vps-openclaw-security-hardening

• Outcome: Review
• Latest audit: Jul 28, 2026 · 2:20 PM UTC
• Version: 1.2.0

Overview

The skill is a disclosed VPS hardening tool, but it needs review because it uses root-level SSH, firewall, audit, and cron authority with lockout-prone instructions and outbound security telemetry options.

Install only on a disposable or dedicated VPS after confirming you have a working non-root sudo account with SSH key access. Review the installer before running it, especially SSH, UFW, and rollback behavior. Do not configure external alert tokens unless sending security logs and login/audit summaries to that service is acceptable.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares shell-capable installation and verification commands in metadata and documentation, but it does not provide a structured machine-readable permissions declaration in the expected format. That mismatch can cause users or tooling to underestimate the privileged actions the skill will perform, especially because it modifies SSH, firewall, audit, and cron configuration.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script transmits a security briefing containing authentication and audit telemetry to Telegram, a third-party service outside the local VPS boundary. Even if intended for alerting, this expands the trust boundary and can disclose sensitive operational security data if the bot token, chat membership, or Telegram account is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The code sends daily security briefing contents to Telegram without strong justification from the stated local hardening purpose, creating an unnecessary data exposure path. The transmitted report includes information about credential access, login activity, privilege escalation attempts, and firewall changes, which may help an attacker or leak internal security posture.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The script disables root SSH login with 'PermitRootLogin no' but then instructs the operator to test access using 'ssh -p <port> root@<your-ip>'. This contradiction can lock administrators out if no non-root key-based user is already configured, causing denial of administrative access on a production VPS.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The script creates a backup as /etc/ssh/sshd_config.rollback.<timestamp> but, on validation failure, attempts to restore from /etc/ssh/sshd_config.bak.* instead. This mismatch means the advertised recovery path can silently fail, leaving sshd_config modified and potentially breaking SSH access after an emergency rollback operation.

Natural-Language Policy Violations

Medium

• Confidence: 77% confidence
• Finding: The permissions declaration is only in Chinese, which can prevent some users and reviewers from understanding the true scope of privileged access, including sudo execution, writes to /etc, log access, and outbound alerting. Because this section is the closest thing to an explicit permissions disclosure, making it inaccessible increases the risk of uninformed consent to sensitive operations.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This script transmits alert contents, including event names, hostnames, timestamps, and snippets of audit data, to third-party services such as Telegram, Discord, Slack, or arbitrary webhooks. Because the piped audit path can include excerpts of sensitive security events, this creates a real data-exposure risk if operators are unaware of what leaves the host or if those channels are less trusted than the VPS itself.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script performs 'ufw --force reset' and enables a deny-by-default firewall without a prior explicit warning or confirmation about connectivity impact. If required management ports are not allowed beforehand, the VPS can become remotely inaccessible, especially in a headless server context.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script appends SSH hardening directives and restarts the SSH service without an upfront warning that remote access settings are being changed immediately. Combined with disabling root and password authentication, this can sever the current administrative access path and lock out the operator.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The restore logic references a different backup naming pattern than the file actually created, and the script suppresses restore errors with '|| true'. In a security-hardening skill for production VPS systems, that makes recovery during SSH changes less reliable and increases the risk of operator lockout or prolonged remote administrative outage.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script sends the generated weekly security report to Telegram, an external third-party service, without any minimization or sanitization of the included log data. Because the report contains audit and authentication events, it may expose sensitive operational details, usernames, IPs, or other security telemetry to an external platform and to anyone with access to the configured chat.

External Transmission

Medium

• Category: Data Exfiltration

Content

return 1
    fi
    
    curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
        -d "chat_id=${TELEGRAM_CHAT_ID}" \
        -d "parse_mode=Markdown" \
        -d "text=${message}" \

• Confidence: 90% confidence
• Finding: The Telegram sender posts the full alert message to an external SaaS endpoint. Since alert messages can contain audit-event excerpts from piped input, sensitive host security telemetry may be disclosed to Telegram or to anyone with access to the bot/chat configuration.

External Transmission

Medium

• Category: Data Exfiltration

Content

return 1
    fi
    
    curl -s -X POST "$DISCORD_WEBHOOK_URL" \
        -H "Content-Type: application/json" \
        -d "{\"content\": \"$message\"}" \
        --max-time 10 \

• Confidence: 90% confidence
• Finding: The Discord webhook sender exfiltrates alert contents to an external webhook. Because the message is inserted directly into a JSON body and may include security-event details, this can leak internal monitoring data outside the VPS boundary.

External Transmission

Medium

• Category: Data Exfiltration

Content

return 1
    fi
    
    curl -s -X POST "$SLACK_WEBHOOK_URL" \
        -H "Content-Type: application/json" \
        -d "{\"text\": \"$message\"}" \
        --max-time 10 \

• Confidence: 90% confidence
• Finding: The Slack notifier transmits alert messages to an external service, which may include sensitive operational details derived from audit logs. This is a genuine confidentiality concern, especially in a hardening skill where the alerts may concern credentials, SSH changes, or privilege-related events.

External Transmission

Medium

• Category: Data Exfiltration

Content

local method="${WEBHOOK_METHOD:-POST}"
    
    curl -s -X "$method" "$WEBHOOK_URL" \
        -H "Content-Type: application/json" \
        -d "{\"alert\": \"$message\", \"timestamp\": \"$(date -Iseconds)\"}" \
        --max-time 10 \

• Confidence: 94% confidence
• Finding: The generic webhook sender can transmit full alert data to any configured URL using a configurable HTTP method, making it the most flexible and therefore riskiest exfiltration path in the script. In the context of a security-monitoring tool, this can leak highly sensitive telemetry to arbitrary destinations if misconfigured or abused.

External Transmission

Medium

• Category: Data Exfiltration

Content

return 1
    fi
    
    curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
        -d "chat_id=${TELEGRAM_CHAT_ID}" \
        -d "parse_mode=Markdown" \
        -d "text=${message}" \

• Confidence: 90% confidence
• Finding: The Telegram sender posts the full alert message to an external SaaS endpoint. Since alert messages can contain audit-event excerpts from piped input, sensitive host security telemetry may be disclosed to Telegram or to anyone with access to the bot/chat configuration.

External Transmission

Medium

• Category: Data Exfiltration

Content

return 0
    fi
    
    curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
        -d "chat_id=${TELEGRAM_CHAT_ID}" \
        -d "parse_mode=Markdown" \
        -d "text=${report}" \

• Confidence: 90% confidence
• Finding: The explicit Telegram API endpoint confirms outbound transmission to an external service. In the context of a VPS hardening skill, exporting audit and authentication telemetry off-host increases confidentiality risk and may violate expectations of a local-only security tool.

External Transmission

Medium

• Category: Data Exfiltration

Content

return 0
    fi
    
    curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
        -d "chat_id=${TELEGRAM_CHAT_ID}" \
        -d "parse_mode=Markdown" \
        -d "text=${report}" \

• Confidence: 90% confidence
• Finding: The explicit Telegram API endpoint confirms outbound transmission to an external service. In the context of a VPS hardening skill, exporting audit and authentication telemetry off-host increases confidentiality risk and may violate expectations of a local-only security tool.

External Transmission

Medium

• Category: Data Exfiltration

Content

if [ -f "$ALERT_CONFIG" ]; then
    source "$ALERT_CONFIG"
    if [ -n "$TELEGRAM_BOT_TOKEN" ] && [ -n "$TELEGRAM_CHAT_ID" ]; then
        curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
            -d chat_id="${TELEGRAM_CHAT_ID}" \
            -d text="$(cat $REPORT_FILE | head -100)" \
            -d parse_mode="HTML" 2>/dev/null

• Confidence: 90% confidence
• Finding: Use of the Telegram API confirms that security data leaves the VPS boundary and is sent to a third-party service. In a security-hardening skill, outbound transfer of audit and auth-derived information is more sensitive than in a generic notification script because it can reveal the system's defensive posture and attack activity.

External Transmission

Medium

• Category: Data Exfiltration

Content

if [ -f "$ALERT_CONFIG" ]; then
    source "$ALERT_CONFIG"
    if [ -n "$TELEGRAM_BOT_TOKEN" ] && [ -n "$TELEGRAM_CHAT_ID" ]; then
        curl -s -X POST "https://api.telegram.org/bot${TELEGRAM_BOT_TOKEN}/sendMessage" \
            -d chat_id="${TELEGRAM_CHAT_ID}" \
            -d text="$(cat $REPORT_FILE | head -100)" \
            -d parse_mode="HTML" 2>/dev/null

• Confidence: 90% confidence
• Finding: Use of the Telegram API confirms that security data leaves the VPS boundary and is sent to a third-party service. In a security-hardening skill, outbound transfer of audit and auth-derived information is more sensitive than in a generic notification script because it can reveal the system's defensive posture and attack activity.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

log "Configuring UFW firewall..."
    
    # Reset to safe defaults
    ufw --force reset
    ufw default deny incoming
    ufw default allow outgoing

• Confidence: 94% confidence
• Finding: Using 'ufw --force reset' is a destructive parameter choice because it wipes existing firewall configuration without confirmation. On a remote VPS this can remove essential access rules and, when followed by restrictive defaults, can cause immediate denial of service to administrators or dependent services.

Static analysis

No suspicious patterns detected.