ClawHub
Back to skill

Security audit

oauth-coder-bridge

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed local bridge that routes OpenClaw requests through a locally authenticated Claude CLI session, with sensitive but purpose-aligned behavior.

Install only if you trust oauth-coder and the Claude CLI session on this machine. Keep the bridge bound to 127.0.0.1, review the ~/.openclaw/openclaw.json change, avoid sensitive logging, and enable systemd autostart only if you intentionally want this OAuth-backed local bridge running across sessions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# Execute with timeout
        try:
            result = subprocess.run(
                cmd,
                capture_output=True,
                text=True,
Confidence
92% confidence
Finding
The bridge executes an external binary on every HTTP request using subprocess.run, passing attacker-influenced prompt content directly to a privileged local CLI that likely has OAuth-backed access and tool capabilities. Even without shell=True, this creates a powerful trust-boundary crossing: remote users can drive local agent behavior and potentially trigger sensitive actions through the oauth-coder toolchain.

Tainted flow: 'cmd' from os.environ.get (line 252, credential/environment) → subprocess.run (code execution)

Medium
Category
Data Flow
Content
# Execute with timeout
        try:
            result = subprocess.run(
                cmd,
                capture_output=True,
                text=True,
Confidence
95% confidence
Finding
The executable path comes from OAUTH_CODER_BIN, an environment-controlled value, and is then executed via subprocess.run. If an attacker can influence environment variables or deployment configuration, they can replace the intended binary with an arbitrary program, yielding direct code execution in the bridge's security context.

Lp3

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding
The skill documentation describes capabilities including environment access, file read/write, network exposure, and shell/subprocess execution, but does not declare any permissions or constraints. This creates a transparency and trust problem: users may install and run a skill that modifies configuration, launches a local HTTP service, and invokes authenticated CLI tooling without an explicit permission model or warning surface.

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
bash scripts/setup.sh              # copies bridge, adds claude-cli provider to openclaw.json
python3 ~/.openclaw/scripts/oauth-coder-bridge.py &
# Or: systemctl --user enable --now oauth-coder-bridge
```

## Verify
Confidence
80% confidence
Finding
The skill suggests enabling a persistent user-level systemd service, which causes the bridge to continue running across sessions. In context, the bridge exposes a local HTTP endpoint that forwards prompts to an authenticated Claude CLI, so persistence increases the attack window and the chance of unintended long-lived access to the user's OAuth-backed model session.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.