ClawHub
Back to skill

Security audit

Evez Fleet

Security checks for vulnerabilities and agentic risk

Overview

This deployment skill is purpose-aligned, but it performs cloud setup, unverified remote installation, persistent service restarts, and API-key storage with too little safety guidance.

Review before installing. Only run these scripts against a test or explicitly approved GCP project, expect them to create or modify cloud resources, do not pass real provider API keys on the command line, and avoid the GCP installer path unless the downloaded OpenClaw installer is pinned and verified. Run the watchdog only as an unprivileged OpenClaw service account and restrict it to the intended gateway process.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
gcp-free-tier.sh:36
Finding

Unpinned Remote Installer Is Piped Directly into Bash

Content
View full analysis
&1 | tail -5 ``` ### Technical Analysis The script opens an SSH session to the newly provisioned GCP instance, downloads the current contents of `https://openclaw.ai/install.sh`, and sends those contents directly to Bash. The downloaded payload is not pinned to a version or immutable commit and is not validated with a hardcoded checksum or cryptographic signature. HTTPS protects the network transport but does not establish that the mutable script remains equivalent to the version originally reviewed. Compromise of the website, DNS, hosting infrastructure, publishing account, or installer generation process could replace the effective payload. Remote installation is consistent with the Skill's deployment purpose, but piping mutable network content directly into a shell exceeds the minimum safe mechanism necessary to install OpenClaw. ### Attack Path 1. An attacker compromises the installer hosting infrastructure, domain, publishing credentials, or upstream deployment process. 2. The attacker replaces `install.sh` with a malicious shell payload. 3. An operator executes `gcp-free-tier.sh`. 4. `gcloud compute ssh` connects to the new `openclaw-free` VM. 5. `curl` retrieves the attacker-controlled installer. 6. Bash executes the payload immediately without integrity or authenticity verification. 7. The payload establishes control of the VM, steals accessible credentials, modifies OpenClaw, or uses the node to access connected fleet resources. ### Impact Assessment The attacker obtains arbitrary command execution on the GCP VM with the privileges of the remote SSH account. The precise privilege level depends on GCP ...[truncated 615 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
deploy-providers.sh:15
Finding

Provider API Key Is Accepted Through a Command-Line Argument

Content
View full analysis
" echo "Providers: google groq cerebras openrouter together chutes huggingface" exit 1 fi ``` ```bash openclaw config set "models.providers.$PROVIDER.apiKey" "$KEY" ``` ### Technical Analysis The provider API key is supplied as the script's second positional command-line argument. Secrets passed through command-line arguments may be exposed through: - Shell history - Process command-line inspection while the script is running - Process auditing and telemetry systems - Terminal session recording - Wrapper-script or automation logs - Diagnostic bundles that collect command invocations The key is subsequently written through `openclaw config set`, but the script does not verify that OpenClaw stores the value in encrypted secret storage or in a file with restrictive permissions. Quoting `"$KEY"` prevents ordinary shell word splitting and command substitution of the already-expanded variable, so no direct shell injection is established here. The confirmed issue is credential exposure through the invocation and storage workflow. ### Attack Path 1. An operator runs `deploy-providers.sh` with a provider API key as the second argument. 2. The command is retained in shell history, captured by session logging, or temporarily exposed through process metadata. 3. A local user, administrator, monitoring agent, backup reader, or other party with access to those records retrieves the key. 4. The party authenticates to the relevant LLM provider using the stolen credential. 5. The provider account, quota, credits, or accessible resources are abused until the credential is revoked. ### Impact Assessment An attacker who obtains the key gains the permissio ...[truncated 585 chars]
Remediation
View remediation
" exit 1 fi IFS= read -r -s -p "API key: " KEY printf '\n' if [ -z "$KEY" ]; then echo "API key must not be empty" >&2 exit 1 fi openclaw config set "models.providers.$PROVIDER.apiKey" "$KEY" unset KEY ``` Protected secret-manager injection is preferable to interactive entry for production fleet deployment. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
watchdog.sh:19
Finding

Watchdog Uses a Broad Command-Line Pattern to Terminate Processes

Content
View full analysis
/dev/null ``` ### Technical Analysis The watchdog uses `pkill -f`, which matches against each process's full command line. The regular expression is broad and identifies a process only by the occurrence and order of the strings `openclaw`, `gateway`, and the configured port. The code does not verify: - The executable path of the matched process - The process owner - A PID recorded when the gateway started - The process's parent or service unit - Whether the process is the specific gateway instance managed by this watchdog As a result, unrelated processes whose command lines happen to match can be terminated. A process could also deliberately choose matching arguments and be killed when the health check fails. This is primarily a reliability and local denial-of-service issue rather than a demonstrated privilege-escalation primitive. ### Attack Path 1. A legitimate or attacker-created process runs with command-line text matching `openclaw.*gateway.*18789`. 2. The gateway health endpoint becomes unavailable, times out, or returns an error. 3. The watchdog executes the broad `pkill -f` expression. 4. Every process visible and signalable by the watchdog's account that matches the expression is terminated. 5. Unrelated services or OpenClaw operations are disrupted. ### Impact Assessment The watchdog can terminate any matching process that its execution account has permission to signal. If it runs as the `openclaw` user, the likely impact is limited to that user's processes. If configured to run with elevated privileges, the potential termination scope becomes substantially broader. Potential consequences include: - Local denial of service - Termination of an unrelated OpenClaw gateway or mainte ...[truncated 169 chars]
Remediation
View remediation
/exe` resolves to the expected executable - The command line identifies the intended gateway instance 5. Use `kill` on the single verified PID rather than `pkill -f`. 6. Add restart-rate limits and failure backoff to prevent restart loops. 7. Ensure the watchdog itself runs with no more privilege than required to manage the gateway. A systemd deployment should use service-level restart controls such as: ```ini [Service] User=openclaw ExecStart=/usr/bin/node /usr/lib/node_modules/openclaw/dist/index.js gateway --port 18789 Restart=on-failure RestartSec=5 [Unit] StartLimitIntervalSec=300 StartLimitBurst=5 ``` The watchdog can then request a restart of only the dedicated service unit rather than searching the global process table. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (12)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · deploy-providers.sh (reported line 12)May include surrounding context.

sh
# - OpenRouter:    openrouter.ai → Keys (free models available)
# - Together:      api.together.ai → Settings ($5 free credit)
# - Chutes:        chutes.ai → API Key (FREE community models)
# - HuggingFace:   huggingface.co → Settings → Access Tokens (FREE serverless)

set -euo pipefail

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script remotely executes downloaded shell code on the created instance without integrity verification, code review, or meaningful user confirmation. This creates a strong supply-chain execution path where a compromised vendor site, DNS/TLS interception, or malicious upstream change can lead to arbitrary code execution on the VM.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

Fetching and executing an external script from https://openclaw.ai/install.sh gives that endpoint full control over commands run on the VM. If the remote content changes or is compromised, the instance can be backdoored, used for persistence, credential theft, or lateral movement within the GCP environment.

Content

Scanner excerpt · gcp-free-tier.sh (reported line 39)May include surrounding context.

sh
# 4. Install OpenClaw on the free instance
echo "=== Installing OpenClaw on free node ==="
gcloud compute ssh openclaw-free --zone=us-west1-b --command="
  curl -fsSL https://openclaw.ai/install.sh | bash
  openclaw setup
" 2>&1 | tail -5

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

Using 'curl ... | bash' removes any inspection boundary between untrusted network content and code execution. In this skill context, the danger is elevated because the script provisions cloud infrastructure and then immediately installs software on it, giving an attacker a turnkey path from script execution to persistent control of a cloud-hosted asset.

Content

Scanner excerpt · gcp-free-tier.sh (reported line 39)May include surrounding context.

sh
# 4. Install OpenClaw on the free instance
echo "=== Installing OpenClaw on free node ==="
gcloud compute ssh openclaw-free --zone=us-west1-b --command="
  curl -fsSL https://openclaw.ai/install.sh | bash
  openclaw setup
" 2>&1 | tail -5

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill advertises scripts that deploy infrastructure, configure providers, and automatically restart services, but it does not warn users that these actions can modify cloud resources, incur costs, change availability, and affect security posture. In a deployment-focused skill, omission of explicit safety and authorization guidance increases the risk that an agent or user will run impactful operations without confirming scope, credentials, targets, or rollback plans.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · deploy-providers.sh (reported line 32)May include surrounding context.

sh
MODELS='[{"id":"gemini-2.5-flash","name":"Gemini 2.5 Flash","contextWindow":1048576,"maxTokens":65536,"reasoning":true,"cost":{"input":0,"output":0}},{"id":"gemini-2.0-flash","name":"Gemini 2.0 Flash","contextWindow":1048576,"maxTokens":8192,"cost":{"input":0,"output":0}}]'
        ;;
    groq)
        BASE_URL="https://api.groq.com/openai/v1"
        ENV_VAR="GROQ_API_KEY"
        MODELS='[{"id":"llama-3.3-70b-versatile","name":"Llama 3.3 70B Groq","contextWindow":131072,"maxTokens":32768,"cost":{"input":0.59,"output":0.79}},{"id":"llama-3.1-8b-instant","name":"Llama 3.1 8B Instant","contextWindow":131072,"maxTokens":8192,"cost":{"input":0,"output":0}}]'
        ;;

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · deploy-providers.sh (reported line 37)May include surrounding context.

sh
MODELS='[{"id":"llama-3.3-70b-versatile","name":"Llama 3.3 70B Groq","contextWindow":131072,"maxTokens":32768,"cost":{"input":0.59,"output":0.79}},{"id":"llama-3.1-8b-instant","name":"Llama 3.1 8B Instant","contextWindow":131072,"maxTokens":8192,"cost":{"input":0,"output":0}}]'
        ;;
    cerebras)
        BASE_URL="https://api.cerebras.ai/v1"
        ENV_VAR="CEREBRAS_API_KEY"
        MODELS='[{"id":"llama-3.3-70b","name":"Llama 3.3 70B Cerebras","contextWindow":131072,"maxTokens":8192,"cost":{"input":0,"output":0}}]'
        ;;

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · deploy-providers.sh (reported line 47)May include surrounding context.

sh
MODELS='[{"id":"google/gemini-2.5-flash-preview","name":"Gemini 2.5 Flash OR","contextWindow":1048576,"maxTokens":65536,"reasoning":true,"cost":{"input":0,"output":0}}]'
        ;;
    together)
        BASE_URL="https://api.together.xyz/v1"
        ENV_VAR="TOGETHER_API_KEY"
        MODELS='[{"id":"meta-llama/Llama-3.3-70B-Instruct-Turbo","name":"Llama 3.3 70B Turbo","contextWindow":131072,"maxTokens":8192,"cost":{"input":0.88,"output":0.88}}]'
        ;;

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script persists a supplied API key into local OpenClaw configuration via 'openclaw config set ... apiKey'. Storing secrets in application config without any warning, scoping, masking, or guidance on storage protections can expose credentials to other local users, backups, logs, or accidental disclosure depending on how OpenClaw stores configuration.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script is presented as a 'free-tier infrastructure setup' but it also installs and configures third-party OpenClaw software on the VM. This mismatch can mislead operators into running software deployment they did not explicitly consent to, increasing supply-chain and unauthorized-change risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · watchdog.sh (reported line 25)May include surrounding context.

sh
# Restart
cd /home/openclaw/.openclaw
nohup /usr/bin/node /usr/lib/node_modules/openclaw/dist/index.js gateway --port "${GATEWAY_PORT}" > /home/openclaw/.openclaw/workspace/logs/gateway.log 2>&1 &

# Wait and verify
sleep 10

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The comment says the script is used as ./fleet-free-models.sh <api_key_for_provider>, implying a single API key argument. The code actually requires two arguments, <provider> <api_key>, and exits with a usage message if either is missing at L19-L23.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.