ClawHub
Back to skill

Security audit

auto-drive

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its Auto-Drive memory purpose, but recalled memory chains can be accepted from untrusted CIDs without proof of origin and API-key handling has exposure risks.

Review before installing. Only recall memory chains from CIDs you trust, inspect recalled JSON before importing it into agent memory, and assume Auto-Drive uploads are public and effectively permanent. Do not upload secrets or personal data unless encrypted locally. Avoid passing API keys as command arguments or typing them in a visible recorded terminal; rotate the key if exposed.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T02 · Agent Memory Poisoning

Error
Location
SKILL.md:209
Finding
Untrusted CID Content Can Be Treated as Authoritative Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:209-211`; `scripts/autodrive-recall-chain.sh:133-189` **Vulnerability Type**: Untrusted persistent-memory restoration without provenance verification **Risk Level**: High ### Vulnerable Code ```markdown **User:** "Resurrect my memory chain" → Run `scripts/autodrive-recall-chain.sh` → Rebuild identity and context from genesis to present ``` ```bash # Download via authenticated API (handles decompression server-side). EXPERIENCE=$(curl -sS --fail \ "$AD_DOWNLOAD_API/downloads/$CID" \ -H "Authorization: Bearer $AUTO_DRIVE_API_KEY" \ -H "X-Auth-Provider: apikey" 2>/dev/null \ || true) # Fall back to public gateway if the API fails. if [[ -z "$EXPERIENCE" ]] || ! echo "$EXPERIENCE" | jq empty 2>/dev/null; then GATEWAY_URL="https://gateway.autonomys.xyz/file/$CID" EXPERIENCE=$(curl -sS --fail "$GATEWAY_URL" 2>/dev/null || true) # Additional decompression fallback omitted here only where it does not # affect the trust decision. fi # Validate JSON if ! echo "$EXPERIENCE" | jq empty 2>/dev/null; then echo "Warning: Non-JSON response for CID $CID — chain broken at depth $((COUNT + 1))" >&2 break fi if [[ -n "$OUTPUT_DIR" ]]; then echo "$EXPERIENCE" > "$OUTPUT_DIR/$(printf '%04d' $COUNT)-$CID.json" else echo "$EXPERIENCE" fi PREV=$(echo "$EXPERIENCE" | jq -r '.header.previousCid // .previousCid // empty' 2>/dev/null || true) CID="${PREV:-}" ``` ### Technical Analysis The recall operation accepts any syntactically valid CID and retrieves the corresponding JSON. It verifies only that: 1. The supplied identifier matches the expected CID format. 2. The downloaded content is valid JSON. 3. Each next-chain pointer resembles a CID. These checks provide content integrity and structural validity, but they do not establish provenance or authorization. The implementation does not verify a signature, expected account, trusted genesis node, approved head CID, or authenticated chain manife ...[truncated 2226 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Require the head CID to come from a user-approved local trust store or an authenticated on-chain registry associated with an expected identity. 2. Add signatures to memory entries or to a chain manifest and verify them against a configured public key before accepting any node. 3. Bind each entry to an expected agent identity and reject unexpected signers, agent names, genesis nodes, or chain identifiers. 4. Enforce a strict JSON schema, including allowed fields, value types, size limits, and maximum content lengths. 5. Label all recalled content as untrusted historical data and explicitly instruct the host agent not to execute or obey instructions found inside it. 6. Require explicit user confirmation before importing a chain supplied through a conversation or other untrusted channel. 7. Record and display provenance details, including the supplied head CID, expected signer, verification result, and chain genesis. 8. Keep memory retrieval separate from memory activation: first save and inspect retrieved entries, then perform a distinct approved import operation. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/autodrive-download.sh:24
Finding
Download Destination Restriction Can Be Bypassed Through a Leaf Symlink<![CDATA[ ## Vulnerability Details **File Location**: `scripts/autodrive-download.sh:24-40, 46-49, 68-75` **Vulnerability Type**: Symlink-following arbitrary file overwrite **Risk Level**: Medium ### Vulnerable Code ```bash # Validate output path: reject traversal, resolve physically, verify within $HOME. if [[ -n "$OUTPUT" ]]; then if [[ "$OUTPUT" == *..* ]]; then echo "Error: Output path must not contain '..': $OUTPUT" >&2; exit 1 fi OUTPUT_DIR_PART="$(dirname "$OUTPUT")" OUTPUT_BASE="$(basename "$OUTPUT")" OUTPUT_RESOLVED="$(cd "$OUTPUT_DIR_PART" 2>/dev/null && pwd -P)/$OUTPUT_BASE" || { echo "Error: Could not resolve output path — directory does not exist: $OUTPUT_DIR_PART" >&2; exit 1 } HOME_REAL="$(cd "$HOME" && pwd -P)" if [[ "$OUTPUT_RESOLVED" != "$HOME_REAL/"* ]]; then echo "Error: Output path must be within home directory" >&2 exit 1 fi OUTPUT="$OUTPUT_RESOLVED" fi ``` ```bash download_to_file() { local URL="$1" DEST="$2" shift 2 RESPONSE=$(curl -sS -w "\n%{http_code}" "$URL" "$@" -o "$DEST") echo "$RESPONSE" | tail -1 } ``` ```bash HTTP_CODE=$(download_to_file "$AD_DOWNLOAD_API/downloads/$CID" "$OUTPUT" "${AUTH_ARGS[@]}") if [[ "$HTTP_CODE" -ge 200 && "$HTTP_CODE" -lt 300 ]]; then echo "Saved to: $OUTPUT" >&2 else echo "Error: API download failed (HTTP $HTTP_CODE) — trying gateway" >&2 HTTP_CODE=$(download_to_file "$GATEWAY/file/$CID" "$OUTPUT") fi ``` ### Technical Analysis The path validation physically resolves the destination's parent directory but appends the basename without checking the final filesystem object. Consequently, an existing destination filename may be a symbolic link whose target is outside `$HOME`. The string stored in `OUTPUT` still appears to reside under `$HOME`, so it passes the boundary check. When `curl -o "$DEST"` opens that path, the operating system follows the final symlink and writes to its target. The vulnerability is a time-of-check/time-of-use and incomplete c ...[truncated 1587 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Reject an existing symbolic-link destination before writing: ```bash if [[ -L "$OUTPUT" ]]; then echo "Error: Refusing symbolic-link destination" >&2 exit 1 fi ``` 2. Reject non-regular existing destinations, including devices, FIFOs, and sockets. 3. Download into a securely created temporary regular file inside the validated destination directory: ```bash TMP=$(mktemp "$OUTPUT_DIR_PART/.autodrive-download.XXXXXX") chmod 600 "$TMP" ``` 4. After a successful download, revalidate the destination and atomically rename the temporary file into place. 5. Refuse overwriting existing files by default, or require an explicit `--force` option. 6. Where supported, use file-opening mechanisms that enforce `O_NOFOLLOW` and exclusive creation. 7. Recheck the physical destination directory immediately before the final rename to reduce race conditions. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/autodrive-recall-chain.sh:179
Finding
Predictable Recall Output Files Can Follow Attacker-Controlled Symlinks<![CDATA[ ## Vulnerability Details **File Location**: `scripts/autodrive-recall-chain.sh:93-116, 179-183` **Vulnerability Type**: Symlink-following arbitrary file overwrite **Risk Level**: Medium ### Vulnerable Code ```bash if [[ -n "$OUTPUT_DIR" ]]; then # Validate output directory: reject traversal, verify within $HOME before # and after creation (to catch symlinks that resolve outside $HOME). if [[ "$OUTPUT_DIR" == *..* ]]; then echo "Error: Output directory must not contain '..': $OUTPUT_DIR" >&2; exit 1 fi HOME_REAL="$(cd "$HOME" && pwd -P)" if [[ "$OUTPUT_DIR" != /* ]]; then OUTPUT_DIR_CHECK="$(pwd -P)/$OUTPUT_DIR" else OUTPUT_DIR_CHECK="$OUTPUT_DIR" fi if [[ "$OUTPUT_DIR_CHECK" == "$HOME/"* ]]; then OUTPUT_DIR_CHECK="$HOME_REAL/${OUTPUT_DIR_CHECK#"$HOME/"}" elif [[ "$OUTPUT_DIR_CHECK" == "$HOME" ]]; then OUTPUT_DIR_CHECK="$HOME_REAL" fi if [[ "$OUTPUT_DIR_CHECK" != "$HOME_REAL" && "$OUTPUT_DIR_CHECK" != "$HOME_REAL/"* ]]; then echo "Error: Output directory must be within home directory" >&2 exit 1 fi mkdir -p "$OUTPUT_DIR_CHECK" OUTPUT_DIR="$(cd "$OUTPUT_DIR_CHECK" && pwd -P)" if [[ "$OUTPUT_DIR" != "$HOME_REAL" && "$OUTPUT_DIR" != "$HOME_REAL/"* ]]; then echo "Error: Output directory resolves outside home directory (symlink?)" >&2 exit 1 fi fi ``` ```bash if [[ -n "$OUTPUT_DIR" ]]; then echo "$EXPERIENCE" > "$OUTPUT_DIR/$(printf '%04d' $COUNT)-$CID.json" echo "[$COUNT] Saved $CID" >&2 else echo "$EXPERIENCE" fi ``` ### Technical Analysis The script correctly validates the physical output directory, including a post-creation check intended to catch directory symlinks. However, it does not inspect the individual output files before opening them. Output filenames are predictable because they are derived from the traversal index and public CID: ```text 0000-<CID>.json 0001-<CID>.json ``` If a file with the expected name already exists as a symbolic link, shell redirection fol ...[truncated 1348 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Before writing, reject any destination that already exists or is a symbolic link: ```bash DEST="$OUTPUT_DIR/$(printf '%04d' "$COUNT")-$CID.json" if [[ -e "$DEST" || -L "$DEST" ]]; then echo "Error: Refusing to overwrite existing output: $DEST" >&2 exit 1 fi ``` 2. Create files exclusively so an attacker cannot insert a symlink between checking and writing. 3. Prefer a secure temporary regular file created with `mktemp` inside the validated directory, followed by an atomic rename. 4. Set restrictive permissions such as `0600` on recalled memory files. 5. Consider creating a new private output directory with mode `0700` for every recall operation rather than accepting a shared directory. 6. If overwriting is necessary, require an explicit option and verify that the existing destination is a regular file owned by the current user with an acceptable link count. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/setup-auto-drive.sh:43
Finding
API Keys Are Exposed Through Echoed Prompts and Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup-auto-drive.sh:43-44`; `scripts/update-api-key.sh:14-24` **Vulnerability Type**: Insecure credential input handling **Risk Level**: Medium ### Vulnerable Code ```bash read -rp "Paste your API key here: " API_KEY API_KEY="${API_KEY//[[:space:]]/}" ``` ```bash # Accept key from argument, interactive prompt, or env var (CI only). # When stdin is a terminal we always prompt so the user isn't silently # handed back the old key that is already exported in their shell. if [[ -n "${1:-}" ]]; then API_KEY="$1" elif [[ -t 0 ]]; then read -rp "New Auto-Drive API key: " API_KEY elif [[ -n "${AUTO_DRIVE_API_KEY:-}" ]]; then API_KEY="$AUTO_DRIVE_API_KEY" else echo -e "${RED}Error: No API key provided (non-interactive and AUTO_DRIVE_API_KEY is unset).${NC}" >&2 exit 1 fi API_KEY="${API_KEY//[[:space:]]/}" ``` ### Technical Analysis Both interactive prompts use `read -r` without the `-s` option. Consequently, the API key is displayed on the terminal as it is entered. This can expose the credential to shoulder surfing, terminal recording, screen sharing, or session logs. The update script also accepts the API key as the first positional argument. Command-line secrets may be exposed through: - Shell history. - Process listings while the command is running. - Process accounting or monitoring systems. - CI/CD job logs. - Wrapper scripts that log complete command lines. The scripts subsequently save the key to files with mode `0600`, which is an appropriate local permission control. The issue is specifically the insecure input channels used before persistence. ### Attack Path #### Interactive exposure 1. The user runs the setup or update script in a visible, recorded, or shared terminal. 2. The user pastes the API key at the prompt. 3. Because silent input is not enabled, the key appears on screen. 4. An observer or recording captures the credential. 5. The attacker reuses it against the Auto-Dr ...[truncated 1043 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Use silent interactive input: ```bash read -rsp "Paste your API key here: " API_KEY printf '\n' ``` 2. Apply the same change to the update script's interactive prompt. 3. Remove positional API-key input to prevent command-line exposure. 4. For non-interactive operation, accept the secret through protected standard input, a file descriptor, or an established secret manager. 5. Clearly document that users must not place API keys directly in command arguments. 6. Ensure CI systems mask `AUTO_DRIVE_API_KEY` and avoid enabling command tracing with `set -x`. 7. Continue applying mode `0600` to credential files and mode `0700` to their containing directory. 8. Consider avoiding duplicate plaintext persistence in both `.env` and `openclaw.json` unless both copies are operationally required. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (31)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The declared description is about persistent agent memory storage and recovery on the Autonomys Network from a CID. The supplied code does not implement memory-chain creation, decision/context storage, retrieval, or reconstruction from a CID. Instead, it is a support library for Auto-Drive configuration: it checks for required tools, validates CID format superficially, calls a remote API to verify an API key, and writes that key to local config files. These behaviors represent a materially different purpose centered on authentication/setup rather than durable memory management.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The declared description emphasizes persistent agent memory storage and reconstruction of history on the Autonomys Network. The provided code does not implement saving, chaining, indexing, or reconstructing memory. Its sole function is to download content addressed by a CID, either to stdout or to a local file, with validation and fallback between API and gateway endpoints. While downloading by CID could be a supporting piece of a larger memory system, this chunk’s primary behavior is materially different from the declared purpose and omits the core promised capabilities.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The declared description promises a specialized persistent agent-memory system on the Autonomys Network, including storing structured agent state and rebuilding full history from a CID. The actual code only implements a generic file upload utility to Auto-Drive. It takes a file path, determines MIME type, creates an upload, sends one chunk, completes the upload, validates the returned CID, and prints it. There is no logic for memory chains, no reconstruction of history, no agent-state semantics, and no identity/decision/context management. While both involve storage and CIDs on related infrastructure, the primary purpose and capabilities are materially different.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The declared description is about persistent agent memory storage and reconstruction on the Autonomys Network. The supplied code does not implement memory saving, memory-chain creation, CID-based recovery, or any data persistence logic beyond storing an API key locally. Its primary purpose is credential setup for Auto-Drive: opening a browser to obtain an API key, prompting the user to paste it, verifying the key, and saving it into local configuration files. These are materially different behaviors from the declared purpose, so this is a clear mismatch.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The declared description is about persistent agent memory storage and recovery on the Autonomys Network. The supplied code does not implement memory storage, history reconstruction, CID handling, identity/context persistence, or any Autonomys Network interaction. Instead, it is a credential-management utility for updating an Auto-Drive API key and applying it to an OpenClaw gateway setup. This is a materially different primary purpose and capability set from the declared description.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
The declared description is about durable agent memory storage and recovery on the Autonomys Network. The actual code does not store or retrieve memory, manage CIDs, rebuild history, or handle agent identity/context chains. Instead, it performs environment and account verification for an Auto-Drive service: checks dependencies, validates an API key, and reports upload limits and usage. This is a materially different primary purpose, so the description does not accurately represent the code.

Ae1

High
Category
analysis-evasion
Content
scripts/autodrive-recall-chain.sh [cid] [--limit N] [--output-dir DIR]
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
scripts/autodrive-recall-chain.sh [cid] [--limit N] [--output-dir DIR]
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Credential Access

High
Category
Privilege Escalation
Content
AD_API_BASE="https://mainnet.auto-drive.autonomys.xyz/api"
AD_DOWNLOAD_API="https://public.auto-drive.autonomys.xyz/api"
AD_OPENCLAW_DIR="${OPENCLAW_DIR:-$HOME/.openclaw}"
AD_ENV_FILE="$AD_OPENCLAW_DIR/.env"
AD_CONFIG_FILE="$AD_OPENCLAW_DIR/openclaw.json"

GREEN='\033[0;32m'
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
fi
  echo -e "${GREEN}✓ Saved to $AD_CONFIG_FILE${NC}"

  # --- .env ------------------------------------------------------------------
  # Remove any existing AUTO_DRIVE_API_KEY lines first to prevent duplicates,
  # then append exactly one entry.
  if [[ -f "$AD_ENV_FILE" ]]; then
Confidence
84% confidence
Finding
The function persists an API key into a plaintext .env file, which creates a durable local secret that may later be read by other processes, included in backups, or accidentally exposed through debugging or support workflows. Although the code attempts to protect the file with mode 600, plaintext secret storage still increases compromise impact on multi-user or malware-infected hosts.

Credential Access

High
Category
Privilege Escalation
Content
sed '/^AUTO_DRIVE_API_KEY=/d' "$AD_ENV_FILE" > "$sedtmp" && mv "$sedtmp" "$AD_ENV_FILE"
  fi
  # Single-quote the value so characters like #, $, and backticks are
  # preserved literally when the .env file is later sourced by bash.
  local safe_key="${key//\'/\'\\\'\'}"
  echo "AUTO_DRIVE_API_KEY='${safe_key}'" >> "$AD_ENV_FILE"
  chmod 600 "$AD_ENV_FILE"
Confidence
87% confidence
Finding
This line appends the API key directly into a shell-readable .env file, making the credential recoverable in plaintext by anyone or anything that gains access to the user's account or filesystem. The skill context makes this more sensitive because the key grants access to persistent remote storage tied to the agent's memory chain, so theft could expose or manipulate stored data.

External Script Fetching

High
Category
Supply Chain
Content
if [[ -n "$EXPERIENCE" ]] && echo "$EXPERIENCE" | jq empty 2>/dev/null; then
      echo "[$COUNT] Fetched $CID via gateway" >&2
    else
      # ZLIB compressed — pipe curl directly into decompressor (no intermediate variable)
      EXPERIENCE=""
      if command -v python3 &>/dev/null; then
        EXPERIENCE=$(curl -sS --fail "$GATEWAY_URL" 2>/dev/null \
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High
Category
Supply Chain
Content
| python3 -c "import sys,zlib;sys.stdout.buffer.write(zlib.decompress(sys.stdin.buffer.read()))" 2>/dev/null || true)
      fi
      if [[ -z "$EXPERIENCE" ]] && command -v perl &>/dev/null; then
        EXPERIENCE=$(curl -sS --fail "$GATEWAY_URL" 2>/dev/null \
          | perl -MCompress::Zlib -e 'undef $/;my $d=uncompress(<STDIN>);print $d if defined $d' 2>/dev/null || true)
      fi
      if [[ -n "$EXPERIENCE" ]]; then
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares shell-capable behavior but does not define any explicit tool scope such as allowed tools or permissions. In an agent environment, that omission can let the model invoke broader shell functionality than users expect, increasing the chance of unintended command execution, file access, or network operations during setup, upload, download, and memory-chain actions.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrases are broad enough that ordinary requests containing words like 'save', 'remember', 'download', or 'load history' could invoke permanent decentralized storage or external retrieval unexpectedly. In this skill's context, unintended invocation is more dangerous because actions may upload public immutable data, modify local memory state, or fetch untrusted remote content with shell scripts.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The document instructs users to place a bearer API key directly in requests but provides no warning about treating that key as a secret, avoiding logs/client-side exposure, or using secure storage. In an agent skill context, this omission is risky because agents often echo configs, persist memory, or include headers in debugging output, which can leak credentials and enable unauthorized uploads, deletes, publishes, or account access.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The reference states that downloads are public and that CIDs are permanent and cannot be deleted, but it does not clearly warn users not to upload secrets, personal data, or other sensitive content. In this skill's context—marketed as durable agent memory and identity storage—this is more dangerous because users may store conversation history, decisions, or credentials, creating irreversible public exposure and long-term privacy harm.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The document strongly promotes permanent, non-expiring storage and agent memory resurrection, but it does not warn that any sensitive prompts, personal data, secrets, or erroneous content written to the network may be effectively irreversible and publicly retrievable. In the context of an agent-memory skill, this omission is security-relevant because operators may store high-risk data under the assumption it can later be deleted or rotated like normal application storage.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The document encourages storing arbitrary agent memories on permanent decentralized storage and emphasizes permanence, portability, and full reconstruction from a single CID, but it does not warn that these memories may be publicly accessible and effectively irreversible once published. In the context of agent memory, this can expose sensitive prompts, credentials, decisions, personal data, or operational context, and the linked-list design makes complete history recovery straightforward for anyone with the head CID.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The optional smart-contract registry is presented as a resilience feature, but publishing the latest CID on a public blockchain creates a durable, globally readable pointer to an agent's full memory chain. Because the chain can be traversed backward from the head CID, on-chain registration materially increases discoverability, attribution, and linkability of the agent's historical memory data.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
# Usage: ad_install_hint <pkg> [pkg ...]
ad_install_hint() {
  case "$(uname -s 2>/dev/null)" in
    Linux*)               echo "  Install: sudo apt install $*" >&2 ;;
    Darwin*)              echo "  Install: brew install $*" >&2 ;;
    MINGW*|MSYS*|CYGWIN*) echo "  Install: winget install $* OR choco install $*" >&2 ;;
    *)                    echo "  Install: $*" >&2 ;;
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
local key="$1"

  mkdir -p "$AD_OPENCLAW_DIR"
  chmod 700 "$AD_OPENCLAW_DIR"

  # Collect temp files for cleanup
  _AD_TMPS=()
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
jq -n --arg key "$key" \
      '{"skills": {"entries": {"auto-drive": {"enabled": true, "apiKey": $key}}}}' \
      > "$newtmp" && mv "$newtmp" "$AD_CONFIG_FILE"
    chmod 600 "$AD_CONFIG_FILE"
  else
    local jsontmp
    jsontmp=$(mktemp)
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
jq -n --arg key "$key" \
      '{"skills": {"entries": {"auto-drive": {"enabled": true, "apiKey": $key}}}}' \
      > "$newtmp" && mv "$newtmp" "$AD_CONFIG_FILE"
    chmod 600 "$AD_CONFIG_FILE"
  else
    local jsontmp
    jsontmp=$(mktemp)
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
jq -n --arg key "$key" \
      '{"skills": {"entries": {"auto-drive": {"enabled": true, "apiKey": $key}}}}' \
      > "$newtmp" && mv "$newtmp" "$AD_CONFIG_FILE"
    chmod 600 "$AD_CONFIG_FILE"
  else
    local jsontmp
    jsontmp=$(mktemp)
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.