T09 · Insecure Skill Coding Practices
- Location
scripts/lib/openclaw.sh:3- Finding
OpenClaw Status Requests Disable TLS Certificate Verification
- Content
View full analysis
Vulnerability Details
File Location:
scripts/lib/openclaw.sh:3-9
Vulnerability Type: Improper certificate validation
Risk Level: HighVulnerable Code:
sh openclaw_status_via_cli() { if ! command_exists claw; then return 1 fi NODE_TLS_REJECT_UNAUTHORIZED=0 claw skill my >/tmp/skillup-openclaw-status.out 2>/tmp/skillup-openclaw-status.log || true return 0 }Technical Analysis
NODE_TLS_REJECT_UNAUTHORIZED=0instructs Node.js to accept TLS certificates without validating their trust chain or hostname. The setting applies to the entireclawchild process and therefore affects every HTTPS request made while executingclaw skill my.The status command may use credentials or session state maintained by the OpenClaw CLI. Disabling certificate validation allows an active network attacker to impersonate the remote service with an untrusted certificate. The attacker could inspect authenticated requests, return forged status data, or potentially capture reusable authentication material depending on how the CLI authenticates.
Disabling TLS verification is not necessary for the declared status or publishing functionality and exceeds the minimum safe network privileges required by the Skill.
Attack Path
- The victim has the
clawCLI installed and authenticated. - The attacker obtains a network interception position, such as control of a hostile Wi-Fi access point, proxy, DNS response, or compromised gateway.
- The victim invokes SkillUp in a workflow that performs OpenClaw status checks.
- SkillUp launches
claw skill mywithNODE_TLS_REJECT_UNAUTHORIZED=0. - The attacker presents an untrusted certificate and impersonates the OpenClaw endpoint.
- The CLI accepts the certificate and communicates with the attacker-controlled endpoint.
- The attacker observes any authentication data sent by the CLI and can return manipulated status information.
Impact
...[truncated 626 chars]
- The victim has the
- Remediation
View remediation
Remediation Suggestions
-
Remove
NODE_TLS_REJECT_UNAUTHORIZED=0and execute the CLI with normal certificate validation:sh claw skill my >"$status_output" 2>"$status_log" -
Correct the underlying certificate or trust-store problem instead of bypassing validation.
-
If the service uses a private certificate authority, support an explicit trusted CA bundle through an option such as
NODE_EXTRA_CA_CERTS, after validating the configured CA file. -
Fail closed when certificate verification fails and report the TLS failure to the user.
-
Do not automatically retry the request with weaker TLS settings.
-
Add a regression test that verifies the command rejects endpoints presenting invalid, expired, or hostname-mismatched certificates.
-