Security audit

Create New Openclaw Instance on GCP VM

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real cloud deployment guide, but it asks users to run mutable remote installers and a persistent service with sensitive credentials and weak SSH setup.

Review each command before running it, use a dedicated disposable VM and least-privileged cloud project, pin and verify installer and npm package versions, restrict SSH source ranges or use a safer SSH path, and plan how to rotate credentials and remove the daemon.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:45
Finding: Unverified Tailscale Installer Is Downloaded and Executed Directly
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:56
Finding: Unverified NVM Installer Is Downloaded and Executed Directly
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:58
Finding: Unpinned Latest OpenClaw Package Executes an Unreviewed Dependency Release
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:41
Finding: SSH Host Identity Verification Is Disabled During Initial Provisioning
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:67
Finding: Unverified OpenClaw Code Is Installed as a Persistent User Daemon
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
md
--machine-type=e2-medium \ --image-family=debian-12 --image-project=debian-cloud \ --boot-disk-size=10GB \ --metadata=ssh-keys="${OPENCLAW_USERNAME}:$(cat ~/.ssh/id_ed25519.pub)" IP=$(gcloud compute instances describe "$VM" \ --project="$OPENCLAW_PROJECT_ID" --zone="$ZONE" \

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The skill downloads and executes a remote installer script from tailscale.com via a shell pipe without integrity verification. If the remote content, DNS, TLS trust chain, or network path is compromised, arbitrary code executes on the VM with root-level effects due to the installation context.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
sleep 30 ssh -o StrictHostKeyChecking=no "${OPENCLAW_USERNAME}@${IP}" " set -euo pipefail sudo apt-get update && sudo apt-get install -y git curl ufw jq curl -fsSL https://tailscale.com/install.sh | sh "

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
sleep 30 ssh -o StrictHostKeyChecking=no "${OPENCLAW_USERNAME}@${IP}" " set -euo pipefail sudo apt-get update && sudo apt-get install -y git curl ufw jq curl -fsSL https://tailscale.com/install.sh | sh "

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
sleep 30 ssh -o StrictHostKeyChecking=no "${OPENCLAW_USERNAME}@${IP}" " set -euo pipefail sudo apt-get update && sudo apt-get install -y git curl ufw jq curl -fsSL https://tailscale.com/install.sh | sh "

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Piping curl output directly to sh executes untrusted remote content immediately and removes any opportunity for review or integrity validation. In a provisioning script this can lead to full host compromise through arbitrary command execution.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
ssh -o StrictHostKeyChecking=no "${OPENCLAW_USERNAME}@${IP}" " set -euo pipefail sudo apt-get update && sudo apt-get install -y git curl ufw jq curl -fsSL https://tailscale.com/install.sh | sh " # Manual: authorize Tailscale

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
# Continue setup ssh "${OPENCLAW_USERNAME}@${IP}" " set -euo pipefail sudo ufw allow 22/tcp && sudo ufw allow in on tailscale0 && echo y | sudo ufw enable echo 'nameserver 8.8.8.8' | sudo tee -a /etc/resolv.conf curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash source ~/.nvm/nvm.sh && nvm install 22

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
md
# Continue setup ssh "${OPENCLAW_USERNAME}@${IP}" " set -euo pipefail sudo ufw allow 22/tcp && sudo ufw allow in on tailscale0 && echo y | sudo ufw enable echo 'nameserver 8.8.8.8' | sudo tee -a /etc/resolv.conf curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash source ~/.nvm/nvm.sh && nvm install 22

Chaining Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: Piping remote content directly to bash is unsafe because it executes whatever the network returns at that moment. This creates an avoidable arbitrary-code-execution path during setup.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
set -euo pipefail sudo ufw allow 22/tcp && sudo ufw allow in on tailscale0 && echo y | sudo ufw enable echo 'nameserver 8.8.8.8' | sudo tee -a /etc/resolv.conf curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash source ~/.nvm/nvm.sh && nvm install 22 source ~/.nvm/nvm.sh && npm install -g openclaw@latest "

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
sleep 30 ssh -o StrictHostKeyChecking=no "${OPENCLAW_USERNAME}@${IP}" " set -euo pipefail sudo apt-get update && sudo apt-get install -y git curl ufw jq curl -fsSL https://tailscale.com/install.sh | sh "

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
sleep 30 ssh -o StrictHostKeyChecking=no "${OPENCLAW_USERNAME}@${IP}" " set -euo pipefail sudo apt-get update && sudo apt-get install -y git curl ufw jq curl -fsSL https://tailscale.com/install.sh | sh "

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
sleep 30 ssh -o StrictHostKeyChecking=no "${OPENCLAW_USERNAME}@${IP}" " set -euo pipefail sudo apt-get update && sudo apt-get install -y git curl ufw jq curl -fsSL https://tailscale.com/install.sh | sh "

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
md
sleep 30 ssh -o StrictHostKeyChecking=no "${OPENCLAW_USERNAME}@${IP}" " set -euo pipefail sudo apt-get update && sudo apt-get install -y git curl ufw jq curl -fsSL https://tailscale.com/install.sh | sh "

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
md
sleep 30 ssh -o StrictHostKeyChecking=no "${OPENCLAW_USERNAME}@${IP}" " set -euo pipefail sudo apt-get update && sudo apt-get install -y git curl ufw jq curl -fsSL https://tailscale.com/install.sh | sh "

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: These instructions make significant host changes including firewall reconfiguration, DNS modification, package installation, and service setup without a prominent warning about side effects. While not inherently malicious, this can lead users to break networking or weaken system hygiene unintentionally.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 87% confidence
Finding: The instructions persist the Brave API key in a systemd user drop-in on disk so it survives reboots. Even with mode 600, long-lived plaintext secret storage increases the blast radius of local account compromise and may expose the key through backups or support snapshots.
Content: Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.
md
# Add Brave key + enable Tailscale auth ssh "${OPENCLAW_USERNAME}@${IP}" " set -euo pipefail mkdir -p ~/.config/systemd/user/openclaw-gateway.service.d cat > ~/.config/systemd/user/openclaw-gateway.service.d/brave.conf << CONF [Service] Environment=\"BRAVE_API_KEY=\$(cat)\"

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
md
[Service] Environment=\"BRAVE_API_KEY=\$(cat)\" CONF chmod 600 ~/.config/systemd/user/openclaw-gateway.service.d/brave.conf systemctl --user daemon-reload source ~/.nvm/nvm.sh jq '.gateway.auth.allowTailscale = true' ~/.openclaw/openclaw.json > /tmp/oc.json

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
md
[Service] Environment=\"BRAVE_API_KEY=\$(cat)\" CONF chmod 600 ~/.config/systemd/user/openclaw-gateway.service.d/brave.conf systemctl --user daemon-reload source ~/.nvm/nvm.sh jq '.gateway.auth.allowTailscale = true' ~/.openclaw/openclaw.json > /tmp/oc.json

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
md
[Service] Environment=\"BRAVE_API_KEY=\$(cat)\" CONF chmod 600 ~/.config/systemd/user/openclaw-gateway.service.d/brave.conf systemctl --user daemon-reload source ~/.nvm/nvm.sh jq '.gateway.auth.allowTailscale = true' ~/.openclaw/openclaw.json > /tmp/oc.json

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The security note is misleading because it states the gateway is exposed only via Tailscale while the instructions also explicitly allow SSH on port 22 from the public internet. Misstated security properties can cause operators to underestimate the attack surface and deploy the system with weaker monitoring and access controls.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: The skill fetches and immediately executes the nvm installer from GitHub without integrity verification. This exposes the host to arbitrary code execution if the fetched content or delivery path is tampered with.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
set -euo pipefail sudo ufw allow 22/tcp && sudo ufw allow in on tailscale0 && echo y | sudo ufw enable echo 'nameserver 8.8.8.8' | sudo tee -a /etc/resolv.conf curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash source ~/.nvm/nvm.sh && nvm install 22 source ~/.nvm/nvm.sh && npm install -g openclaw@latest "

Static analysis

No suspicious patterns detected.