ClawHub
Back to skill

Security audit

vps-bootstrap

Security checks for vulnerabilities and agentic risk

Overview

This VPS bootstrap skill matches its stated purpose, but it performs high-impact system and credential restoration work with unsafe supply-chain and restore controls that users should review carefully.

Install only on a fresh, disposable VPS after reviewing the scripts line by line. Do not run restore.sh on any backup you did not create and trust, and prefer pinned package versions, verified downloads, signed backup manifests, sandboxed browser execution, and explicit approval before replacing OpenClaw instructions, scripts, cron data, or credentials.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/bootstrap.sh:48
Finding

Mutable Remote Script Executed with Root Privileges

Content
View full analysis

Vulnerability Details

File Location: scripts/bootstrap.sh:48-54
Vulnerability Type: Remote code retrieval and privileged execution
Risk Level: Critical

Vulnerable Code

bash
else
    log "Installing Node.js ${NODE_MAJOR}..."
    curl -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | sudo -E bash - 2>/dev/null
    sudo apt-get install -y -qq nodejs 2>/dev/null
    log "Node.js $(node --version) installed"
fi

Technical Analysis

The script downloads a mutable shell script from an external URL and pipes it directly into sudo bash. The downloaded content is not pinned to a known version, authenticated with a package-signing key by this script, or checked against an expected digest before execution.

TLS protects the connection in transit but does not protect against compromise of the upstream server, distribution account, DNS or certificate trust chain, or an unintended upstream content change. Because the response is immediately interpreted by a root shell, a compromised response can run arbitrary commands before any local validation is possible.

Attack Path

  1. An attacker compromises the NodeSource distribution endpoint, its publishing credentials, or a trusted network component.
  2. The attacker modifies the response returned for setup_${NODE_MAJOR}.x.
  3. An administrator runs bootstrap.sh.
  4. curl retrieves the altered response.
  5. The response is passed directly to sudo -E bash.
  6. The attacker-controlled script executes as root and can install services, alter SSH configuration, create users, or access all local data.

Impact Assessment

Successful exploitation provides arbitrary root-level code execution over the entire VPS. The attacker could obtain persistent administrative access, steal OpenClaw credentials and restored secrets, modify firewall or SSH settings, replace system binaries, and compromise all users and services on the host.

Remediation
View remediation

Remediation Suggestions

  • Do not pipe network responses directly into a shell, especially a privileged shell.
  • Configure the repository through locally maintained, version-controlled commands.
  • Download any required setup artifact to a temporary file created with mktemp.
  • Verify a pinned cryptographic digest or a signature made by a pre-established trusted key.
  • Pin the repository and Node.js major or exact version to an approved release.
  • Display the verified artifact and require administrative confirmation before privileged execution.
  • Remove sudo -E unless preservation of the caller's environment is demonstrably required, because inherited environment variables expand the privileged execution surface.

T02 · Agent Memory Poisoning

Error
Location
scripts/restore.sh:23
Finding

Unauthenticated Backup Restoration Can Poison Agent State and Install Persistent Content

Content
View full analysis

Vulnerability Details

File Location: scripts/restore.sh:23-30, scripts/restore.sh:36-54, and scripts/restore.sh:69-76
Vulnerability Type: Untrusted archive restoration into active Agent and persistence locations
Risk Level: High

Vulnerable Code

bash
# Extract to temp directory
TEMP_DIR=$(mktemp -d)
tar xzf "$BACKUP_FILE" -C "$TEMP_DIR"

# Find the backup root (may be nested)
BACKUP_ROOT=$(find "$TEMP_DIR" -maxdepth 2 -name "SOUL.md" -printf '%h\n' | head -1)
if [ -z "$BACKUP_ROOT" ]; then
    BACKUP_ROOT="$TEMP_DIR"
fi
bash
for f in SOUL.md USER.md AGENTS.md IDENTITY.md TOOLS.md HEARTBEAT.md MEMORY.md BOOT.md; do
    [ -f "$BACKUP_ROOT/$f" ] && cp "$BACKUP_ROOT/$f" "$WORKSPACE/$f" && echo "  ✓ $f"
done

# Memory files
if [ -d "$BACKUP_ROOT/memory" ]; then
    cp -r "$BACKUP_ROOT/memory/"* "$WORKSPACE/memory/" 2>/dev/null || true
    echo "  ✓ memory/ ($(ls "$WORKSPACE/memory/" | wc -l) files)"
fi

# Scripts
if [ -d "$BACKUP_ROOT/scripts" ]; then
    cp -r "$BACKUP_ROOT/scripts/"* "$WORKSPACE/scripts/" 2>/dev/null || true
    chmod +x "$WORKSPACE/scripts/"*.sh 2>/dev/null || true
    echo "  ✓ scripts/ ($(ls "$WORKSPACE/scripts/"*.sh 2>/dev/null | wc -l) scripts)"
fi
bash
# --- Cron database -----------------------------------------------------------
if [ -d "$BACKUP_ROOT/cron-db" ]; then
    echo "Restoring cron database..."
    for crondir in "$OPENCLAW_DIR/cron" "$OPENCLAW_DIR/data/cron"; do
        mkdir -p "$crondir"
        cp -r "$BACKUP_ROOT/cron-db/"* "$crondir/" 2>/dev/null && break
    done
    echo "  ✓ cron jobs restored"
fi

Technical Analysis

The restore operation accepts any local tarball without verifying a cryptographic signature, trusted manifest, expected ownership, or file inventory. It then copies archive content into active OpenClaw instruction and state files, including `SOUL.m ...[truncated 1950 chars]

Remediation
View remediation

Remediation Suggestions

  • Require every backup to include a signed manifest and verify it against a separately provisioned trusted public key before extraction.
  • Verify file hashes, expected paths, types, sizes, and permissions against the authenticated manifest.
  • List and inspect archive entries before extraction.
  • Reject absolute paths, .. components, symbolic links, hard links, devices, FIFOs, and all entries outside a strict allowlist.
  • Extract with ownership restoration disabled and restrictive permissions.
  • Restore ordinary data separately from active instruction files, scripts, cron records, configuration, and credentials.
  • Require explicit per-category confirmation before replacing Agent instructions or persistent state.
  • Never automatically mark restored scripts executable. Place them in quarantine for review.
  • Do not restore cron state directly. Parse, validate, display, and explicitly approve each scheduled task.
  • Preserve existing files and provide a reviewable diff and rollback snapshot before activation.

T08 · Insecure Dependencies

Error
Location
scripts/bootstrap.sh:59
Finding

Unpinned Global and Privileged Package Installation

Content
View full analysis

Vulnerability Details

File Location: scripts/bootstrap.sh:59-65 and scripts/bootstrap.sh:77-85
Vulnerability Type: Unsafe third-party dependency acquisition
Risk Level: High

Vulnerable Code

bash
else
    log "Installing Google Chrome..."
    wget -q -O /tmp/chrome.deb https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
    sudo dpkg -i /tmp/chrome.deb 2>/dev/null || sudo apt-get install -f -y -qq 2>/dev/null
    rm -f /tmp/chrome.deb
bash
if command -v openclaw &>/dev/null; then
    log "OpenClaw already installed: $(openclaw --version 2>/dev/null | head -1)"
    log "Updating OpenClaw..."
    npm update -g openclaw 2>/dev/null || npm install -g openclaw
else
    log "Installing OpenClaw..."
    npm install -g openclaw
fi

Technical Analysis

The Chrome URL identifies a moving “current stable” artifact rather than an approved immutable release. The script does not verify a pinned digest or vendor signature before handing the package to privileged installation tools.

OpenClaw is installed or updated globally without an exact version or an integrity value. This makes the effective dependency content mutable after the Skill itself has been reviewed. npm lifecycle scripts can execute during installation, so compromise of the package, its publishing account, or a transitive dependency can result in local code execution.

The fallback from npm update -g openclaw to npm install -g openclaw also silently replaces a failed update with another unconstrained retrieval operation.

Attack Path

  1. An attacker compromises an upstream release, registry package, publisher account, or transitive dependency.
  2. The compromised artifact becomes the current Chrome package or the version selected by unconstrained npm install or npm update.
  3. An operator runs the bootstrap script.
  4. The script retrieves and installs the altered artifact with ...[truncated 672 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin Chrome and OpenClaw to exact reviewed versions.
  • Download packages to securely created temporary files and verify vendor signatures and project-pinned digests before installation.
  • Configure the official signed package repository using a key with a restricted signed-by configuration rather than installing a mutable direct-download package.
  • Use npm lock or shrinkwrap metadata with integrity values where applicable.
  • Review package provenance and transitive dependencies.
  • Disable npm lifecycle scripts during retrieval when feasible, then run only explicitly reviewed installation steps.
  • Avoid unconditional global installation and use a dedicated, unprivileged service account or isolated deployment directory.
  • Fail closed when verification or update operations fail instead of falling back to an unconstrained latest installation.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/bootstrap.sh:67
Finding

System-Wide Chrome Shim Disables the Browser Sandbox

Content
View full analysis

Vulnerability Details

File Location: scripts/bootstrap.sh:67-72
Vulnerability Type: Browser isolation disabled
Risk Level: High

Vulnerable Code

bash
# Create headless shim for OpenClaw browser tools
sudo tee /usr/local/bin/chrome-shim > /dev/null << 'SHIM'
#!/bin/bash
exec google-chrome --headless --no-sandbox --disable-gpu --disable-dev-shm-usage "$@"
SHIM
sudo chmod +x /usr/local/bin/chrome-shim

Technical Analysis

The privileged bootstrap process installs a system-wide executable wrapper that always supplies Chrome's --no-sandbox option. This disables an important defense-in-depth boundary intended to contain compromised renderer processes and malicious web content.

The wrapper forwards all caller-provided arguments to Chrome, but the central issue is that callers cannot use this wrapper while retaining Chrome's normal sandbox. Because browser automation commonly processes untrusted Internet content, disabling process isolation materially increases the consequences of a browser vulnerability.

Attack Path

  1. OpenClaw or an operator invokes chrome-shim to visit attacker-controlled or compromised web content.
  2. The content exploits a vulnerability in Chrome's renderer or another browser component.
  3. Chrome was launched with --no-sandbox, so the normal sandbox containment boundary is absent.
  4. The exploit gains access under the account running the browser and can read or modify that account's files and credentials.
  5. The attacker can target OpenClaw workspace data, browser state, OAuth material, and other user-accessible secrets.

Impact Assessment

Successful exploitation can provide code execution with the privileges of the browser process. If OpenClaw runs under a privileged account, the impact increases accordingly. Potential exposure includes Agent configuration, workspace files, API credentials, OAuth tokens, browser profiles, and any local services a ...[truncated 26 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove --no-sandbox and run Chrome with its supported sandbox enabled.
  • Run browser automation under a dedicated unprivileged account with minimal filesystem and network access.
  • If the host environment cannot support Chrome's sandbox, isolate the browser in a hardened container or virtual machine with seccomp, namespace, capability, filesystem, and network restrictions.
  • Do not place an unsafe wrapper in a system-wide path.
  • Document any exceptional need to disable the sandbox and require explicit opt-in rather than enabling it by default.
  • Keep Chrome pinned to a supported, promptly patched release.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/bootstrap.sh:139
Finding

Password Store Encryption Key Is Generated Without Passphrase Protection

Content
View full analysis

Vulnerability Details

File Location: scripts/bootstrap.sh:139-155
Vulnerability Type: Insufficient protection of a secret-decryption key
Risk Level: Medium

Vulnerable Code

bash
if ! gpg --list-keys 2>/dev/null | grep -q "pub"; then
    log "Setting up GPG key for secret store..."
    read -p "Enter email for GPG key (or press Enter for default): " GPG_EMAIL
    GPG_EMAIL="${GPG_EMAIL:-openclaw@localhost}"
    
    cat > /tmp/gpg-params << GPGEOF
%no-protection
Key-Type: RSA
Key-Length: 4096
Name-Real: OpenClaw Agent
Name-Email: ${GPG_EMAIL}
Expire-Date: 0
%commit
GPGEOF
    gpg --batch --gen-key /tmp/gpg-params 2>/dev/null
    rm -f /tmp/gpg-params
    pass init "${GPG_EMAIL}" 2>/dev/null || true
    log "GPG key + password store initialized"

Technical Analysis

The %no-protection directive deliberately creates a GPG private key without passphrase protection. The key is then used to initialize pass, which is intended to hold API keys and other credentials.

Encryption still protects the password-store files when the corresponding private key is absent. However, any attacker who obtains read access to both the user's GPG directory and password-store directory can use the unprotected private key without knowing an additional secret. This weakens protection against filesystem disclosure, backup leakage, and account compromise.

Attack Path

  1. An attacker obtains read access to the user's home directory, an unencrypted filesystem snapshot, or a backup containing .gnupg and .password-store.
  2. The attacker copies the unprotected private key and encrypted password-store entries.
  3. Because the private key has no passphrase, the attacker imports or uses it without an additional authentication factor.
  4. The attacker decrypts credentials stored by pass.
  5. The recovered credentials are used to access connected APIs and external services.

Impac

...[truncated 347 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not use %no-protection for a key that encrypts operational secrets.
  • Generate a passphrase-protected key through a secure interactive process.
  • Prefer an OS keyring, hardware-backed key, or dedicated secret manager where unattended operation requirements permit.
  • Restrict .gnupg and .password-store permissions and verify ownership before use.
  • Ensure backups containing private keys are encrypted independently and protected separately from password-store data.
  • Define a secure noninteractive unlocking mechanism rather than removing key protection.
  • Set an appropriate key expiration and document rotation and revocation procedures.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/bootstrap.sh:117
Finding

SSH Hardening and Verification Can Falsely Report Key-Only Authentication

Content
View full analysis

Vulnerability Details

File Location: scripts/bootstrap.sh:117-127 and scripts/verify.sh:57-59
Vulnerability Type: Incomplete SSH configuration enforcement and validation
Risk Level: Medium

Vulnerable Code

bash
# Harden SSH (key-only, no root)
if grep -q "^PasswordAuthentication yes" /etc/ssh/sshd_config 2>/dev/null; then
    log "Hardening SSH..."
    sudo sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
    sudo sed -i 's/^#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
    sudo sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
    sudo systemctl reload sshd 2>/dev/null || sudo systemctl reload ssh 2>/dev/null
    log "SSH hardened (key-only, no root login)"
else
    log "SSH already hardened"
fi
bash
echo "🔐 SECURITY:"
check "SSH key-only auth" '! grep -q "^PasswordAuthentication yes" /etc/ssh/sshd_config'

Technical Analysis

Hardening occurs only if the primary configuration file contains the exact string PasswordAuthentication yes at the beginning of a line. The logic does not account for leading whitespace, case variations accepted by configuration parsing, included files, distribution drop-ins, Match blocks, or other authentication directives.

The root-login replacement similarly changes only the exact PermitRootLogin yes form and is executed only when the password-authentication condition is met. Therefore, root login can remain enabled when password authentication is represented differently or controlled elsewhere.

Verification repeats the same textual assumption. It treats absence of one exact insecure line as proof that key-only authentication is active, rather than querying the effective SSH daemon configuration.

Attack Path

  1. The host has password authentication or root login enabled through an included configuration file, a differently formatted di ...[truncated 933 chars]
Remediation
View remediation

Remediation Suggestions

  • Install a dedicated SSH drop-in with explicit settings such as PasswordAuthentication no, KbdInteractiveAuthentication no, and an appropriate PermitRootLogin value.
  • Validate configuration syntax with sshd -t before reloading the service.
  • Query effective global settings with sshd -T rather than grepping configuration text.
  • Where Match rules are used, validate relevant connection contexts with the appropriate sshd -T -C parameters.
  • Confirm that authorized key access works before disabling alternative authentication to avoid administrative lockout.
  • Back up existing SSH configuration and implement automatic rollback if validation or reload fails.
  • Update verify.sh to inspect effective daemon settings and fail if password or keyboard-interactive authentication remains enabled.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (53)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

This skill is presented as a complete VPS bootstrap and hardening workflow, yet the file mainly contains operational claims and instructions to run external scripts rather than the implementation itself. That disconnect increases supply-chain and review risk because an agent may execute unseen scripts with root privileges based on incomplete or misleading documentation.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

This skill is presented as a complete VPS bootstrap and hardening workflow, yet the file mainly contains operational claims and instructions to run external scripts rather than the implementation itself. That disconnect increases supply-chain and review risk because an agent may execute unseen scripts with root privileges based on incomplete or misleading documentation.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
88% confidence
Finding

The skill combines root execution, system file writes, network egress, secret-store handling, and restore functionality, which creates a meaningful chaining risk if the referenced scripts are compromised or misleading. In the context of a bootstrap/recovery skill, these combined permissions could enable full host takeover, persistence, credential exfiltration, or restoration of malicious state from backup.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md
| 权限 | 范围 | 用途 | 说明 |
|------|------|------|------|
| 执行 | sudo (root) | apt 包管理、系统配置 | 安装 Node.js/Chrome/Docker 等依赖 |
| 文件系统 | 写入 | 系统配置目录 (`/etc/`, `/usr/local/bin/`) | 修改 SSH、UFW、Fail2Ban 配置 |
| 文件系统 | 写入 | Workspace 目录 | 从备份恢复 AGENTS.md/MEMORY.md 等文件 |
| 网络 | 出站 | 包管理器源、Google Drive API | 下载软件包、备份恢复 |

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The command curl -fsSL ... | sudo -E bash executes network-retrieved content directly as root, combining remote content retrieval, shell interpretation, privilege escalation, and environment preservation in one step. This is a classic high-risk supply-chain and remote-code-execution pattern that can fully compromise the VPS if the fetched script is tampered with.

Content

Scanner excerpt · scripts/bootstrap.sh (reported line 52)May include surrounding context.

sh
log "Node.js already installed: $NODE_VER"
else
    log "Installing Node.js ${NODE_MAJOR}..."
    curl -fsSL https://deb.nodesource.com/setup_${NODE_MAJOR}.x | sudo -E bash - 2>/dev/null
    sudo apt-get install -y -qq nodejs 2>/dev/null
    log "Node.js $(node --version) installed"
fi

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/bootstrap.sh (reported line 64)May include surrounding context.

sh
else
        log "Installing Google Chrome..."
        wget -q -O /tmp/chrome.deb https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
        sudo dpkg -i /tmp/chrome.deb 2>/dev/null || sudo apt-get install -f -y -qq 2>/dev/null
        rm -f /tmp/chrome.deb

        # Create headless shim for OpenClaw browser tools

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/bootstrap.sh (reported line 123)May include surrounding context.

sh
else
        log "Installing Google Chrome..."
        wget -q -O /tmp/chrome.deb https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
        sudo dpkg -i /tmp/chrome.deb 2>/dev/null || sudo apt-get install -f -y -qq 2>/dev/null
        rm -f /tmp/chrome.deb

        # Create headless shim for OpenClaw browser tools

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/bootstrap.sh (reported line 65)May include surrounding context.

sh
log "Installing Google Chrome..."
        wget -q -O /tmp/chrome.deb https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
        sudo dpkg -i /tmp/chrome.deb 2>/dev/null || sudo apt-get install -f -y -qq 2>/dev/null
        rm -f /tmp/chrome.deb

        # Create headless shim for OpenClaw browser tools
        sudo tee /usr/local/bin/chrome-shim > /dev/null << 'SHIM'

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

ufw --force reset deletes existing firewall rules non-interactively, which can remove protections or access exceptions required for continued administration. In a VPS bootstrap/recovery context this is especially risky because it may disrupt remote access or unintentionally expose or block services until reconfiguration completes.

Content

Scanner excerpt · scripts/bootstrap.sh (reported line 91)May include surrounding context.

sh
# --- Step 5: Security baseline ----------------------------------------------
if [ "$ENABLE_FIREWALL" = "true" ]; then
    log "Configuring UFW firewall..."
    sudo ufw --force reset >/dev/null 2>&1
    sudo ufw default deny incoming >/dev/null
    sudo ufw default allow outgoing >/dev/null
    sudo ufw allow ssh >/dev/null

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/bootstrap.sh (reported line 154)May include surrounding context.

sh
%commit
GPGEOF
    gpg --batch --gen-key /tmp/gpg-params 2>/dev/null
    rm -f /tmp/gpg-params
    pass init "${GPG_EMAIL}" 2>/dev/null || true
    log "GPG key + password store initialized"
else

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/restore.sh (reported line 65)May include surrounding context.

sh
fi

if [ -f "$BACKUP_ROOT/dot-env" ]; then
    cp "$BACKUP_ROOT/dot-env" "$OPENCLAW_DIR/.env"
    echo "  ✓ .env"
fi

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/restore.sh (reported line 66)May include surrounding context.

sh
fi

if [ -f "$BACKUP_ROOT/dot-env" ]; then
    cp "$BACKUP_ROOT/dot-env" "$OPENCLAW_DIR/.env"
    echo "  ✓ .env"
fi

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/restore.sh (reported line 103)May include surrounding context.

sh
echo "  ✓ GOG config"
fi

if [ -d "$BACKUP_ROOT/keyrings" ]; then
    mkdir -p "$HOME/.local/share/keyrings"
    cp -r "$BACKUP_ROOT/keyrings/"* "$HOME/.local/share/keyrings/" 2>/dev/null || true
    echo "  ✓ keyrings"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/restore.sh (reported line 104)May include surrounding context.

sh
echo "  ✓ GOG config"
fi

if [ -d "$BACKUP_ROOT/keyrings" ]; then
    mkdir -p "$HOME/.local/share/keyrings"
    cp -r "$BACKUP_ROOT/keyrings/"* "$HOME/.local/share/keyrings/" 2>/dev/null || true
    echo "  ✓ keyrings"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/restore.sh (reported line 105)May include surrounding context.

sh
echo "  ✓ GOG config"
fi

if [ -d "$BACKUP_ROOT/keyrings" ]; then
    mkdir -p "$HOME/.local/share/keyrings"
    cp -r "$BACKUP_ROOT/keyrings/"* "$HOME/.local/share/keyrings/" 2>/dev/null || true
    echo "  ✓ keyrings"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/restore.sh (reported line 106)May include surrounding context.

sh
echo "  ✓ GOG config"
fi

if [ -d "$BACKUP_ROOT/keyrings" ]; then
    mkdir -p "$HOME/.local/share/keyrings"
    cp -r "$BACKUP_ROOT/keyrings/"* "$HOME/.local/share/keyrings/" 2>/dev/null || true
    echo "  ✓ keyrings"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill describes shell-based bootstrap, restore, and verification flows with privileged system changes, but it does not declare explicit tool scope such as permissions or allowed-tools in the machine-readable metadata. That omission can cause an agent or reviewer to underestimate its execution capabilities and approve a high-impact skill without appropriate gating.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file is primarily written in English, but the permissions declaration and critical warning are presented only in Chinese. This imposes a language constraint on users reading important operational and safety information, with no opt-in, alternative locale, or stated region-specific justification.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md
# --- Step 1: System packages ------------------------------------------------
log "Installing system packages..."
sudo apt-get update -qq
sudo apt-get install -y -qq \
    build-essential curl git jq unzip wget gnupg2 \
    ca-certificates lsb-release software-properties-common \

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md
# --- Step 1: System packages ------------------------------------------------
log "Installing system packages..."
sudo apt-get update -qq
sudo apt-get install -y -qq \
    build-essential curl git jq unzip wget gnupg2 \
    ca-certificates lsb-release software-properties-common \

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/bootstrap.sh (reported line 37)May include surrounding context.

sh
# --- Step 1: System packages ------------------------------------------------
log "Installing system packages..."
sudo apt-get update -qq
sudo apt-get install -y -qq \
    build-essential curl git jq unzip wget gnupg2 \
    ca-certificates lsb-release software-properties-common \

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/bootstrap.sh (reported line 38)May include surrounding context.

sh
# --- Step 1: System packages ------------------------------------------------
log "Installing system packages..."
sudo apt-get update -qq
sudo apt-get install -y -qq \
    build-essential curl git jq unzip wget gnupg2 \
    ca-certificates lsb-release software-properties-common \

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/bootstrap.sh (reported line 53)May include surrounding context.

sh
# --- Step 1: System packages ------------------------------------------------
log "Installing system packages..."
sudo apt-get update -qq
sudo apt-get install -y -qq \
    build-essential curl git jq unzip wget gnupg2 \
    ca-certificates lsb-release software-properties-common \

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/bootstrap.sh (reported line 64)May include surrounding context.

sh
# --- Step 1: System packages ------------------------------------------------
log "Installing system packages..."
sudo apt-get update -qq
sudo apt-get install -y -qq \
    build-essential curl git jq unzip wget gnupg2 \
    ca-certificates lsb-release software-properties-common \

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/bootstrap.sh (reported line 68)May include surrounding context.

sh
# --- Step 1: System packages ------------------------------------------------
log "Installing system packages..."
sudo apt-get update -qq
sudo apt-get install -y -qq \
    build-essential curl git jq unzip wget gnupg2 \
    ca-certificates lsb-release software-properties-common \

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/bootstrap.sh (reported line 72)May include surrounding context.

sh
# --- Step 1: System packages ------------------------------------------------
log "Installing system packages..."
sudo apt-get update -qq
sudo apt-get install -y -qq \
    build-essential curl git jq unzip wget gnupg2 \
    ca-certificates lsb-release software-properties-common \