. That gap matters because users may authorize the skill expecting routine setup, while it can make irreversible security and persistence changes and import secrets from backups.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The restore script reinstalls GPG keys, a password store, OAuth material, desktop keyrings, and rclone credentials from an untrusted backup archive directly into the user's live environment. That greatly exceeds a narrow application restore scope and can silently replace or seed authentication material, enabling account takeover, data exfiltration, or persistence if the backup is tampered with or stale.

Context-Inappropriate Capability

Low

• Confidence: 94% confidence
• Finding: The script performs an outbound connectivity check to https://api.telegram.org, which is a third-party service not required to verify the local VPS/OpenClaw deployment itself. Even though the command is simple, it creates unnecessary external network traffic, leaks that the host is online and running this verification, and couples verification success to an unrelated external provider.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script modifies SSH authentication settings to disable password login and root login without an upfront confirmation or safety precheck. On a remote VPS, this can immediately lock out administrators who have not verified key-based access or alternate recovery paths, causing an availability and administrative access incident.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The generated GPG key uses '%no-protection', creating a private key with no passphrase for the secret store. If the VPS or the user's account is compromised, the attacker can immediately use the unencrypted private key to access secrets protected by pass without any additional barrier.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## Requirements

- Ubuntu 22.04+ or Debian 12+
- Root or sudo access
- 2GB+ RAM recommended
- SSH key access configured

• Confidence: 88% confidence
• Finding: Requiring root or sudo access makes any mistake or hidden behavior in the associated scripts capable of changing core system state, weakening host security, or breaking remote access. In this skill's context, privileged execution is especially sensitive because the same workflow also alters SSH, firewalling, packages, services, and credentials.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

| 权限 | 范围 | 用途 | 说明 |
|------|------|------|------|
| 执行 | sudo (root) | apt 包管理、系统配置 | 安装 Node.js/Chrome/Docker 等依赖 |
| 文件系统 | 写入 | 系统配置目录 (`/etc/`, `/usr/local/bin/`) | 修改 SSH、UFW、Fail2Ban 配置 |
| 文件系统 | 写入 | Workspace 目录 | 从备份恢复 AGENTS.md/MEMORY.md 等文件 |
| 网络 | 出站 | 包管理器源、Google Drive API | 下载软件包、备份恢复 |

• Confidence: 90% confidence
• Finding: The permissions table explicitly grants sudo/root for package management and system configuration, confirming the skill is designed to make privileged modifications under `/etc` and other system locations. Because the skill also handles restore operations and credential material, root execution increases the blast radius of any misuse, tampering, or operator misunderstanding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

log "Node.js already installed: $NODE_VER"
else
    log "Installing Node.js ${NODE_MAJOR}..."
    curl -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | sudo -E bash - 2>/dev/null
    sudo apt-get install -y -qq nodejs 2>/dev/null
    log "Node.js $(node --version) installed"
fi

• Confidence: 97% confidence
• Finding: The use of 'sudo -E' preserves environment variables while executing a downloaded script as root. That increases the attack surface because environment-controlled behavior can influence the privileged shell or the setup script, compounding the risk of remote root code execution from the piped installer.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# --- Step 5: Security baseline ----------------------------------------------
if [ "$ENABLE_FIREWALL" = "true" ]; then
    log "Configuring UFW firewall..."
    sudo ufw --force reset >/dev/null 2>&1
    sudo ufw default deny incoming >/dev/null
    sudo ufw default allow outgoing >/dev/null
    sudo ufw allow ssh >/dev/null

• Confidence: 90% confidence
• Finding: The command resets the firewall configuration with force under sudo, which can erase prior protections and service-specific rules on a live host. In a bootstrap/recovery context, this can expose services or disrupt intended controls if the host was not truly fresh or if additional required rules are omitted.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

log "Node.js already installed: $NODE_VER"
else
    log "Installing Node.js ${NODE_MAJOR}..."
    curl -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | sudo -E bash - 2>/dev/null
    sudo apt-get install -y -qq nodejs 2>/dev/null
    log "Node.js $(node --version) installed"
fi

• Confidence: 97% confidence
• Finding: The use of 'sudo -E' preserves environment variables while executing a downloaded script as root. That increases the attack surface because environment-controlled behavior can influence the privileged shell or the setup script, compounding the risk of remote root code execution from the piped installer.

Credential Access

High

• Category: Privilege Escalation

Content

echo "  ✓ GOG config"
fi

if [ -d "$BACKUP_ROOT/keyrings" ]; then
    mkdir -p "$HOME/.local/share/keyrings"
    cp -r "$BACKUP_ROOT/keyrings/"* "$HOME/.local/share/keyrings/" 2>/dev/null || true
    echo "  ✓ keyrings"

• Confidence: 97% confidence
• Finding: Creating the user's desktop keyring directory as part of an application restore enables the next step of planting arbitrary keyring material into the active account context. Because these keyrings may hold tokens and passwords for unrelated services, restoring them from a backup tarball can compromise far more than OpenClaw.

Credential Access

High

• Category: Privilege Escalation

Content

fi

if [ -d "$BACKUP_ROOT/keyrings" ]; then
    mkdir -p "$HOME/.local/share/keyrings"
    cp -r "$BACKUP_ROOT/keyrings/"* "$HOME/.local/share/keyrings/" 2>/dev/null || true
    echo "  ✓ keyrings"
fi

• Confidence: 99% confidence
• Finding: Copying keyring files from the backup archive directly into ~/.local/share/keyrings imports third-party credentials into the user's environment without validation. A malicious or poisoned backup could inject attacker-controlled tokens, overwrite existing secrets, or create persistence through reused authentication material.

Credential Access

High

• Category: Privilege Escalation

Content

if [ -d "$BACKUP_ROOT/keyrings" ]; then
    mkdir -p "$HOME/.local/share/keyrings"
    cp -r "$BACKUP_ROOT/keyrings/"* "$HOME/.local/share/keyrings/" 2>/dev/null || true
    echo "  ✓ keyrings"
fi

if [ -f "$BACKUP_ROOT/rclone.conf" ]; then

• Confidence: 96% confidence
• Finding: Restoring rclone.conf imports cloud remote definitions and often embedded OAuth tokens or credentials, potentially granting access to backup storage or other linked cloud resources. In the context of a bootstrap/recovery skill, this is especially dangerous because it normalizes broad credential restoration from a tarball and can hand an attacker durable access to remote data if the archive is compromised.

Chaining Abuse

High

• Category: Tool Misuse

Content

| 权限 | 范围 | 用途 | 说明 |
|------|------|------|------|
| 执行 | sudo (root) | apt 包管理、系统配置 | 安装 Node.js/Chrome/Docker 等依赖 |
| 文件系统 | 写入 | 系统配置目录 (`/etc/`, `/usr/local/bin/`) | 修改 SSH、UFW、Fail2Ban 配置 |
| 文件系统 | 写入 | Workspace 目录 | 从备份恢复 AGENTS.md/MEMORY.md 等文件 |
| 网络 | 出站 | 包管理器源、Google Drive API | 下载软件包、备份恢复 |

• Confidence: 85% confidence
• Finding: This skill combines sudo/root execution, filesystem writes, network access, service control, and credential restoration in one workflow. That capability chaining is dangerous because a single invocation could fetch content, write persistent system configuration, install/start services, and import secrets, creating a strong path for privilege abuse or durable compromise if the scripts are altered or the backups are untrusted.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# --- Step 5: Security baseline ----------------------------------------------
if [ "$ENABLE_FIREWALL" = "true" ]; then
    log "Configuring UFW firewall..."
    sudo ufw --force reset >/dev/null 2>&1
    sudo ufw default deny incoming >/dev/null
    sudo ufw default allow outgoing >/dev/null
    sudo ufw allow ssh >/dev/null

• Confidence: 92% confidence
• Finding: Using 'ufw --force reset' is destructive and bypasses interactive safeguards, which can wipe carefully curated firewall rules without operator review. In a disaster-recovery or migration scenario, that can create exposure or outages because the script assumes only SSH needs to be preserved.

Chaining Abuse

High

• Category: Tool Misuse

Content

log "Node.js already installed: $NODE_VER"
else
    log "Installing Node.js ${NODE_MAJOR}..."
    curl -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | sudo -E bash - 2>/dev/null
    sudo apt-get install -y -qq nodejs 2>/dev/null
    log "Node.js $(node --version) installed"
fi

• Confidence: 98% confidence
• Finding: Piping curl output directly into 'sudo bash' creates a classic command-chaining risk: unreviewed remote content is executed immediately with root privileges. Because this script is meant for fresh VPS provisioning, successful exploitation would fully compromise the host at initial setup time.

Static analysis

No suspicious patterns detected.