OpenClaw Docker Setup

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:35 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent OpenClaw Docker setup guide, but it handles several powerful credentials and downloads in ways that materially increase exposure risk.

Review this skill before installing. Use a pinned OpenClaw image digest, avoid piping unverified latest-release archives into the container, do not print raw secret-bearing config files, replace the fixed Google keyring password with a unique secret, and use dedicated low-privilege bot accounts for Discord, Gmail, and Google Workspace. Rotate any token or app password that has been displayed in terminal output or copied into logs.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/gmail-setup.md:77

Finding

Unverified Mutable Remote Executables Are Downloaded and Executed

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:161

Finding

Mutable Container Image Is Trusted with Persistent Data and Service Credentials

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/gmail-setup.md:105

Finding

Gmail App Password Is Stored, Displayed, and Updated Insecurely

Content

View full analysis

/home/node/.config/himalaya/config.toml' [accounts.gmail] default = true email = "" display-name = "OpenClaw Bot" [accounts.gmail.incoming] type = "imap" host = "imap.gmail.com" port = 993 login = "" auth.type = "password" auth.raw = "APP_PASSWORD_HERE" [accounts.gmail.outgoing] type = "smtp" host = "smtp.gmail.com" port = 587 login = "" auth.type = "password" auth.raw = "APP_PASSWORD_HERE" CONFIG ``` ```bash docker exec openclaw-isolated cat /home/node/.config/himalaya/config.toml ``` ```bash docker exec -it openclaw-isolated sh -c \ 'sed -i "s/auth.raw = .*/auth.raw = \"NEW_APP_PASSWORD\"/" \ /home/node/.config/himalaya/config.toml' ``` ### Technical Analysis The Gmail app password is embedded directly in a plaintext TOML file. The file-creation command does not establish a restrictive `umask` or explicit mode such as `0600`. The subsequent verification command prints the entire configuration, including both password entries, to the terminal. The maintenance command is also unsafe because the new password is included in the command text. It can consequently be retained in shell history and exposed through command-line or process inspection while the command runs. A Gmail app password is a reusable authentication secret. Container isolation does not eliminate the need for restrictive permissions because every process running as the same user can read the file, and terminal output may be captured by Agent transcripts, support logs, shell recording, or screen-sharing software. ### Attack Path 1. The user replaces `APP_PASSWORD_HERE` ...[truncated 1031 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/google-drive-setup.md:148

Finding

Google OAuth Token Uses a Predictable Temporary File and Hard-Coded Keyring Password

Content

View full analysis

\ --client isolated \ --out /tmp/gog-token-export.json \ --overwrite ``` ```bash cat /tmp/gog-token-export.json | \ docker exec -i -e GOG_KEYRING_PASSWORD=openclaw-isolated \ openclaw-isolated /home/node/.local/bin/gog auth tokens import /dev/stdin ``` ```bash rm /tmp/gog-token-export.json ``` ```bash docker run -d \ --name openclaw-isolated \ --restart unless-stopped \ -p 19002:18789 \ -m 2048m \ --cpus=1 \ --cap-drop=ALL \ --cap-add=NET_BIND_SERVICE \ --security-opt no-new-privileges \ -v openclaw-isolated-data:/app/data \ -v openclaw-isolated-home:/home/node \ -e NODE_OPTIONS="--max-old-space-size=1024" \ -e GOG_KEYRING_PASSWORD=openclaw-isolated \ -e GOG_CLIENT=isolated \ -e GOG_ACCOUNT= \ ghcr.io/openclaw/openclaw:latest ``` The token-refresh procedure at `references/google-drive-setup.md:265-269` repeats the same temporary-file and password pattern. ### Technical Analysis A reusable Google OAuth token is exported to the fixed pathname `/tmp/gog-token-export.json`. The guide does not securely create the file, set a restrictive `umask`, validate ownership, or guarantee cleanup if an intermediate operation fails. Predictable shared temporary paths can permit unauthorized reads and may allow replacement or link-based race attacks, depending on the exporting tool’s file-handling behavior. The file is deleted with ordinary `rm`, but only after successful execution of preceding commands. It may remain if setup is interrupted. Ordinary deletion also does not provide a reliable data-erasure guarantee on modern filesystems. The keyring password is the ...[truncated 1450 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:278

Finding

Raw OpenClaw Configuration Is Printed to Bypass Secret Redaction

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (25)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The guide imports Google OAuth tokens into the container while providing a static keyring password via an environment variable: GOG_KEYRING_PASSWORD=openclaw-isolated. A hardcoded, predictable secret weakens protection of stored credentials because anyone with access to the container config, process environment, logs, or documentation can decrypt or reuse the credential store.

Content

Scanner excerpt · references/google-drive-setup.md (reported line 163)May include surrounding context.

bash

cat /tmp/gog-token-export.json | \
  docker exec -i -e GOG_KEYRING_PASSWORD=openclaw-isolated \
  openclaw-isolated /home/node/.local/bin/gog auth tokens import /dev/stdin

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/google-drive-setup.md (reported line 170)May include surrounding context.

Clean up:

bash

rm /tmp/gog-token-export.json

Verify inside container:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/google-drive-setup.md (reported line 269)May include surrounding context.

Clean up:

bash

rm /tmp/gog-token-export.json

Verify inside container:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

This verification command again exposes reliance on a static environment-variable password for the gog keyring. Although listing auth is legitimate, the dangerous part is normalizing disclosure and reuse of a shared predictable secret that protects OAuth tokens for Google services.

Content

Scanner excerpt · references/google-drive-setup.md (reported line 176)May include surrounding context.

Verify inside container:

bash

docker exec -e GOG_KEYRING_PASSWORD=openclaw-isolated \
  openclaw-isolated /home/node/.local/bin/gog auth list --client isolated

Credential Access

High

• Category: Privilege Escalation
• Confidence: 100% confidence

Finding

The docker run example permanently sets GOG_KEYRING_PASSWORD=openclaw-isolated in container configuration, making the decryption secret predictable and retrievable through Docker inspection or operational tooling. In the context of a skill that provisions a long-lived bot with Google Drive/Docs/Calendar access, this materially increases the chance of credential compromise.

Content

Scanner excerpt · references/google-drive-setup.md (reported line 203)May include surrounding context.

md

-v openclaw-isolated-data:/app/data \
  -v openclaw-isolated-home:/home/node \
  -e NODE_OPTIONS="--max-old-space-size=1024" \
  -e GOG_KEYRING_PASSWORD=openclaw-isolated \
  -e GOG_CLIENT=isolated \
  -e GOG_ACCOUNT=<YOUR_BOT_EMAIL> \
  ghcr.io/openclaw/openclaw:latest

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

This command repeats the same insecure secret-handling pattern during normal operation by passing the predictable keyring password through environment variables at execution time. Repetition increases the likelihood the secret appears in shell history, copied docs, screenshots, automation, and operator habits, making compromise more likely.

Content

Scanner excerpt · references/google-drive-setup.md (reported line 245)May include surrounding context.

bash

# List Drive files from inside container
docker exec -e GOG_KEYRING_PASSWORD=openclaw-isolated \
  -e GOG_CLIENT=isolated \
  openclaw-isolated /home/node/.local/bin/gog drive ls

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The maintenance workflow continues to export tokens and re-import them using the same documented static keyring password. This compounds risk over time because token refreshes are recurring operations, so insecure handling is not one-time but institutionalized in the setup process.

Content

Scanner excerpt · references/google-drive-setup.md (reported line 267)May include surrounding context.

Export and re-import

gog auth tokens export <YOUR_BOT_EMAIL> --client isolated --out /tmp/gog-token-export.json --overwrite cat /tmp/gog-token-export.json |
docker exec -i -e GOG_KEYRING_PASSWORD=openclaw-isolated
openclaw-isolated /home/node/.local/bin/gog auth tokens import /dev/stdin rm /tmp/gog-token-export.json

text

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file explicitly describes defeating CLI redaction to reveal an authentication token. That undermines a built-in safety control and can enable unauthorized access to the OpenClaw gateway if the token is exposed, especially given this skill’s focus on deploying a remotely reachable service with browser and Discord integration.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to pull and run ghcr.io/openclaw/openclaw:latest, which is mutable and can change over time without notice. That creates a supply-chain and reproducibility risk: a later image update could introduce vulnerable or malicious code while the instructions still appear identical.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Although the matched text is docker run -d, the surrounding command launches the same unpinned ghcr.io/openclaw/openclaw:latest image. Running a mutable image tag undermines integrity guarantees and allows silent behavior changes between installs or reinstalls.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md

> **Pitfall — OOM crash loop:** If the container keeps restarting, check logs:
> `docker logs --tail 20 $INSTANCE`
> If you see `JavaScript heap out of memory`, the container needs `-m 2048m` AND `-e NODE_OPTIONS="--max-old-space-size=1024"`. Recreate with the full command above.

> **Pitfall — port conflict:** If the port is in use, you chose the wrong `HOST_PORT` in Step 0. Re-run the conflict check: `lsof -i :$HOST_PORT`. Pick a free port and relaunch.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

Wait 10 seconds, then verify:

bash

curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:$HOST_PORT/

Success: Returns 200.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The update workflow again pulls ghcr.io/openclaw/openclaw:latest, repeating the mutable-tag supply-chain risk. A user following the maintenance section could unknowingly upgrade to an unreviewed image with new vulnerabilities or hostile modifications.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The maintenance docker run example recreates the container from the same mutable image reference, so the deployment is not reproducible or auditable. This is especially relevant because the skill stores persistent auth and workspace data in volumes, increasing the value of a compromised image.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This document materially expands the skill from Docker/OpenClaw installation into enabling persistent Gmail access, email sending, and attachment retrieval. That gives the container a new external communications and data-ingestion capability that is not necessary for basic Docker setup, increasing the attack surface and enabling sensitive data access if the agent or container is compromised.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

These steps configure a general-purpose mail client inside the container with credentials that permit reading emails, sending mail, and downloading attachments. In context, this is more dangerous because the skill is supposed to set up an isolated OpenClaw instance, yet it equips that instance with broad exfiltration and inbound file-handling capabilities that can be abused for phishing, data theft, or malicious document retrieval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The verification step instructs the user to print the entire Himalaya configuration file, which contains the Gmail app password in cleartext. This can leak credentials to terminal scrollback, shell logging, screen recording, or support transcripts, making unauthorized mailbox access possible.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · references/google-drive-setup.md (reported line 141)May include surrounding context.

Verify ownership (must show node node):

bash

docker exec openclaw-isolated ls -la /home/node/.config/gogcli/credentials-isolated.json

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The guide exports OAuth tokens into /tmp/gog-token-export.json in plaintext and does not clearly warn that this file contains bearer-token material equivalent to account access. On multi-user systems, in backups, shell history, crash artifacts, or weak /tmp handling, this can expose Google Drive/Docs/Calendar access for the bot account.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence

Finding

The container is launched with ghcr.io/openclaw/openclaw:latest, which uses a mutable tag rather than an immutable digest or pinned version. This can cause supply-chain risk because future pulls may run different code than was reviewed, including a compromised or malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation tells the operator to bypass secret redaction by reading the raw config file to recover gateway.auth.token. That directly exposes a live authentication secret and normalizes handling sensitive credentials in cleartext, increasing the chance of accidental disclosure through terminal history, screenshots, logs, or copied output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions expose /home/node/.openclaw/openclaw.json, which likely contains authentication tokens and other sensitive configuration, without any warning about sensitive data handling. In a setup skill, users are especially likely to copy terminal output into support channels, making disclosure more likely.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The documentation table states CPU limit | 1 core at L513, but the actual docker run commands use --cpus=2 at L166 and again at L446. This is an active contradiction between the file's reference documentation and the commands users are instructed to run.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.