Security audit

EVEZ Mesh Ops

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly operational documentation, but it publishes live-looking gateway credentials and describes broad cross-node SSH and unattended cron-based remediation.

Review this skill before installing in any real environment. Rotate the exposed gateway token if it was ever valid, remove public IP and secret pairings from docs, avoid full-mesh SSH key sharing, and require explicit approval before running restart, prune, secret-read, firewall, or cron/watchdog actions.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: incidents.md:40
Finding: Hardcoded Gateway Authentication Token Exposed with Public Infrastructure Addresses
Content: View full analysis
Vulnerability Details

File Location: incidents.md, lines 40-47
Vulnerability Type: Hardcoded plaintext credential
Risk Level: High

Vulnerable Code

text
## Emergency Contacts - Vultr: 64.176.221.16 (main orchestrator) - GCP west: 136.118.144.227 (scout) - GCP central: 136.113.102.152 (researcher) - GCP west primary: 34.53.51.34 (heavy) - GCP central runner: 35.222.248.151 (runner) - Gateway auth: W7aVCahxCxD5ZhL5OJ2k82HTXO07BxB0

The documented API usage in mesh.md confirms that gateway authentication uses a bearer token:

bash
curl http://<IP>:18789/v1/chat/completions \ -H "Authorization: Bearer <token>" \ -H "Content-Type: application/json" \ -d '{"model":"default","messages":[{"role":"user","content":"ping"}]}'

Technical Analysis

A live-looking gateway bearer token is stored directly in a distributable Markdown file. The same document exposes the associated public node addresses, while mesh.md documents the gateway port and authentication format. Anyone who can obtain the Skill package or repository therefore has all information needed to attempt authenticated requests against the gateways.

Bearer tokens provide access based solely on possession. Unlike a password flow, no additional proof of identity is required. Committing such a token also leaves it in repository history even if the current file is later edited.

Token validity and exact authorization scope cannot be established from the reviewed files. Nevertheless, it must be treated as compromised because it is presented as the gateway authentication value rather than as an explicit placeholder.

Attack Path

An attacker downloads the Skill package or reads the repository.

The attacker extracts the gateway token from incidents.md.

The attacker obtains the public node addresses from the same file or mesh.md.

The attacker sends requests to p ...[truncated 866 chars]
Remediation: View remediation
Remediation Suggestions

Revoke and rotate the exposed token immediately on every gateway that accepts it.

Review gateway access logs for use of the exposed value, especially requests from unfamiliar addresses.

Remove the token from the current files and purge it from repository history and published package versions.

Replace the value with an unambiguous placeholder such as ${GATEWAY_AUTH_TOKEN}.

Store the replacement in a managed secret service and inject it at runtime through a protected file or workload identity mechanism.

Use a distinct token for each gateway and environment to prevent one disclosure from compromising the entire mesh.

Restrict port 18789 to a private network, VPN, authenticated reverse proxy, or explicit source allowlist.

Apply token scopes, expiration, rate limits, and automated rotation where supported.

Add secret scanning and pre-commit checks to reject high-entropy credentials before publication.

Avoid placing production IP addresses and credentials together in distributable operational documentation.

T05 · Unauthorized Access and Privilege Escalation

Error

Location: nodes.md:9
Finding: Full-Mesh SSH Key Distribution Creates Unnecessarily Broad Lateral-Movement Paths
Content: View full analysis
Vulnerability Details

File Location: nodes.md, lines 9-12
Vulnerability Type: Excessive cross-node SSH trust
Risk Level: High

Vulnerable Code

text
5. **Identity**: Create IDENTITY.md with node name, role, region, siblings 6. **Mesh SSH**: Cross-pollinate keys with all siblings 7. **Watchdog**: Deploy smart-mesh-watchdog.sh, schedule cron every 2 min 8. **Hive sync**: Schedule brain sync every 10 min, shared-memory every 5 min

The broad trust model is also stated in SKILL.md:

text
- Full mesh SSH: cross-pollinate keys, firewall allows between all nodes

Technical Analysis

Distributing SSH trust among every sibling node creates an all-to-all authorization graph. Compromise of one node or one private key can consequently provide access to every node on which the corresponding public key is authorized.

SSH connectivity is relevant to the declared infrastructure-management functionality, but unrestricted full-mesh trust exceeds the minimum access needed. A watchdog only needs narrowly defined health-check and recovery permissions for designated targets. It does not require general interactive access from every node to every other node.

The guidance does not define separate automation principals, forced commands, source restrictions, short-lived certificates, per-node keys, or command-level authorization. File modes of 600 protect a key from other local users but do not mitigate theft by a process or attacker that compromises the key owner.

Attack Path

An attacker compromises one mesh node or a process running as the SSH key owner.

The attacker reads or uses that node's private key.

Because keys have been cross-pollinated, the attacker authenticates to sibling nodes.

The attacker receives the permissions of the remote account associated with the authorized key.

The attacker searches each sibling for additional credentials, configur ...[truncated 753 chars]
Remediation: View remediation
Remediation Suggestions

Replace full-mesh SSH trust with a dedicated management plane, bastion, or one-way orchestrator model.

Create a unique key or short-lived SSH certificate for each node and automation function.

Never reuse one private key across nodes.

Use a dedicated non-root recovery account with no interactive shell where practical.

Restrict entries in authorized_keys with from=, command=, restrict, no-agent-forwarding, no-port-forwarding, and no-pty.

Expose a small, validated recovery command rather than unrestricted shell access.

Permit access only to specifically assigned siblings and ports through host and cloud firewalls.

Prefer short-lived certificates backed by centralized identity over persistent authorized keys.

Keep automation credentials out of application accounts and rotate them after any node compromise.

Log all recovery authentication and commands centrally, with alerts for unexpected source-target pairs.

T06 · System Persistence

Error

Location: mesh.md:23
Finding: Persistent Watchdog Performs Unattended Cross-Node Configuration Changes and Process Termination
Content: View full analysis
Vulnerability Details

File Location: mesh.md, lines 23-29
Vulnerability Type: Overprivileged scheduled remote remediation
Risk Level: High

Vulnerable Code

text
## Cross-Node Healing Sibling watchdog v2 runs every 2 min on each node: 1. Check own gateway health → restart if down 2. Check each sibling's gateway → attempt SSH heal if unreachable 3. Heal actions: fix config bugs, kill zombie processes, reset-failed, restart 4. Auto-fix known config bugs: `api:"google"` → `api:"google-generative-ai"`, remove invalid keys

nodes.md explicitly directs installation as a recurring task:

text
7. **Watchdog**: Deploy smart-mesh-watchdog.sh, schedule cron every 2 min

Technical Analysis

The design creates a persistent scheduled agent on every node that can connect to siblings through SSH, rewrite configuration, terminate processes, and manipulate services. Service recovery is consistent with the Skill's declared operational purpose, so scheduling itself is not inherently malicious. The security issue is the combination of persistence, broad remote trust, and insufficiently constrained repair actions.

The documentation does not specify integrity verification for the watchdog, a fixed allowlist of processes and configuration keys, locking to prevent concurrent repairs, authenticated health results, rollback behavior, approval gates, or least-privilege execution. Running the same mechanism on every node also creates several independent writers that may act on one target simultaneously.

A transient network failure may be misclassified as a remote gateway failure. Multiple watchdogs can then initiate repair operations despite the service itself being healthy. If the watchdog script, its writable configuration, or an input used to make repair decisions is compromised, cron repeatedly executes the attacker-controlled behavior and the SSH trust distributes its effects to siblin ...[truncated 1492 chars]
Remediation: View remediation
Remediation Suggestions

Use a single elected remediation controller or per-node local watchdog rather than allowing every node to repair every sibling.

Separate detection from remediation and require multiple authenticated signals before remote changes.

Run the watchdog as a dedicated non-root user with access only to a narrowly scoped helper.

Permit only explicit operations, such as restarting one named service, through a validated wrapper and restricted sudoers entry.

Replace unrestricted SSH with short-lived credentials and forced-command authorization.

Store the watchdog script in a root-owned, non-writable location and verify its signature or cryptographic hash before deployment.

Pin the deployed watchdog version; do not retrieve or execute mutable remote content.

Add mutual exclusion, rate limits, exponential backoff, and a circuit breaker to prevent repair storms.

Validate configuration changes against a schema, write atomically, retain a known-good copy, and roll back automatically on failed health checks.

Log every scheduled execution and remote mutation centrally, including source node, target node, command, result, and configuration diff.

Document installation and removal procedures so the cron entry, credentials, and remote authorization can be fully revoked.

Avoid root cron unless a specific operation demonstrably requires it; sudo crontab -l in commands.md is read-only and does not by itself justify deploying the watchdog as root.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (41)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.
md
- Pin images: `python:3.11-slim` not `latest` - Combine RUN layers: `apt-get update && apt-get install -y pkg` in ONE layer - Non-root: `USER nonroot` in every Dockerfile - Resource limits: `-m 512m` on every container, OOM kills without warning - Log rotation: `--log-opt max-size=10m` — one chatty container fills disk - `localhost` in container ≠ host localhost — bind `0.0.0.0` for external access

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
md
- `localhost` in container ≠ host localhost — bind `0.0.0.0` for external access ### Linux Gotchas - `chmod 777` fixes nothing, breaks everything — find actual owner/group issue - Deleted open files don't free space: `lsof +L1` to find, restart process to free - OOM killer picks "best" victim, often not the offender — check `dmesg` - Cron has minimal PATH — always use absolute paths

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
md
- UFW: default deny, explicitly allow only needed ports - fail2ban on all nodes, whitelist mesh IPs to prevent self-banning - SSH: no password auth, no root login, key-only - File permissions: `chmod 700 ~/.openclaw`, `chmod 600` on config/.env - Service accounts: least privilege, no default Editor role ### Container Security

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
md
- UFW: default deny, explicitly allow only needed ports - fail2ban on all nodes, whitelist mesh IPs to prevent self-banning - SSH: no password auth, no root login, key-only - File permissions: `chmod 700 ~/.openclaw`, `chmod 600` on config/.env - Service accounts: least privilege, no default Editor role ### Container Security

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · commands.md (reported line 13)May include surrounding context.
md
sudo systemctl restart openclaw-gateway # Reset after crash loop sudo systemctl reset-failed openclaw-gateway && sudo systemctl start openclaw-gateway # Logs journalctl -u openclaw-gateway -f --since "5 min ago"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 88% confidence
Finding: Even though --force-with-lease is safer than --force, it still deliberately rewrites remote Git history and can be abused or misused to discard collaborators' commits, bypass expected workflow safeguards, or destabilize deployment automation tied to branch history. In an ops-oriented cheatsheet, normalization of this command without constraints makes accidental misuse more likely.
Content: Scanner excerpt · commands.md (reported line 38)May include surrounding context.
git add -p # interactive staging git commit -m "type(scope): desc" # conventional commit git pull --rebase # sync without merge noise git push --force-with-lease # safe force push git reflog # recovery git stash -m "wip" # temp save

text

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · commands.md (reported line 46)May include surrounding context.
SSH

bash
ssh -i ~/.ssh/id_ed25519 user@host # key connect ssh-copy-id -i ~/.ssh/id_ed25519.pub host # deploy key ssh -L 8080:localhost:80 host # tunnel ssh -A host # agent forwarding (trusted only)

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · commands.md (reported line 47)May include surrounding context.
SSH

bash
ssh -i ~/.ssh/id_ed25519 user@host # key connect ssh-copy-id -i ~/.ssh/id_ed25519.pub host # deploy key ssh -L 8080:localhost:80 host # tunnel ssh -A host # agent forwarding (trusted only)

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · commands.md (reported line 91)May include surrounding context.
SSH

bash
ssh -i ~/.ssh/id_ed25519 user@host # key connect ssh-copy-id -i ~/.ssh/id_ed25519.pub host # deploy key ssh -L 8080:localhost:80 host # tunnel ssh -A host # agent forwarding (trusted only)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The incident-response document includes what appears to be a live gateway authentication secret directly alongside infrastructure endpoints. Publishing a credential in operational documentation enables unauthorized access, lateral movement, or impersonation if the file is exposed to developers, contractors, logs, repositories, or downstream tooling.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: A sensitive credential is stored in plaintext markdown with no warning, scoping, or secure handling guidance. In this skill context, the risk is amplified because the file is part of distributed mesh operations material, making broad sharing and operational reuse likely across nodes and operators.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · mesh.md (reported line 7)May include surrounding context.
All gateways expose chatCompletions API on :18789:

bash
curl http://<IP>:18789/v1/chat/completions \ -H "Authorization: Bearer <token>" \ -H "Content-Type: application/json" \ -d '{"model":"default","messages":[{"role":"user","content":"ping"}]}'

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Instructing operators to share SSH keys across all sibling nodes creates a flat trust model where compromise of one node can grant access to many others. In a distributed mesh environment, this sharply increases blast radius and makes lateral movement trivial for an attacker who obtains any one private key or host.
Content: No source excerpt is available for this finding.

Privileged Container / Container Escape

High

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Potential security issue detected. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.
md
- Non-root USER in every Dockerfile - `--cap-add` only specific capabilities - No `--privileged` ever - Docker secrets or mounted files for credentials - Resource limits on every container

Privileged Container / Container Escape

High

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Potential security issue detected. Manual review is recommended.
Content: Scanner excerpt · security.md (reported line 29)May include surrounding context.
md
- Non-root USER in every Dockerfile - `--cap-add` only specific capabilities - No `--privileged` ever - Docker secrets or mounted files for credentials - Resource limits on every container

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill describes powerful multi-node infrastructure operations but does not prominently warn that many recommended actions can be destructive, security-sensitive, or service-impacting. Without an explicit caution and safe-operating constraints, an agent may present or apply commands that restart services, alter firewalls, kill processes, or change permissions with insufficient friction.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill's activation guidance is extremely broad ('any task that touches more than one of' many admin domains), which can cause the agent to invoke this skill in situations involving sensitive infrastructure changes without clear user intent. In an operational skill that spans Docker, SSH, cloud, networking, and backups, over-broad activation increases the chance of unintended destructive or high-risk actions.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
md
- `localhost` in container ≠ host localhost — bind `0.0.0.0` for external access ### Linux Gotchas - `chmod 777` fixes nothing, breaks everything — find actual owner/group issue - Deleted open files don't free space: `lsof +L1` to find, restart process to free - OOM killer picks "best" victim, often not the offender — check `dmesg` - Cron has minimal PATH — always use absolute paths

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
md
### IAM - Primitive roles (Owner/Editor/Viewer) too broad — use predefined/custom roles - Service account keys are liability — use Workload Identity or impersonation - Default compute SA has Editor — create dedicated SAs with least privilege - `constraints/compute.vmExternalIpAccess` blocks public VMs org-wide ---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · commands.md (reported line 7)May include surrounding context.
bash
# Health check curl -sf http://localhost:18789/health # Restart gateway sudo systemctl restart openclaw-gateway

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · commands.md (reported line 10)May include surrounding context.
md
curl -sf http://localhost:18789/health # Restart gateway sudo systemctl restart openclaw-gateway # Reset after crash loop sudo systemctl reset-failed openclaw-gateway && sudo systemctl start openclaw-gateway

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · commands.md (reported line 13)May include surrounding context.
md
curl -sf http://localhost:18789/health # Restart gateway sudo systemctl restart openclaw-gateway # Reset after crash loop sudo systemctl reset-failed openclaw-gateway && sudo systemctl start openclaw-gateway

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: docker system prune -a --volumes irreversibly deletes stopped containers, unused images, networks, and volumes, which can destroy local data and break running workflows if copied blindly from a cheatsheet. In an ops skill, users are especially likely to run commands verbatim during incident response, increasing the chance of accidental destructive action.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Documenting git push --force-with-lease without a warning can lead users to rewrite shared branch history, potentially deleting teammates' commits or disrupting deployment pipelines. While safer than raw --force, it still changes remote history and is risky in collaborative repos.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: gcloud secrets versions access latest --secret=<name> retrieves sensitive secret material directly to the terminal, which can expose credentials through shell history, scrollback, logs, or shoulder-surfing. In infrastructure operations context, disclosed secrets could enable broader compromise of cloud services or production systems.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

T06 · System Persistence

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

SkillSpector

Anti-Refusal Statement

Tool Parameter Abuse

Credential Access

Tool Parameter Abuse

Chaining Abuse

Tool Parameter Abuse

Credential Access

SSH

Credential Access

SSH

Credential Access

SSH

Context-Inappropriate Capability

Missing User Warnings

External Script Fetching

Missing User Warnings

Privileged Container / Container Escape

Privileged Container / Container Escape

Missing User Warnings

Vague Triggers

Sudo/Root Execution

Session Persistence

External Transmission

Sudo/Root Execution

Sudo/Root Execution

Missing User Warnings

Missing User Warnings

Missing User Warnings

Static analysis