Security audit
xiaozhi-mcp-server
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its stated purpose (bridging a Xiaozhi speaker to OpenClaw) but has a few mismatches and operational risks you should understand before installing.
What to check before installing: - Confirm you have and trust the local 'openclaw' CLI: server.py runs 'openclaw agent --message ... --deliver'. The skill executes that binary on your machine; any capabilities or credentials the 'openclaw' CLI has will be used. If you don't have that binary installed, the skill will fail or may attempt to run a different binary named 'openclaw' if present. - Be aware of required host commands: the server uses 'timeout' and expects Python 3.8+ and aiohttp/pyyaml. start.sh auto-installs aiohttp via pip if missing; decide if you accept automatic pip installs in your environment or prefer to install dependencies in a virtualenv. - Network exposure & token: the service binds an HTTP and WS endpoint (default port 28765 per config.yaml, start.sh uses env XIAOZHI_MCP_PORT). It creates a token under ~/.config/openclaw-mcp/token for auth. If you expose the port to untrusted networks, rotate the token and protect the host firewall. Consider binding to localhost or using a reverse proxy with TLS if exposing to WAN. - Run it in a restricted account or container: because it will execute local commands on incoming messages (even though inputs are sanitized), run the service as a non-privileged user or in an isolated container to limit blast radius. - Inspect and test locally: review server.py (especially the subprocess invocation and file writes) and test in a controlled environment. If you rely on the OpenClaw CLI, audit that binary and its configuration to understand what actions incoming messages can trigger. If you want, I can list the exact lines where the subprocess call and token file creation occur, or suggest a safer start command that uses a virtualenv and explicit dependency installation.
Static analysis
No suspicious patterns detected.