Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says, but it exposes an OAuth-backed Claude bridge with weak access controls and persistent/local configuration changes that users should review before installing.
Install only if you intend to run a local Claude OAuth bridge. Keep it bound to 127.0.0.1, do not expose port 8787 through a proxy or container port mapping, review changes to ~/.openclaw/openclaw.json, and avoid enabling auto-start unless you understand how to stop and remove the service.
scripts/oauth-coder-bridge.py:21Unauthenticated OAuth-backed bridge can be exposed on a non-loopback interface
scripts/oauth-coder-bridge.py:143Untrusted X-Forwarded-For values allow rate-limit bypass
scripts/oauth-coder-bridge.py:342Model-generated calls to undeclared tools are forwarded as valid tool requests
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
# Remove null bytes and control characters
prompt = re.sub(r'[\x00-\x08\x0b-\x0c\x0e-\x1f]', '', prompt)
return prompt
def validate_json_schema(obj: Any, max_depth: int = 10, current_depth: int = 0) -> bool:
The skill documents installation and operation of scripts that can read environment variables, modify local files/configuration, invoke shell commands, and expose a local network service, but it declares no explicit tool scope or permissions. This is dangerous because consumers and agent frameworks cannot accurately constrain or review the capability boundary, increasing the risk of over-privileged execution and unsafe deployment of the bridge and installer scripts.
The skill suggests enabling the bridge as a persistent user service with systemd, causing it to start automatically and continue running beyond the initial session. Persistence is security-relevant because it increases attack surface over time, may keep OAuth-backed model access continuously available on localhost, and can survive user forgetfulness or changes in trust in the skill.
bash scripts/setup.sh # copies bridge, adds claude-cli provider to openclaw.json
python3 ~/.openclaw/scripts/oauth-coder-bridge.py &
# Or: systemctl --user enable --now oauth-coder-bridge
This service forwards user-supplied HTTP request content to an external local CLI process, which may transmit prompts, tool definitions, and embedded data to another component or remote model backend. Without explicit disclosure, callers may unknowingly send sensitive data outside the immediate HTTP service boundary, creating confidentiality and compliance risks.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
# Execute with timeout
try:
result = subprocess.run(
cmd,
capture_output=True,
text=True,
The executable path comes from OAUTH_CODER_BIN, an environment variable, and is then invoked as a subprocess without integrity checks beyond file existence. If an attacker can influence the service environment, startup wrapper, or deployment config, they can redirect execution to an arbitrary local binary/script and gain code execution in the bridge process context.
# Execute with timeout
try:
result = subprocess.run(
cmd,
capture_output=True,
text=True,
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
SKILL_DIR="$(dirname "$SCRIPT_DIR")"
# Copy bridge script to ~/.openclaw/scripts
mkdir -p ~/.openclaw/scripts
cp "$SCRIPT_DIR/oauth-coder-bridge.py" ~/.openclaw/scripts/
chmod +x ~/.openclaw/scripts/oauth-coder-bridge.py
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
echo " python3 ~/.openclaw/scripts/oauth-coder-bridge.py &"
echo ""
echo "Or enable systemd auto-start:"
echo " systemctl --user enable --now oauth-coder-bridge"
The script writes directly to the user's ~/.openclaw/openclaw.json in place without prompting, creating a backup, or performing any validation before replacement. In a skill that modifies a user-specific configuration file, this can unintentionally destroy existing settings or leave the application misconfigured if the write is interrupted or the generated structure is incompatible.
Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.
# Setup logging
log_format = "%(asctime)s | %(levelname)s | %(message)s"
logging.basicConfig(
level=getattr(logging, LOG_LEVEL.upper()),
format=log_format,
handlers=[
logging.StreamHandler(sys.stderr),