Security audit

Kkclaw Server

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real headless KKClaw client, but it documents a persistent system service and can send API keys, messages, and telemetry over unencrypted HTTP.

Review carefully before installing. Use HTTPS for any non-local gateway, protect or avoid plaintext API keys in config files, and prefer foreground or user-level service operation unless system-wide boot persistence is truly needed. If using systemd, run it as a dedicated least-privilege account, harden the unit, and document how to stop, disable, and remove it.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

Location: SKILL.md:91
Finding: Boot-Persistent System Service Installed with Elevated Privileges
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: main.js:282
Finding: Bearer Credentials, Messages, and Telemetry Can Be Transmitted over Plaintext HTTP
Content: View full analysis
{ const url = new URL(endpoint, this.config.gateway.url); const options = { hostname: url.hostname, port: url.port, path: url.pathname + url.search, method, headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${this.config.gateway.apiKey}` }, timeout: this.config.heartbeat.timeout }; const req = (url.protocol === 'https:' ? https : http).request(options, (res) => { let body = ''; res.on('data', c => body += c); res.on('end', () => { try { const json = JSON.parse(body); if (res.statusCode >= 200 && res.statusCode < 300) { resolve(json); } else { reject(new Error(`HTTP ${res.statusCode}: ${json.error || body}`)); } } catch (e) { reject(new Error(`Invalid JSON: ${body}`)); } }); }); req.on('error', reject); req.on('timeout', () => { req.destroy(); reject(new Error('Request timeout')); }); if (data) { req.write(JSON.stringify(data)); } req.end(); }); } ``` The shipped configuration also permits plaintext HTTP: ```json "gateway": { "url": "http://localhost:18789", "apiKey": "" } ``` The documentation presents a potentially remote HTTP endpoint: ```json "gatew ...[truncated 2759 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill documentation states that it reports status to a gateway and later specifies that heartbeats include status, model, queue length, memory, and uptime. Because this behavior transmits system and operational data off-host, the markdown should disclose the privacy and telemetry implications to users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The config example includes an API key field in a user-editable JSON file without any guidance on secure storage, file permissions, or avoiding credential exposure. This can lead users to place long-lived secrets in plaintext configs that may be leaked through backups, logs, screenshots, or overly permissive filesystem access.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.
Then:

bash
sudo systemctl daemon-reload sudo systemctl enable kkclaw sudo systemctl start kkclaw

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
Then:

bash
sudo systemctl daemon-reload sudo systemctl enable kkclaw sudo systemctl start kkclaw

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 116)May include surrounding context.
Then:

bash
sudo systemctl daemon-reload sudo systemctl enable kkclaw sudo systemctl start kkclaw

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.
Then:

bash
sudo systemctl daemon-reload sudo systemctl enable kkclaw sudo systemctl start kkclaw

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The heartbeat transmits runtime telemetry including process uptime, memory usage, queue length, model name, and status, and message sending transmits queued content to the configured gateway. While this appears to be intended functionality for a remote server, it still creates a privacy and security risk because sensitive operational metadata and user-provided message content are sent outbound without any visible consent flow, minimization, or redaction, and the default gateway is plain HTTP.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · main.js (reported line 471)May include surrounding context.
js
break; case 'init': // Create config const configDir = path.dirname(configPath); if (!fs.existsSync(configDir)) { fs.mkdirSync(configDir, { recursive: true });

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The init command creates ~/.kkclaw/config.json on disk, which is a file write operation, but there is no preceding disclosure that a persistent config file will be created at that path. Although a success message is printed afterward, the user is not warned before the write occurs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.