ClawHub
Back to skill

Security audit

Openclaw Remote Install

Security checks for vulnerabilities and agentic risk

Overview

This skill does perform the advertised remote OpenClaw installation work, but it uses risky SSH and installer practices that users should review before running it.

Review this before installing on production hosts. Prefer key-based SSH with verified known_hosts, avoid password mode and inline API keys, use secret references, pin versions or image digests, and do not run the curl-to-bash installer paths unless you trust the live upstream scripts and deployment channel.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/install_openclaw_remote.sh:323
Finding

Unverified Remote Installer Scripts Are Executed Directly

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/configure_openclaw_remote.py:17
Finding

Shell Command Injection Through Untrusted Configuration Values

Content
View full analysis
tuple[str, str, int]: """Execute command via SSH and return stdout, stderr, returncode.""" full_cmd = f"{ssh_cmd} '{command}'" result = subprocess.run( full_cmd, shell=True, capture_output=True, text=True ) return result.stdout, result.stderr, result.returncode ``` ```python cmd_parts = [ "openclaw onboard --non-interactive", f"--auth-choice {auth_choice}", ] if api_key: if secret_mode == "ref": env_var = f"{auth_choice.upper().replace('-', '_')}_KEY" cmd_parts.append(f"--secret-input-mode ref") print(f"Note: Set {env_var} environment variable before running") else: cmd_parts.append(f"--{auth_choice}-api-key '{api_key}'") if base_url: cmd_parts.append(f"--custom-base-url '{base_url}'") if model_id: cmd_parts.append(f"--custom-model-id '{model_id}'") cmd_parts.append("--accept-risk") full_cmd = " ".join(cmd_parts) print(f"Running: {full_cmd}") stdout, stderr, code = run_ssh_command(ssh_cmd, full_cmd) ``` ```python cmd = f"openclaw config set gateway.mode {mode}" if mode == "remote": cmd += f" && openclaw config set gateway.port {port} && openclaw config set gateway.bind {bind}" stdout, stderr, code = run_ssh_command(ssh_cmd, cmd) ``` ### Technical Analysis The program builds command strings by directly interpolating API keys, custom base URLs, model IDs, and gateway bind values. Single quotes are manually added around some values, but embedded single quotes are not escaped. The resulting SSH invocation is passed to `subprocess.run(..., shell=True)`, causing the local shell to interpret metacharacters. The remote command is also interpreted by the remote login shell. This creates multi ...[truncated 1555 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/install_openclaw_remote.sh:143
Finding

SSH Server Identity Verification Is Disabled

Content
View full analysis
/dev/null; then log_error "sshpass required for password authentication" log_info "Install: apt-get install sshpass (Debian/Ubuntu) or brew install sshpass (macOS)" exit 1 fi if [[ "$cmd_type" == "ssh" ]]; then echo "sshpass -p '$AUTH' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -p $SSH_PORT $USER@$HOST" else echo "sshpass -p '$AUTH' scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -P $SSH_PORT" fi else if [[ "$cmd_type" == "ssh" ]]; then echo "ssh -i '$AUTH' -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -p $SSH_PORT $USER@$HOST" else echo "scp -i '$AUTH' -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -P $SSH_PORT" fi fi ``` ```python if args.password_based or not args.key_based: if not args.auth: print("Error: Auth required (password or key path)") sys.exit(1) import shlex ssh_cmd = f"sshpass -p {shlex.quote(args.auth)} ssh -o StrictHostKeyChecking=no -p {args.port} {args.user}@{args.host}" else: ssh_cmd = f"ssh -i '{args.auth}' -o StrictHostKeyChecking=no -p {args.port} {args.user}@{args.host}" ``` ### Technical Analysis `StrictHostKeyChecking=no` instructs SSH to accept an unrecognized or changed host key without requiring meaningful verification. The shell installer additionally uses `UserKnownHostsFile=/dev/null`, ensuring that accepted host keys are not retained for future comparison. This removes SSH's server-authentication guarantee. Encryption alone is insufficient if the client cannot determine whether it encrypted the session to the intended server o ...[truncated 1308 chars]
Remediation
View remediation
` 5. If trust on first use is explicitly acceptable, use `StrictHostKeyChecking=accept-new`. Document that it does not protect the first connection from interception. 6. Treat a changed host key as a hard failure requiring manual or independently authenticated remediation. 7. Prefer host certificates signed by a trusted SSH certificate authority for scalable deployments. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/configure_openclaw_remote.py:62
Finding

SSH Passwords and Provider API Keys Are Exposed in Process Arguments and Output

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (26)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

This mismatch hides materially dangerous behaviors such as password-based SSH, disabled host key verification, and execution of remote scripts fetched over the network. When documentation omits or downplays those actions, users may authorize the skill without understanding that it can expose credentials, enable MITM attacks, and run untrusted code on remote systems.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

This mismatch hides materially dangerous behaviors such as password-based SSH, disabled host key verification, and execution of remote scripts fetched over the network. When documentation omits or downplays those actions, users may authorize the skill without understanding that it can expose credentials, enable MITM attacks, and run untrusted code on remote systems.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

This remote-install skill is especially dangerous because it is explicitly designed to connect to external systems over SSH and execute administrative commands. Using shell=True with attacker-influenced parameters in this context turns the script into a potential command-execution primitive against the operator machine, and the broad deployment context increases blast radius across multiple hosts.

Content

Scanner excerpt · scripts/configure_openclaw_remote.py (reported line 19)May include surrounding context.

python
def run_ssh_command(ssh_cmd: str, command: str) -> tuple[str, str, int]:
    """Execute command via SSH and return stdout, stderr, returncode."""
    full_cmd = f"{ssh_cmd} '{command}'"
    result = subprocess.run(
        full_cmd, shell=True, capture_output=True, text=True
    )
    return result.stdout, result.stderr, result.returncode

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md
Examples:
  # Auto-detect best method
  $0 root@server.com user ~/.ssh/id_rsa

  # Async installation with monitoring
  $0 root@server.com user ~/.ssh/id_rsa --async

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

md
Examples:
  # Auto-detect best method
  $0 root@server.com user ~/.ssh/id_rsa

  # Async installation with monitoring
  $0 root@server.com user ~/.ssh/id_rsa --async

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install_openclaw_remote.sh (reported line 96)May include surrounding context.

sh
Examples:
  # Auto-detect best method
  $0 root@server.com user ~/.ssh/id_rsa

  # Async installation with monitoring
  $0 root@server.com user ~/.ssh/id_rsa --async

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install_openclaw_remote.sh (reported line 99)May include surrounding context.

sh
Examples:
  # Auto-detect best method
  $0 root@server.com user ~/.ssh/id_rsa

  # Async installation with monitoring
  $0 root@server.com user ~/.ssh/id_rsa --async

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/install_openclaw_remote.sh (reported line 102)May include surrounding context.

sh
Examples:
  # Auto-detect best method
  $0 root@server.com user ~/.ssh/id_rsa

  # Async installation with monitoring
  $0 root@server.com user ~/.ssh/id_rsa --async

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The script fetches https://openclaw.ai/install-cli.sh and pipes it directly to bash on the remote host. This gives the remote content full code-execution privileges during installation; if the host, CDN, TLS chain, DNS, or upstream script is compromised, an attacker can execute arbitrary commands on target servers at scale.

Content

Scanner excerpt · scripts/install_openclaw_remote.sh (reported line 325)May include surrounding context.

sh
cli|install-cli)
            log_info "Preparing install-cli.sh installation..."
            install_cmd="curl -fsSL https://openclaw.ai/install-cli.sh | bash -s -- --version $VERSION"
            if [[ "$NON_INTERACTIVE" == "true" ]]; then
                install_cmd="$install_cmd --no-onboard"
            fi

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The main installer path downloads https://openclaw.ai/install.sh and executes it directly with bash, creating an unverified remote code execution path on every target system. Because this skill is explicitly for one-click remote deployment across servers, the blast radius is high: a single upstream compromise could lead to broad fleet compromise.

Content

Scanner excerpt · scripts/install_openclaw_remote.sh (reported line 333)May include surrounding context.

sh
installer|*)
            log_info "Preparing installer script installation..."
            install_cmd="curl -fsSL https://openclaw.ai/install.sh | bash -s --"
            if [[ "$VERSION" != "latest" ]]; then
                install_cmd="$install_cmd --version $VERSION"
            fi

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill advertises and documents shell-based remote installation behavior but does not declare any explicit tool scope or permissions boundary. That increases the chance that an agent or reviewer will underestimate its ability to execute commands against local or remote systems, which is especially risky for an SSH-based installer.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation promotes one-click remote installation and automation without a clear warning that it will make changes to the target machine. In the context of an SSH installer, that omission is risky because users may invoke it on production hosts without realizing it performs privileged or persistent system modifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Documenting password-based remote installation without strong credential-handling warnings normalizes a weaker authentication path for administrative access. In this context, passwords may be exposed via shell history, process arguments, logs, or automation systems, making remote compromise more likely if operational hygiene is poor.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Offering plaintext secret storage as an option without a prominent warning can lead users to persist API keys directly in configuration files. In a remote-install/configuration workflow, that raises the chance of credential leakage through backups, logs, file sharing, or host compromise.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

bash
# Check key permissions
chmod 600 ~/.ssh/id_rsa

# Add to ssh-agent
ssh-add ~/.ssh/id_rsa

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
98% confidence
Finding

The script constructs a shell command by concatenating ssh_cmd and a quoted remote command, then executes it with subprocess.run(..., shell=True). Because multiple inputs that feed ssh_cmd and command are user-controlled and not robustly shell-escaped across both local and remote shell contexts, this creates command-injection risk on the local machine and potentially malformed execution on the remote host.

Content

Scanner excerpt · scripts/configure_openclaw_remote.py (reported line 19)May include surrounding context.

python
def run_ssh_command(ssh_cmd: str, command: str) -> tuple[str, str, int]:
    """Execute command via SSH and return stdout, stderr, returncode."""
    full_cmd = f"{ssh_cmd} '{command}'"
    result = subprocess.run(
        full_cmd, shell=True, capture_output=True, text=True
    )
    return result.stdout, result.stderr, result.returncode

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script prints the full generated openclaw onboard command, and in plaintext mode that command includes the API key inline. This can leak credentials to terminal history, logs, CI output, monitoring systems, or other users with access to the process/session output.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The docstring for update_config_file states that it will update the OpenClaw config file directly. In reality, the implementation only retrieves the current config, prints it along with the requested updates, and explicitly notes that direct update is just a placeholder, so the documented intent contradicts actual behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script accepts an SSH password and embeds it directly in an sshpass -p ... command string. Even with quoting, putting secrets on the command line risks exposure through process listings, shell history, audit logs, crash reports, and other system telemetry.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/install_openclaw_remote.sh (reported line 57)May include surrounding context.

sh
LOG_DIR="$HOME/.openclaw/remote-install-logs/${host_safe}_${timestamp}"
    fi
    
    mkdir -p "$LOG_DIR"
    LOG_FILE="$LOG_DIR/install.log"
    
    # Create symlink to latest

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

For password-based authentication, the script constructs an sshpass -p '...password...' command string and later executes it. Supplying secrets on the command line exposes them to local process listing, shell history/logging risks, and quoting/injection issues if the password contains shell metacharacters; this is made more dangerous by the script's remote-admin use case.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The code logs Installing Docker first... and sets install_cmd to a Docker installer, but then immediately overwrites install_cmd with docker run ..., so Docker is never actually installed in this branch. The comment/log intent contradicts the effective behavior, which assumes Docker is already present.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
86% confidence
Finding

The Docker deployment uses a floating image reference (openclawai/openclaw:latest) rather than a pinned digest or immutable version. This allows unexpected or malicious upstream image changes to be pulled during remote installation, which is especially risky because the script is intended for unattended deployment onto remote servers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This script performs safety-impacting remote actions including package installation, container startup, execution of curl-piped installer scripts, and optional remote configuration. While it logs progress, it does not clearly warn the user that it will modify the remote system, fetch and execute remote scripts, and potentially change services or packages before proceeding.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
93% confidence
Finding

The script includes a curl ... | sh pattern to install Docker from a remote URL with no signature or checksum verification. Even though the current control flow appears to overwrite this command later, the pattern is inherently dangerous and could lead to arbitrary code execution on the remote host if used or reintroduced; in a remote installer context, this materially raises supply-chain risk.

Content

Scanner excerpt · scripts/install_openclaw_remote.sh (reported line 284)May include surrounding context.

sh
# Check if Docker is available
            if ! $SSH_CMD "command -v docker &> /dev/null" 2>/dev/null; then
                log_info "Installing Docker first..."
                install_cmd="curl -fsSL https://get.docker.com | sh"
            fi
            # Run OpenClaw Docker
            install_cmd="docker run -d --name openclaw \

Static analysis

No suspicious patterns detected.