ClawHub
Back to skill

Security audit

Failover Gateway Pub

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate failover setup guide, but it needs Review because it installs a persistent root-level monitor and uses unverified remote installer commands.

Review before installing on a real server. Prefer verified package repositories or pinned checksums instead of curl-pipe installers, run the monitor under a dedicated least-privilege account with systemd hardening, avoid broad sudo access, use authenticated health checks, and treat optional secret rsync as sensitive production credential handling.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:71
Finding

Remote Tailscale Installer Is Executed Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:79
Finding

Remote NVM Installer Is Executed Without Cryptographic Verification

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:142
Finding

Boot-Persistent Health Monitor Runs With Unrestricted Root Privileges

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:79
Finding

Unpinned Node.js and Global OpenClaw Installation Expose the Deployment to Supply-Chain Changes

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/health-monitor.sh:24
Finding

Failover State Is Controlled by an Unauthenticated Plaintext HTTP Health Check

Content
View full analysis
/dev/null } ``` ```bash while true; do if check_primary; then if [ "$PROMOTED" = true ]; then demote fi FAIL_COUNT=0 else if [ "$PROMOTED" = false ]; then FAIL_COUNT=$((FAIL_COUNT + 1)) log "Primary check FAILED (${FAIL_COUNT}/${FAIL_THRESHOLD})" if [ "$FAIL_COUNT" -ge "$FAIL_THRESHOLD" ]; then promote fi fi fi sleep "$CHECK_INTERVAL" done ``` ### Technical Analysis The monitor uses plaintext HTTP and treats any response accepted by `curl -f` as proof that the primary gateway is healthy. It discards the response body and performs no application-level authentication, expected-content validation, or cryptographic endpoint verification. Tailscale normally encrypts tailnet traffic, which reduces exposure when the configured address is exclusively reached through a correctly secured tailnet. However, the script also documents the address as a Tailscale or LAN address. On an untrusted LAN, with unsafe routing, or after compromise of another reachable host, endpoint spoofing or traffic manipulation may affect the failover decision. A forged successful response can suppress promotion or force a promoted standby to demote. Blocking health traffic can cause promotion while the primary remains operational. ### Attack Path 1. An attacker gains a position from which traffic to the configured primary address can be intercepted, redirected, blocked, or impersonated. 2. To suppress failover, the attacker returns any successful HTTP status at `/health`, even when the real primary is unavailab ...[truncated 815 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (18)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The guide instructs users to fetch and execute a remote installer script directly from the network using a shell pipe. If the source, transport, DNS, or upstream account is compromised, arbitrary code runs immediately on the standby host, likely with elevated privileges during setup.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

Copy your SSH key to openclaw user

Install Tailscale

curl -fsSL https://tailscale.com/install.sh | sh tailscale up --hostname=your-failover-name

text

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

Piping curl output directly into sh removes opportunities for inspection and compounds the supply-chain risk by turning a network response into immediate code execution. In a deployment guide for infrastructure nodes, this is especially dangerous because compromise of the failover host can undermine resilience and expose secrets or tokens.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

Copy your SSH key to openclaw user

Install Tailscale

curl -fsSL https://tailscale.com/install.sh | sh tailscale up --hostname=your-failover-name

text

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

Using curl piped to bash for the nvm install similarly enables instant execution of unverified remote content. The risk is somewhat lower than a root-level installer if run as an unprivileged user, but it can still compromise the openclaw account, workspace, tokens, and subsequent operational workflows.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

bash
# As openclaw user
curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash
source ~/.bashrc
nvm install --lts
npm install -g openclaw

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill contains multiple shell commands, privileged operations, and service-management steps but does not declare any tool scope or permissions boundary. In an agent ecosystem, this increases the chance that automation executes impactful system changes without explicit user awareness or policy enforcement.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

Copy the included scripts/health-monitor.sh to the standby:

bash
sudo cp health-monitor.sh /usr/local/bin/openclaw-health-monitor.sh
sudo chmod +x /usr/local/bin/openclaw-health-monitor.sh

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

Copy the included scripts/health-monitor.sh to the standby:

bash
sudo cp health-monitor.sh /usr/local/bin/openclaw-health-monitor.sh
sudo chmod +x /usr/local/bin/openclaw-health-monitor.sh

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

Copy the included scripts/health-monitor.sh to the standby:

bash
sudo cp health-monitor.sh /usr/local/bin/openclaw-health-monitor.sh
sudo chmod +x /usr/local/bin/openclaw-health-monitor.sh

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

Copy the included scripts/health-monitor.sh to the standby:

bash
sudo cp health-monitor.sh /usr/local/bin/openclaw-health-monitor.sh
sudo chmod +x /usr/local/bin/openclaw-health-monitor.sh

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

Copy the included scripts/health-monitor.sh to the standby:

bash
sudo cp health-monitor.sh /usr/local/bin/openclaw-health-monitor.sh
sudo chmod +x /usr/local/bin/openclaw-health-monitor.sh

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.

Copy the included scripts/health-monitor.sh to the standby:

bash
sudo cp health-monitor.sh /usr/local/bin/openclaw-health-monitor.sh
sudo chmod +x /usr/local/bin/openclaw-health-monitor.sh

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

Copy the included scripts/health-monitor.sh to the standby:

bash
sudo cp health-monitor.sh /usr/local/bin/openclaw-health-monitor.sh
sudo chmod +x /usr/local/bin/openclaw-health-monitor.sh

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

bash
sudo systemctl daemon-reload
sudo systemctl enable openclaw-health-monitor
sudo systemctl start openclaw-health-monitor
# Do NOT enable openclaw.service — the monitor controls it

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The test procedure tells the operator to stop the primary gateway to simulate failure but does not clearly warn that this intentionally disrupts production service and may trigger user-visible downtime or message loss. In a high-availability guide, destructive validation is legitimate, but omitting an explicit disruption warning makes accidental unsafe execution more likely.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/health-monitor.sh (reported line 27)May include surrounding context.

sh
log() { logger -t "$LOG_TAG" "$1"; echo "$(date -Is) $1"; }

check_primary() {
    curl -sf -o /dev/null --connect-timeout 5 \
        "http://${PRIMARY_IP}:${PRIMARY_PORT}/health" 2>/dev/null
}

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
# Pull latest workspace from git (best effort)
    if [ -d "$WORKSPACE/.git" ]; then
        cd "$WORKSPACE"
        sudo -u "$OPENCLAW_USER" git pull --ff-only 2>&1 | logger -t "$LOG_TAG" \
            || log "WARNING: git pull failed, using last sync"
    fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/health-monitor.sh (reported line 37)May include surrounding context.

sh
# Pull latest workspace from git (best effort)
    if [ -d "$WORKSPACE/.git" ]; then
        cd "$WORKSPACE"
        sudo -u "$OPENCLAW_USER" git pull --ff-only 2>&1 | logger -t "$LOG_TAG" \
            || log "WARNING: git pull failed, using last sync"
    fi

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
90% confidence
Finding

The script automatically rsyncs secrets from a remote host during promotion without any visible integrity verification, host key pinning, or restriction on what is synchronized. In a failover context this is more dangerous because compromise, misconfiguration, or spoofing of SECRETS_HOST could poison the standby with attacker-controlled credentials or overwrite local secret material right before service startup.

Content

Scanner excerpt · scripts/health-monitor.sh (reported line 43)May include surrounding context.

sh
# Sync secrets from remote host (optional, best effort)
    if [ -n "$SECRETS_HOST" ]; then
        sudo -u "$OPENCLAW_USER" rsync -a "${SECRETS_HOST}:~/.secrets/" \
            "/home/${OPENCLAW_USER}/.secrets/" 2>&1 | logger -t "$LOG_TAG" \
            || log "WARNING: secrets sync failed, using cached"
    fi

External Script Fetching

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The skill also fetches and executes the nvm installer directly from a remote URL. Although common in practice, it still creates a supply-chain execution path where a compromised upstream or network path can run arbitrary code on the target machine.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

bash
# As openclaw user
curl -fsSL https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash
source ~/.bashrc
nvm install --lts
npm install -g openclaw

Static analysis

No suspicious patterns detected.