ClawHub
Back to skill

Security audit

Evez Os Cheat Codes

Security checks for vulnerabilities and agentic risk

Overview

This documentation-only skill is not hiding executable code, but it promotes high-risk OpenClaw and GCP operations that can expose credentials, disable authentication, and grant full host access.

Treat this as Review-only material for experienced OpenClaw/GCP operators, not as a general agent skill. Do not run the auth-bypass, /elevated full, OPENCLAW_SHOW_SECRETS, full-payload logging, debug proxy, or GCP metadata token/SSH-key commands on real systems unless you are in an isolated, authorized diagnostic environment with short retention and secret cleanup. Keep device auth enabled, avoid broad trusted-proxy ranges, and pin/review MCP packages before use.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:303
Finding

GCP Metadata Service Instructions Expose Temporary Credentials and Sensitive Instance Data

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:47
Finding

Skill Promotes Full Host Execution Through Elevated Agent Mode

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:124
Finding

Authentication Bypass and Elevated-Scope Configuration Weaken Gateway Access Controls

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:155
Finding

Debug Configuration Intentionally Exposes Secrets, Environment Variables, Conversations, and Network Traffic

Content
View full analysis
` | Custom trajectory output dir | | `OPENCLAW_RAW_STREAM=1` | Capture raw LLM streaming output | | `OPENCLAW_RAW_STREAM_PATH=` | Write raw stream to file | ``` ```text | `OPENCLAW_DEBUG_PROXY_ENABLED=1` | Enable debug proxy (captures ALL traffic) | | `OPENCLAW_DEBUG_PROXY_URL=` | Debug proxy endpoint | | `OPENCLAW_DEBUG_PROXY_BLOB_DIR=` | Store captured blobs | | `OPENCLAW_DEBUG_PROXY_DB_PATH=` | SQLite DB for captured traffic | ``` ```text | `OPENCLAW_LOAD_SHELL_ENV=1` | Inherit full shell environment | | `OPENCLAW_SHOW_SECRETS=1` | **Display unredacted secrets in output** | ``` ```bash OPENCLAW_DEBUG_PROXY_ENABLED=1 openclaw gateway # Captures ALL HTTP traffic in/out of the gateway # Store in SQLite DB for later analysis ``` ```bash OPENCLAW_SHOW_SECRETS=1 OPENCLAW_DEBUG_MODEL_PAYLOAD=1 OPENCLAW_CACHE_TRACE=1 OPENCLAW_VERBOSE=1 openclaw gateway ``` The last command is described as providing “unredacted secrets + ...[truncated 2461 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:260
Finding

Unpinned Third-Party MCP Packages Are Downloaded and Executed Through npx

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (18)

Ssd 3

Critical
Category
Not specified by scanner
Confidence
99% confidence
Finding

The documented environment variable explicitly enables unredacted secret display in output, alongside high-verbosity/debug options. This creates a direct path to plaintext credential exposure in terminals, logs, screenshots, CI output, or shared support artifacts.

Content

No source excerpt is available for this finding.

Ssd 3

Critical
Category
Not specified by scanner
Confidence
100% confidence
Finding

The 'ultimate cheat code' intentionally combines settings for unredacted secrets, full model payload logging, cache tracing, and maximum verbosity. This is an explicit recipe for comprehensive exposure of credentials, prompts, responses, and potentially regulated data, making compromise or leakage highly likely.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
87% confidence
Finding

The memory preload and verbose/history-related features increase the amount of prior context and potentially sensitive content automatically surfaced to future sessions. In an agent skill, this raises the risk of inadvertent disclosure, over-retention, and propagation of secrets or private user data beyond the original context.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill describes device-auth bypass and privileged control options as usable configuration guidance, including a statement that bypass is already enabled on the node. Presenting authentication disablement and elevated scopes without prominent safety constraints increases the chance of unauthorized administrative access.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

This section documents settings that explicitly expose secrets and sensitive model payloads, but does not consistently frame them as dangerous, temporary diagnostics-only features with strict handling requirements. In a skill context, such guidance can normalize unsafe operation and lead users or agents to disclose credentials, prompts, or private data in logs and output.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

Trajectory and raw-stream capture to disk can record full user prompts, model outputs, tool arguments, tokens, and other sensitive interaction contents. Without strict safeguards, this creates durable local exfiltration and privacy risks well beyond transient debugging.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

This section gives direct instructions for querying the GCP metadata service to obtain access tokens, startup scripts, and SSH keys, while marketing it as a 'god key' and minimizing sensitivity. In practice, this is credential-access guidance that can enable cloud compromise and lateral movement if followed from a privileged VM.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

The skill explicitly instructs readers to obtain a live GCP access token from the instance metadata service. That is direct credential-access guidance and can immediately enable unauthorized API access under the VM's service account privileges.

Content

Scanner excerpt · SKILL.md (reported line 306)May include surrounding context.

Metadata Service (The God Key)

On any GCP VM, this API gives you:

bash
# Get a live, auto-rotating access token — NO KEY FILE NEEDED
curl -s -H "Metadata-Flavor: Google" \
  http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

Cloud Metadata Access

High
Category
Server-Side Request Forgery
Confidence
99% confidence
Finding

This is explicit guidance to access the cloud metadata endpoint for a service-account token, a classic high-impact SSRF target. In any agent or tool-capable environment, such instructions materially increase the risk of credential theft via internal request capabilities.

Content

Scanner excerpt · SKILL.md (reported line 308)May include surrounding context.

bash
# Get a live, auto-rotating access token — NO KEY FILE NEEDED
curl -s -H "Metadata-Flavor: Google" \
  http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

# Get the service account email
curl -s -H "Metadata-Flavor: Google" \

Cloud Metadata Access

High
Category
Server-Side Request Forgery
Confidence
96% confidence
Finding

The metadata email lookup reveals the active service account identity, which supports privilege enumeration and targeted follow-on abuse. While less severe than token retrieval, it is still sensitive internal metadata that should not be promoted in a general skill.

Content

Scanner excerpt · SKILL.md (reported line 312)May include surrounding context.

md
# Get the service account email
curl -s -H "Metadata-Flavor: Google" \
  http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/email

# Get scopes (what this SA can do)
curl -s -H "Metadata-Flavor: Google" \

Cloud Metadata Access

High
Category
Server-Side Request Forgery
Confidence
97% confidence
Finding

Querying metadata scopes aids attackers in understanding what the attached service account can access, enabling efficient privilege exploitation. In combination with token retrieval guidance in the same section, this materially supports cloud compromise.

Content

Scanner excerpt · SKILL.md (reported line 316)May include surrounding context.

md
# Get scopes (what this SA can do)
curl -s -H "Metadata-Flavor: Google" \
  http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/scopes

# Get startup script (may contain secrets)
curl -s -H "Metadata-Flavor: Google" \

Cloud Metadata Access

High
Category
Server-Side Request Forgery
Confidence
99% confidence
Finding

The startup-script metadata path may expose embedded secrets, bootstrap credentials, or sensitive infrastructure logic. Documenting this as a cheat code directly encourages secret harvesting from privileged cloud instances.

Content

Scanner excerpt · SKILL.md (reported line 320)May include surrounding context.

md
# Get startup script (may contain secrets)
curl -s -H "Metadata-Flavor: Google" \
  http://metadata.google.internal/computeMetadata/v1/instance/attributes/startup-script

# Get SSH keys
curl -s -H "Metadata-Flavor: Google" \

Cloud Metadata Access

High
Category
Server-Side Request Forgery
Confidence
98% confidence
Finding

The project SSH keys metadata path can reveal credentials or authorized access material for broader infrastructure access. Including it in an offensive-style cheat-sheet context substantially increases risk of unauthorized access and lateral movement.

Content

Scanner excerpt · SKILL.md (reported line 324)May include surrounding context.

Get SSH keys

curl -s -H "Metadata-Flavor: Google"
http://metadata.google.internal/computeMetadata/v1/project/attributes/sshKeys

text
**This is the biggest cheat code in GCP.** Every VM has this. The token auto-rotates every hour. No key files. No secrets manager. Just the metadata service.

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The documentation encourages direct use of short-lived access tokens in shell commands without sufficient warnings about handling, exposure in shell history, process listings, or logs. While legitimate in some admin workflows, presenting it casually in this skill increases the chance of credential leakage.

Content

Scanner excerpt · SKILL.md (reported line 343)May include surrounding context.

Short-Lived Tokens (No Key Files)

bash
# Get a 1-hour access token (no JSON key file needed)
gcloud auth print-access-token

# Use it directly

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The non-interactive repair command with auto-approval enables autonomous configuration changes without human review. In a powerful system-management skill, this can amplify mistakes or malicious prompting into unauthorized or destructive reconfiguration.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

openclaw crestodian --json # Full system state as JSON openclaw crestodian -m "fix my config" --yes # Non-interactive repair

text
The meta-controller that can reconfigure the entire system. `--yes` auto-approves config writes.

### Doctor Deep Scan

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

text
Enable these and any node (or external service) can call the gateway like an OpenAI-compatible API:
```bash
curl http://127.0.0.1:18789/v1/chat/completions \
  -H "Authorization: Bearer <gateway-token>" \
  -H "Content-Type: application/json" \
  -d '{"model":"openclaw","messages":[{"role":"user","content":"hello"}]}'

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 405)May include surrounding context.

bash
openclaw sandbox list              # List containers
openclaw sandbox explain           # Explain effective policy
openclaw sandbox recreate          # Force container rebuild

Debug Proxy (Full Traffic Capture)

External Transmission

Medium
Category
Data Exfiltration
Confidence
78% confidence
Finding

This cross-node chat example normalizes sending authenticated requests across sibling IPs in the mesh, expanding the trust boundary and creating opportunities for token misuse, interception, or lateral movement if network segmentation is weak. In this skill's broader 'mesh' context, cross-node invocation is more dangerous than a local loopback example.

Content

Scanner excerpt · SKILL.md (reported line 482)May include surrounding context.

Cross-Node Chat API

bash
curl http://<sibling-ip>:18789/v1/chat/completions \
  -H "Authorization: Bearer <gateway-token>" \
  -H "Content-Type: application/json" \
  -d '{"model":"openclaw","messages":[{"role":"user","content":"ping"}]}'

Static analysis

No suspicious patterns detected.