OpenClaw Docker Setup

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:35 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent OpenClaw Docker setup guide, but it handles several powerful credentials and downloads in ways that materially increase exposure risk.

Review this skill before installing. Use a pinned OpenClaw image digest, avoid piping unverified latest-release archives into the container, do not print raw secret-bearing config files, replace the fixed Google keyring password with a unique secret, and use dedicated low-privilege bot accounts for Discord, Gmail, and Google Workspace. Rotate any token or app password that has been displayed in terminal output or copied into logs.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/gmail-setup.md:77
• Finding: Unverified Mutable Remote Executables Are Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `references/gmail-setup.md:77-89`, `references/gmail-setup.md:238-240`, `references/google-drive-setup.md:105-117` **Vulnerability Type**: Supply-chain compromise through mutable remote payloads **Risk Level**: High ### Vulnerable Code ```bash # references/gmail-setup.md:77-89 docker exec openclaw-isolated sh -c \ 'mkdir -p /home/node/.local/bin && \ curl -L https://github.com/pimalaya/himalaya/releases/latest/download/himalaya-aarch64-unknown-linux-musl.tar.gz \ | tar -xz -C /home/node/.local/bin/' docker exec openclaw-isolated sh -c \ 'mkdir -p /home/node/.local/bin && \ curl -L https://github.com/pimalaya/himalaya/releases/latest/download/himalaya-x86_64-unknown-linux-musl.tar.gz \ | tar -xz -C /home/node/.local/bin/' ``` ```bash # references/google-drive-setup.md:105-117 docker exec openclaw-isolated sh -c \ 'mkdir -p /home/node/.local/bin && \ curl -L https://github.com/steipete/gogcli/releases/latest/download/gogcli_linux_arm64.tar.gz \ | tar -xz -C /home/node/.local/bin/' docker exec openclaw-isolated sh -c \ 'mkdir -p /home/node/.local/bin && \ curl -L https://github.com/steipete/gogcli/releases/latest/download/gogcli_linux_amd64.tar.gz \ | tar -xz -C /home/node/.local/bin/' ``` The Himalaya update procedure at `references/gmail-setup.md:238-240` repeats the same unsafe pattern. ### Technical Analysis The commands retrieve release archives from mutable `latest` URLs and stream them directly into `tar`. The resulting programs are placed in an executable directory and subsequently run with access to sensitive Gmail or Google Workspace credentials. The installation process provides no: - Immutable version pinning - SHA-256 digest verification - Cryptographic signature or provenance verification - Archive-content inspection - Protection against archive path traversal - `curl --fail` check to reject HTTP errors Although GitHub is a mainstream hosting service, these releas ...[truncated 1598 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin each dependency to a reviewed, immutable release version rather than `latest`. 2. Publish expected SHA-256 hashes in the Skill and verify them before extraction. 3. Prefer upstream signature or artifact-attestation verification when available. 4. Download the archive to a securely created temporary file rather than piping it directly to `tar`. 5. Use `curl --fail --show-error --location --proto '=https'`. 6. List and validate archive entries before extraction, rejecting absolute paths and `..` traversal entries. 7. Extract into a temporary staging directory and install only the expected binary. 8. Abort installation if any integrity or provenance check fails. 9. Document a controlled review and update process for changing pinned versions or hashes. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:161
• Finding: Mutable Container Image Is Trusted with Persistent Data and Service Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:131-134`, `SKILL.md:161-173`, `SKILL.md:435-453`, `references/google-drive-setup.md:191-206` **Vulnerability Type**: Unpinned container dependency **Risk Level**: High ### Vulnerable Code ```bash docker pull ghcr.io/openclaw/openclaw:latest ``` ```bash docker run -d \ --name $INSTANCE \ --restart unless-stopped \ -p $HOST_PORT:18789 \ -m 2048m \ --cpus=2 \ --cap-drop=ALL \ --cap-add=NET_BIND_SERVICE \ --security-opt no-new-privileges \ -v ${INSTANCE}-data:/app/data \ -v ${INSTANCE}-home:/home/node \ -e NODE_OPTIONS="--max-old-space-size=1024" \ ghcr.io/openclaw/openclaw:latest ``` The update and Google Drive setup procedures also recreate the container from the same mutable `latest` tag. ### Technical Analysis The core OpenClaw image is selected by the mutable `latest` tag without a pinned image digest or documented provenance verification. A tag can be changed to reference different image content after this Skill has passed review. This image is especially sensitive because it receives persistent volumes, network access, a restart policy, and credentials for Anthropic, Discord, Gmail, and Google services. The container-hardening flags are beneficial and reduce Linux capability abuse, but they cannot prevent a malicious process inside the trusted image from reading data deliberately mounted or supplied to it. ### Attack Path 1. The registry account, image build system, or upstream release process is compromised, or the `latest` tag is otherwise changed unexpectedly. 2. The user runs `docker pull ghcr.io/openclaw/openclaw:latest`. 3. Docker obtains the attacker-controlled or unreviewed image. 4. The container starts with persistent `/app/data` and `/home/node` volumes and outbound network access. 5. During setup, the container receives AI-provider, Discord, Gmail, gateway, or Google credentials. 6. The malicious image reads or modifies those credentials and persistent ...[truncated 682 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the image to a reviewed digest, for example: ```bash ghcr.io/openclaw/openclaw@sha256:REVIEWED_DIGEST ``` 2. Verify image signatures or provenance attestations before launch. 3. Document the exact reviewed version and digest in the Skill. 4. Require explicit review before updating the digest. 5. Consider a read-only root filesystem and writable mounts only where necessary. 6. Add explicit egress controls where operationally feasible. 7. Separate credentials by integration and avoid exposing optional credentials to deployments that do not need them. 8. Back up and inspect persistent volumes before running a newly approved image revision. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/gmail-setup.md:105
• Finding: Gmail App Password Is Stored, Displayed, and Updated Insecurely<![CDATA[ ## Vulnerability Details **File Location**: `references/gmail-setup.md:105-137`, `references/gmail-setup.md:225-231` **Vulnerability Type**: Plaintext credential exposure **Risk Level**: High ### Vulnerable Code ```bash docker exec openclaw-isolated sh -c 'mkdir -p /home/node/.config/himalaya' cat << 'CONFIG' | docker exec -i openclaw-isolated sh -c \ 'cat > /home/node/.config/himalaya/config.toml' [accounts.gmail] default = true email = "<YOUR_BOT_EMAIL>" display-name = "OpenClaw Bot" [accounts.gmail.incoming] type = "imap" host = "imap.gmail.com" port = 993 login = "<YOUR_BOT_EMAIL>" auth.type = "password" auth.raw = "APP_PASSWORD_HERE" [accounts.gmail.outgoing] type = "smtp" host = "smtp.gmail.com" port = 587 login = "<YOUR_BOT_EMAIL>" auth.type = "password" auth.raw = "APP_PASSWORD_HERE" CONFIG ``` ```bash docker exec openclaw-isolated cat /home/node/.config/himalaya/config.toml ``` ```bash docker exec -it openclaw-isolated sh -c \ 'sed -i "s/auth.raw = .*/auth.raw = \"NEW_APP_PASSWORD\"/" \ /home/node/.config/himalaya/config.toml' ``` ### Technical Analysis The Gmail app password is embedded directly in a plaintext TOML file. The file-creation command does not establish a restrictive `umask` or explicit mode such as `0600`. The subsequent verification command prints the entire configuration, including both password entries, to the terminal. The maintenance command is also unsafe because the new password is included in the command text. It can consequently be retained in shell history and exposed through command-line or process inspection while the command runs. A Gmail app password is a reusable authentication secret. Container isolation does not eliminate the need for restrictive permissions because every process running as the same user can read the file, and terminal output may be captured by Agent transcripts, support logs, shell recording, or screen-sharing software. ### Attack Path 1. The user replaces `APP_PASSWORD_HERE` ...[truncated 1031 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer a supported secret manager, OS keychain, or protected credential command instead of `auth.raw`. 2. If a file is unavoidable, create it with restrictive permissions: ```bash umask 077 install -m 600 /dev/stdin /home/node/.config/himalaya/config.toml ``` 3. Verify only ownership and permissions; do not print the configuration file. 4. Replace the password through an interactive prompt or protected standard input, not a command-line argument. 5. Ensure the secret is never written to shell history, logs, transcripts, or `TOOLS.md`. 6. Run the email client under a dedicated identity with access only to its own credential file. 7. Continue recommending a separate bot mailbox and document immediate credential revocation procedures. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: references/google-drive-setup.md:148
• Finding: Google OAuth Token Uses a Predictable Temporary File and Hard-Coded Keyring Password<![CDATA[ ## Vulnerability Details **File Location**: `references/google-drive-setup.md:148-176`, `references/google-drive-setup.md:191-206`, `references/google-drive-setup.md:258-269` **Vulnerability Type**: Unsafe temporary credential handling and hard-coded secret **Risk Level**: High ### Vulnerable Code ```bash gog auth tokens export <YOUR_BOT_EMAIL> \ --client isolated \ --out /tmp/gog-token-export.json \ --overwrite ``` ```bash cat /tmp/gog-token-export.json | \ docker exec -i -e GOG_KEYRING_PASSWORD=openclaw-isolated \ openclaw-isolated /home/node/.local/bin/gog auth tokens import /dev/stdin ``` ```bash rm /tmp/gog-token-export.json ``` ```bash docker run -d \ --name openclaw-isolated \ --restart unless-stopped \ -p 19002:18789 \ -m 2048m \ --cpus=1 \ --cap-drop=ALL \ --cap-add=NET_BIND_SERVICE \ --security-opt no-new-privileges \ -v openclaw-isolated-data:/app/data \ -v openclaw-isolated-home:/home/node \ -e NODE_OPTIONS="--max-old-space-size=1024" \ -e GOG_KEYRING_PASSWORD=openclaw-isolated \ -e GOG_CLIENT=isolated \ -e GOG_ACCOUNT=<YOUR_BOT_EMAIL> \ ghcr.io/openclaw/openclaw:latest ``` The token-refresh procedure at `references/google-drive-setup.md:265-269` repeats the same temporary-file and password pattern. ### Technical Analysis A reusable Google OAuth token is exported to the fixed pathname `/tmp/gog-token-export.json`. The guide does not securely create the file, set a restrictive `umask`, validate ownership, or guarantee cleanup if an intermediate operation fails. Predictable shared temporary paths can permit unauthorized reads and may allow replacement or link-based race attacks, depending on the exporting tool’s file-handling behavior. The file is deleted with ordinary `rm`, but only after successful execution of preceding commands. It may remain if setup is interrupted. Ordinary deletion also does not provide a reliable data-erasure guarantee on modern filesystems. The keyring password is the ...[truncated 1450 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Avoid writing the exported token to disk if the tool supports exporting directly to standard output. 2. If a file is required, create a private temporary directory and file: ```bash umask 077 token_dir="$(mktemp -d)" token_file="$token_dir/token.json" trap 'rm -rf "$token_dir"' EXIT INT TERM ``` 3. Verify the file is a regular file owned by the current user and has mode `0600`. 4. Generate a strong, unique keyring password using a cryptographically secure random generator. 5. Supply the keyring password through Docker secrets or a protected file rather than `-e` command arguments. 6. Do not document a universal default password. 7. Revoke and reauthorize Google OAuth tokens if temporary-file exposure is suspected. 8. Reduce requested Google service scopes to only those needed for the intended deployment. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:278
• Finding: Raw OpenClaw Configuration Is Printed to Bypass Secret Redaction<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:278-286`, `SKILL.md:495`, `references/pitfalls.md:112-123` **Vulnerability Type**: Excessive disclosure of sensitive configuration **Risk Level**: Medium ### Vulnerable Code ```bash ### Get the gateway auth token The CLI redacts secrets in output. Read the raw config file instead: docker exec $INSTANCE cat /home/node/.openclaw/openclaw.json ``` ```bash # references/pitfalls.md:120-123 docker exec openclaw-isolated cat /home/node/.openclaw/openclaw.json ``` The instructions then direct the user to locate `gateway.auth.token` in the displayed JSON. ### Technical Analysis The Skill intentionally bypasses the application’s secret-redaction behavior by printing the entire raw configuration file. The stated objective is to retrieve one gateway token, but the command exposes every value stored in the same file. Depending on the OpenClaw configuration schema and installed integrations, this may include additional provider, channel, authentication, or operational secrets. This exceeds minimum necessary disclosure. Even when the dashboard is bound to the host loopback interface, terminal output can be retained by shell recording, copied into support requests, captured in Agent transcripts, or observed by another person. ### Attack Path 1. The user runs the documented command to retrieve the gateway token. 2. The complete raw configuration is written to the terminal. 3. Terminal logging, an Agent transcript, screen sharing, or an observer captures the output. 4. An attacker extracts the gateway token or any other credentials present in the configuration. 5. The attacker uses the token to access the dashboard where network reachability exists, potentially through local access or an SSH tunnel. 6. Any additional exposed credentials can be used against their corresponding connected services. ### Impact Assessment The immediate impact is disclosure of the gateway authentication token. Depending on wha ...[truncated 391 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not print the entire configuration file. 2. Provide or implement a narrowly scoped command that reveals only the gateway token after explicit user confirmation. 3. If the CLI intentionally redacts the token, use a secure pairing or token-rotation workflow rather than bypassing redaction. 4. Warn users not to paste secret-bearing output into Agent conversations, issue reports, or support channels. 5. Disable terminal recording and screen sharing while retrieving the token. 6. Rotate the gateway token immediately if the raw configuration has been exposed. 7. Keep the dashboard bound to the minimum reachable interface and use SSH forwarding only when needed. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (25)

Credential Access

High

• Category: Privilege Escalation

Content

```bash
cat /tmp/gog-token-export.json | \
  docker exec -i -e GOG_KEYRING_PASSWORD=openclaw-isolated \
  openclaw-isolated /home/node/.local/bin/gog auth tokens import /dev/stdin
```

• Confidence: 99% confidence
• Finding: The guide imports Google OAuth tokens into the container while providing a static keyring password via an environment variable: `GOG_KEYRING_PASSWORD=openclaw-isolated`. A hardcoded, predictable secret weakens protection of stored credentials because anyone with access to the container config, process environment, logs, or documentation can decrypt or reuse the credential store.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Clean up:

```bash
rm /tmp/gog-token-export.json
```

### Verify inside container:

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

### Clean up:

```bash
rm /tmp/gog-token-export.json
```

### Verify inside container:

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High

• Category: Privilege Escalation

Content

### Verify inside container:

```bash
docker exec -e GOG_KEYRING_PASSWORD=openclaw-isolated \
  openclaw-isolated /home/node/.local/bin/gog auth list --client isolated
```

• Confidence: 98% confidence
• Finding: This verification command again exposes reliance on a static environment-variable password for the gog keyring. Although listing auth is legitimate, the dangerous part is normalizing disclosure and reuse of a shared predictable secret that protects OAuth tokens for Google services.

Credential Access

High

• Category: Privilege Escalation

Content

-v openclaw-isolated-data:/app/data \
  -v openclaw-isolated-home:/home/node \
  -e NODE_OPTIONS="--max-old-space-size=1024" \
  -e GOG_KEYRING_PASSWORD=openclaw-isolated \
  -e GOG_CLIENT=isolated \
  -e GOG_ACCOUNT=<YOUR_BOT_EMAIL> \
  ghcr.io/openclaw/openclaw:latest

• Confidence: 100% confidence
• Finding: The `docker run` example permanently sets `GOG_KEYRING_PASSWORD=openclaw-isolated` in container configuration, making the decryption secret predictable and retrievable through Docker inspection or operational tooling. In the context of a skill that provisions a long-lived bot with Google Drive/Docs/Calendar access, this materially increases the chance of credential compromise.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
# List Drive files from inside container
docker exec -e GOG_KEYRING_PASSWORD=openclaw-isolated \
  -e GOG_CLIENT=isolated \
  openclaw-isolated /home/node/.local/bin/gog drive ls
```

• Confidence: 98% confidence
• Finding: This command repeats the same insecure secret-handling pattern during normal operation by passing the predictable keyring password through environment variables at execution time. Repetition increases the likelihood the secret appears in shell history, copied docs, screenshots, automation, and operator habits, making compromise more likely.

Credential Access

High

• Category: Privilege Escalation

Content

# Export and re-import
gog auth tokens export <YOUR_BOT_EMAIL> --client isolated --out /tmp/gog-token-export.json --overwrite
cat /tmp/gog-token-export.json | \
  docker exec -i -e GOG_KEYRING_PASSWORD=openclaw-isolated \
  openclaw-isolated /home/node/.local/bin/gog auth tokens import /dev/stdin
rm /tmp/gog-token-export.json
```

• Confidence: 99% confidence
• Finding: The maintenance workflow continues to export tokens and re-import them using the same documented static keyring password. This compounds risk over time because token refreshes are recurring operations, so insecure handling is not one-time but institutionalized in the setup process.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The file explicitly describes defeating CLI redaction to reveal an authentication token. That undermines a built-in safety control and can enable unauthorized access to the OpenClaw gateway if the token is exposed, especially given this skill’s focus on deploying a remotely reachable service with browser and Discord integration.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill instructs users to pull and run `ghcr.io/openclaw/openclaw:latest`, which is mutable and can change over time without notice. That creates a supply-chain and reproducibility risk: a later image update could introduce vulnerable or malicious code while the instructions still appear identical.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: Although the matched text is `docker run -d`, the surrounding command launches the same unpinned `ghcr.io/openclaw/openclaw:latest` image. Running a mutable image tag undermines integrity guarantees and allows silent behavior changes between installs or reinstalls.

Session Persistence

Medium

• Category: Rogue Agent

Content

> **Pitfall — OOM crash loop:** If the container keeps restarting, check logs:
> `docker logs --tail 20 $INSTANCE`
> If you see `JavaScript heap out of memory`, the container needs `-m 2048m` AND `-e NODE_OPTIONS="--max-old-space-size=1024"`. Recreate with the full command above.

> **Pitfall — port conflict:** If the port is in use, you chose the wrong `HOST_PORT` in Step 0. Re-run the conflict check: `lsof -i :$HOST_PORT`. Pick a free port and relaunch.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

Wait 10 seconds, then verify:

```bash
curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:$HOST_PORT/
```

**Success:** Returns `200`.

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The update workflow again pulls `ghcr.io/openclaw/openclaw:latest`, repeating the mutable-tag supply-chain risk. A user following the maintenance section could unknowingly upgrade to an unreviewed image with new vulnerabilities or hostile modifications.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The maintenance `docker run` example recreates the container from the same mutable image reference, so the deployment is not reproducible or auditable. This is especially relevant because the skill stores persistent auth and workspace data in volumes, increasing the value of a compromised image.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: This document materially expands the skill from Docker/OpenClaw installation into enabling persistent Gmail access, email sending, and attachment retrieval. That gives the container a new external communications and data-ingestion capability that is not necessary for basic Docker setup, increasing the attack surface and enabling sensitive data access if the agent or container is compromised.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: These steps configure a general-purpose mail client inside the container with credentials that permit reading emails, sending mail, and downloading attachments. In context, this is more dangerous because the skill is supposed to set up an isolated OpenClaw instance, yet it equips that instance with broad exfiltration and inbound file-handling capabilities that can be abused for phishing, data theft, or malicious document retrieval.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The verification step instructs the user to print the entire Himalaya configuration file, which contains the Gmail app password in cleartext. This can leak credentials to terminal scrollback, shell logging, screen recording, or support transcripts, making unauthorized mailbox access possible.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

Verify ownership (must show `node node`):

```bash
docker exec openclaw-isolated ls -la /home/node/.config/gogcli/credentials-isolated.json
```

---

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide exports OAuth tokens into `/tmp/gog-token-export.json` in plaintext and does not clearly warn that this file contains bearer-token material equivalent to account access. On multi-user systems, in backups, shell history, crash artifacts, or weak `/tmp` handling, this can expose Google Drive/Docs/Calendar access for the bot account.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The container is launched with `ghcr.io/openclaw/openclaw:latest`, which uses a mutable tag rather than an immutable digest or pinned version. This can cause supply-chain risk because future pulls may run different code than was reviewed, including a compromised or malicious image.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The documentation tells the operator to bypass secret redaction by reading the raw config file to recover `gateway.auth.token`. That directly exposes a live authentication secret and normalizes handling sensitive credentials in cleartext, increasing the chance of accidental disclosure through terminal history, screenshots, logs, or copied output.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The instructions expose `/home/node/.openclaw/openclaw.json`, which likely contains authentication tokens and other sensitive configuration, without any warning about sensitive data handling. In a setup skill, users are especially likely to copy terminal output into support channels, making disclosure more likely.

Intent-Code Divergence

Low

• Confidence: 99% confidence
• Finding: The documentation table states `CPU limit | 1 core` at L513, but the actual `docker run` commands use `--cpus=2` at L166 and again at L446. This is an active contradiction between the file's reference documentation and the commands users are instructed to run.

Static analysis

No suspicious patterns detected.