vps-openclaw-security-hardening

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:42 AM UTC
• Version: 1.2.0

Overview

This skill is not clearly malicious, but it asks for root access to change SSH, firewall, audit, and cron settings, and the shipped installer is unsafe and incomplete enough to require Review before installation.

Do not install this on a production or remote VPS as-is. Review and fix the installer first: include the missing audit/config files, avoid ufw --force reset unless explicitly confirmed with a rollback plan, install cron scripts and config into root-owned protected paths, stop sourcing .env as shell code, validate SSH_PORT and SSH config before changes, and test the full flow in a disposable VM. Treat external alerting as sensitive telemetry sharing.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/install.sh:183

Finding

Root Cron Jobs Execute Scripts from a Potentially User-Writable Skill Directory

Content

View full analysis

/etc/cron.d/agent-security << 'EOF' # VPS Security Hardening - Automated Tasks # Daily briefing at 08:00 0 8 * * * root $SKILL_DIR/scripts/daily-briefing.sh # Log size check every 6 hours 0 */6 * * * root $SKILL_DIR/scripts/audit-log-monitor.sh # Weekly security report (Sundays) 0 9 * * 0 root $SKILL_DIR/scripts/weekly-report.sh EOF chmod 644 /etc/cron.d/agent-security log " Cron jobs installed" } ``` ### Technical Analysis The installer registers three scheduled jobs under the `root` account. Their intended targets are scripts in the original Skill directory rather than copies installed into a protected system directory. The documented installation procedure places the Skill under a user's OpenClaw skills directory and then invokes the installer with `sudo`. The installer does not: - Copy scheduled executables into a root-owned directory. - Recursively change ownership to `root`. - Verify that scripts and parent directories are not writable by non-root users. - Check for symbolic links before registering the paths. - Pin the scheduled content through a trusted wrapper or integrity mechanism. If a non-root user retains write access to a scheduled script or any relevant parent directory, that user can replace the executable and cause attacker-controlled commands to run as `root`. The persistence is related to the declared monitoring functionality, but executing mutable project files as root violates least privilege and turns the scheduled tasks into a local privilege-escalation mechanism. ### Attack Path 1. A user installs the Skill from a directory that remains owned or writable by that user. 2. The installer creates `/etc/cron.d/agent-security` with jo ...[truncated 858 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/audit-log-monitor.sh:5

Finding

Root-Scheduled Scripts Execute Configuration Files as Shell Code

Content

View full analysis

/dev/null fi fi ``` ### Technical Analysis The scripts use Bash `source` to load `config/alerting.env`. A sourced file is not treated as inert key-value data; every shell construct in it is executed with the privileges of the calling process. These scripts are registered by the installer as root cron jobs. Consequently, modification or creation of `config/alerting.env` by a non-root user allows arbitrary shell commands to execute as root. The installer does not create a protected configuration directory or validate the file's owner, permissions, type, or contents before sourcing it. This is particularly dangerous because the configuration path is relative to the Skill directory, which may remain under ordinary user ownership following the documented installa ...[truncated 1064 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/install.sh:186

Finding

Quoted Heredoc Prevents Cron Script Paths from Being Expanded

Content

View full analysis

/etc/cron.d/agent-security << 'EOF' # VPS Security Hardening - Automated Tasks # Daily briefing at 08:00 0 8 * * * root $SKILL_DIR/scripts/daily-briefing.sh # Log size check every 6 hours 0 */6 * * * root $SKILL_DIR/scripts/audit-log-monitor.sh # Weekly security report (Sundays) 0 9 * * 0 root $SKILL_DIR/scripts/weekly-report.sh EOF ``` ### Technical Analysis Quoting the heredoc delimiter as `'EOF'` disables parameter expansion while generating the cron file. Therefore, the literal text `$SKILL_DIR` is written to `/etc/cron.d/agent-security`. Cron does not receive the installer's shell variable. Depending on cron's shell processing and environment, the command generally resolves to an invalid path such as `/scripts/daily-briefing.sh`, causing the jobs to fail. The installer subsequently reports that cron jobs were installed, and `scripts/verify.sh` only checks whether `/etc/cron.d/agent-security` exists. It does not verify that the commands point to valid executables or have run successfully. This creates false confidence that security monitoring, daily briefings, and weekly reports are operational. ### Attack Path 1. The administrator runs the installer. 2. The installer writes literal `$SKILL_DIR` references into the system cron file. 3. The installer reports successful cron setup because file creation succeeds. 4. Verification passes the cron check because it tests only for file existence. 5. Scheduled execution fails to locate the scripts. 6. Security events are not processed or reported as advertised, potentially allowing malicious activity to remain undetected. This issue does not directly grant attacker privileges, but an attacker benefits from the resulting monitoring blind spot. ### Impact Assessment The af ...[truncated 334 chars]

Remediation

View remediation

/etc/cron.d/agent-security <

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install.sh:137

Finding

Missing Audit Rules File Causes a Dangerous Partial Hardening Installation

Content

View full analysis

/dev/null || \ warn "Some audit rules already exist, continuing..." log " Auditd configured with 8MB × 5 logs max" } ``` The installation order is: ```bash check_root check_os backup_configs install_packages disable_unnecessary_services configure_ssh configure_ufw configure_auditd configure_autoupdates setup_cron verify_installation ``` ### Technical Analysis The complete project directory supplied for audit does not contain the referenced `rules/audit.rules` file or a `rules/` directory. Because the installer enables `set -euo pipefail`, the failed `cp` terminates installation immediately. The failure occurs only after the installer has already: - Installed packages. - Potentially disabled CUPS. - Appended SSH hardening directives. - Restarted the SSH daemon. - Reset the existing UFW configuration. - Set default-deny inbound firewall behavior. - Allowed only the selected SSH port. - Enabled the firewall. There is no transactional rollback or error trap covering these earlier changes. The user is therefore left with a partially modified host, no installed audit rules, and no final verification. Resetting UFW also des ...[truncated 1322 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (53)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 281)May include surrounding context.

sudo systemctl disable auditd

Remove cron jobs

sudo rm /etc/cron.d/agent-security

text

## Customization

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

If verification scripts only audit existing settings while the skill promises active hardening, users may deploy it expecting protection that never gets applied. In a security skill, overstating enforcement capabilities is particularly dangerous because the context encourages trust and direct use on production infrastructure.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If verification scripts only audit existing settings while the skill promises active hardening, users may deploy it expecting protection that never gets applied. In a security skill, overstating enforcement capabilities is particularly dangerous because the context encourages trust and direct use on production infrastructure.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If verification scripts only audit existing settings while the skill promises active hardening, users may deploy it expecting protection that never gets applied. In a security skill, overstating enforcement capabilities is particularly dangerous because the context encourages trust and direct use on production infrastructure.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If verification scripts only audit existing settings while the skill promises active hardening, users may deploy it expecting protection that never gets applied. In a security skill, overstating enforcement capabilities is particularly dangerous because the context encourages trust and direct use on production infrastructure.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

| 权限 | 范围 | 用途 | 说明 |
|------|------|------|------|
| 执行 | sudo | SSH 加固、防火墙、auditd 安装 | 系统安全配置变更 |
| 文件系统 | 写入 | `/etc/ssh/sshd_config` | SSH 端口/认证模式配置 |
| 文件系统 | 写入 | `/etc/audit/rules.d/` | 内核级审计规则 |
| 文件系统 | 写入 | `/etc/cron.d/` | 安装定期安全简报定时任务 |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 94% confidence

Finding

Using 'ufw --force reset' as root is a destructive operation that removes all existing firewall rules and can invalidate carefully curated access controls. In a VPS hardening script, this is especially risky because it may expose services temporarily or lock out administrators if replacement rules are incomplete or incorrect.

Content

Scanner excerpt · scripts/install.sh (reported line 124)May include surrounding context.

sh

log "Configuring UFW firewall..."
    
    # Reset to safe defaults
    ufw --force reset
    ufw default deny incoming
    ufw default allow outgoing

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/critical-alert.sh (reported line 192)May include surrounding context.

sh

echo "=== CREDENTIAL SECURITY ==="
# Check credential file permissions (customize paths as needed)
CRED_PATHS=(
    "/root/.openclaw/.env"
    "/root/.env"
)
CRED_SECURE=0

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/verify.sh (reported line 78)May include surrounding context.

sh

echo "=== CREDENTIAL SECURITY ==="
# Check credential file permissions (customize paths as needed)
CRED_PATHS=(
    "/root/.openclaw/.env"
    "/root/.env"
)
CRED_SECURE=0

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/verify.sh (reported line 79)May include surrounding context.

sh

echo "=== CREDENTIAL SECURITY ==="
# Check credential file permissions (customize paths as needed)
CRED_PATHS=(
    "/root/.openclaw/.env"
    "/root/.env"
)
CRED_SECURE=0

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Using source on an environment file executes its contents as shell code, not merely variable assignments. If that file is modified by an attacker or misconfigured, arbitrary commands will run in the context of the report script, which is especially dangerous for a cron-executed security utility.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 52)May include surrounding context.

bash

# Example: Choose port 4848
export SSH_PORT=4848
sudo ./scripts/install.sh

Why this matters:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 89)May include surrounding context.

bash

# Example: Choose port 4848
export SSH_PORT=4848
sudo ./scripts/install.sh

Why this matters:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 281)May include surrounding context.

bash

# Example: Choose port 4848
export SSH_PORT=4848
sudo ./scripts/install.sh

Why this matters:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 291)May include surrounding context.

bash

# Example: Choose port 4848
export SSH_PORT=4848
sudo ./scripts/install.sh

Why this matters:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 304)May include surrounding context.

bash

# Example: Choose port 4848
export SSH_PORT=4848
sudo ./scripts/install.sh

Why this matters:

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises shell-capable installation and verification commands but does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent or user may invoke privileged shell actions without a machine-readable restriction boundary, increasing the chance of unintended or unsafe execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Lines L029-L033 present critical installation and safety warnings only in Chinese, while the rest of the skill is written in English. This imposes a language requirement on users for understanding essential safety information without opt-in or documented locale scope, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 83% confidence

Finding

The documented use of sudo to run the installer is expected for a system-hardening skill, but it is still dangerous because it grants full system modification capability to the script. In this context, the risk comes from executing a privileged installer whose exact actions may be broader than the metadata clearly constrains.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

# Install
cd ~/.openclaw/skills/vps-openclaw-security-hardening
sudo ./scripts/install.sh

# Verify
./scripts/verify.sh

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/critical-alert.sh (reported line 46)May include surrounding context.

sh

return 1
    fi
    
    curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
        -d "chat_id=${TELEGRAM_CHAT_ID}" \
        -d "parse_mode=Markdown" \
        -d "text=${message}" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/critical-alert.sh (reported line 46)May include surrounding context.

sh

return 1
    fi
    
    curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
        -d "chat_id=${TELEGRAM_CHAT_ID}" \
        -d "parse_mode=Markdown" \
        -d "text=${message}" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/critical-alert.sh (reported line 65)May include surrounding context.

sh

return 1
    fi
    
    curl -s -X POST "$DISCORD_WEBHOOK_URL" \
        -H "Content-Type: application/json" \
        -d "{\"content\": \"$message\"}" \
        --max-time 10 \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/critical-alert.sh (reported line 83)May include surrounding context.

sh

return 1
    fi
    
    curl -s -X POST "$SLACK_WEBHOOK_URL" \
        -H "Content-Type: application/json" \
        -d "{\"text\": \"$message\"}" \
        --max-time 10 \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 82% confidence

Finding

Unlike the fixed vendor integrations, this sends alert payloads to an arbitrary user-configured webhook using a configurable HTTP method. In this script, alert messages can include raw audit-event excerpts such as .env access evidence, so a misconfigured or compromised webhook target could receive sensitive security telemetry or credential-related file paths.

Content

Scanner excerpt · scripts/critical-alert.sh (reported line 103)May include surrounding context.

sh

local method="${WEBHOOK_METHOD:-POST}"
    
    curl -s -X "$method" "$WEBHOOK_URL" \
        -H "Content-Type: application/json" \
        -d "{\"alert\": \"$message\", \"timestamp\": \"$(date -Iseconds)\"}" \
        --max-time 10 \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The explicit use of the Telegram API confirms that the destination is an external third-party service rather than a local notification mechanism. In the context of a VPS hardening skill, exporting security telemetry off-box is more dangerous because it contradicts the principle of minimizing disclosure of defensive and operational state.

Content

Scanner excerpt · scripts/daily-briefing.sh (reported line 129)May include surrounding context.

sh

return 0
    fi
    
    curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
        -d "chat_id=${TELEGRAM_CHAT_ID}" \
        -d "parse_mode=Markdown" \
        -d "text=${report}" \

Static analysis

No suspicious patterns detected.