ClawHub
Back to skill

Security audit

Closeli Open Device status Query

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do the disclosed job of checking Closeli device status, but it handles an API key and device metadata so users should keep the configuration locked down.

Install only if you trust the Closeli gateway configuration. Keep ~/.openclaw/.env permission-restricted, use a least-privilege API key, avoid passing keys on the command line, leave TLS verification enabled, and verify AI_GATEWAY_HOST before running the skill.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Credential Access

High
Category
Privilege Escalation
Content
openclaw:
    requires:
      bins: ["python3"]
      configPaths: ["~/.openclaw/.env"]
    primaryEnv: "AI_GATEWAY_API_KEY"
---
Confidence
85% confidence
Finding
The skill requires reading a shared persistent credential file at `~/.openclaw/.env`, which exposes API secrets to any skill running as the same user. Even though this is documented and intended for authentication, centralizing secrets in a broadly readable file increases the blast radius if another skill is compromised or malicious.

Credential Access

High
Category
Privilege Escalation
Content
def get_api_host(env_vars):
    """
    获取网关地址：~/.openclaw/.env 中的 AI_GATEWAY_HOST，未配置则用默认值。
    """
    host = env_vars.get("AI_GATEWAY_HOST")
    return host.rstrip("/") if host else DEFAULT_API_HOST
Confidence
84% confidence
Finding
Allowing the API host to be taken from a shared local config file can redirect authenticated requests, including the Bearer token, to an attacker-controlled endpoint if that file is tampered with. In this skill context, the script automatically sends the API key in the Authorization header, so host override materially increases the chance of credential exfiltration and misuse.

Credential Access

High
Category
Privilege Escalation
Content
def get_verify_ssl(env_vars):
    """
    判断是否启用 TLS 证书验证。默认启用。
    仅当 ~/.openclaw/.env 中显式设置 AI_GATEWAY_VERIFY_SSL=false 时禁用（仅开发环境）。
    """
    val = env_vars.get("AI_GATEWAY_VERIFY_SSL", "true").lower()
    return val not in ("false", "0", "no")
Confidence
93% confidence
Finding
The script permits disabling TLS certificate verification via shared config. If an attacker can influence the config or network path, requests carrying the Bearer token can be intercepted or redirected through man-in-the-middle infrastructure, exposing credentials and device data.

Credential Access

High
Category
Privilege Escalation
Content
def main():
    parser = argparse.ArgumentParser(description="查询设备状态")
    parser.add_argument("--api-key", help="API Key 临时覆盖；持久化请写到 ~/.openclaw/.env")
    parser.add_argument("--device-ids", required=True, help="设备 ID 列表，逗号分隔")
    args = parser.parse_args()
Confidence
78% confidence
Finding
Accepting the API key via command-line argument can expose the secret to other local users or logging systems through shell history, process listings, job control tools, and audit logs. In an agent skill setting, secrets passed as arguments are often more likely to be captured by orchestration or telemetry than secrets read from a protected file.

Session Persistence

Medium
Category
Rogue Agent
Content
### Configuration Source

The script reads `~/.openclaw/.env` as the single persistent configuration source. This file is shared by all skills and uses the format `KEY=VALUE` (one entry per line). OpenClaw clients write to this file when the user updates settings. The script does NOT read any `AI_GATEWAY_*` environment variables — env variables are intentionally ignored to avoid stale Gateway-process snapshots overriding the user's latest config.

## Security Notes
Confidence
83% confidence
Finding
The skill relies on a single persistent shared `.env` file as the authoritative configuration source across skills and explicitly ignores process environment overrides. This creates session persistence and cross-skill coupling: stale, poisoned, or maliciously modified values can affect future runs and all skills sharing that file.

Unsafe Defaults

Medium
Category
Tool Misuse
Content
def get_verify_ssl(env_vars):
    """
    判断是否启用 TLS 证书验证。默认启用。
    仅当 ~/.openclaw/.env 中显式设置 AI_GATEWAY_VERIFY_SSL=false 时禁用（仅开发环境）。
    """
    val = env_vars.get("AI_GATEWAY_VERIFY_SSL", "true").lower()
    return val not in ("false", "0", "no")
Confidence
95% confidence
Finding
Permitting VERIFY_SSL=false is an unsafe transport default/escape hatch for a script that transmits Bearer credentials and sensitive device status data. In this context, even a local config change can silently downgrade transport security and enable interception, spoofing, or credential theft.

Static analysis

No suspicious patterns detected.