ClawHub
Back to skill

Security audit

connect-to-another-openclaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real remote OpenClaw admin tool, but it needs review because it can use SSH credentials, kill or restart remote services, and install skills locally or remotely with weak safeguards.

Install only if you intend to give this skill administrative SSH access to a specific trusted OpenClaw server. Use a dedicated least-privilege SSH key and non-root account, avoid --yes, review every skill before syncing, do not run sync-to-local against untrusted or compromised hosts, and treat fix-port as disruptive because it can kill matching processes and restart the remote gateway.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (14)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"""Run a remote command via SSH and return (returncode, stdout, stderr)"""
        full_cmd = self.ssh_base + [cmd]
        try:
            proc = subprocess.run(full_cmd, capture_output=True, text=True, timeout=timeout)
            return proc.returncode, proc.stdout, proc.stderr
        except subprocess.TimeoutExpired:
            return -1, "", f"SSH command timed out after {timeout}s"
Confidence
94% confidence
Finding
The SSH wrapper executes arbitrary shell command strings on the remote host, and several callers build those strings with untrusted values such as skill names, log filters, and ports. While subprocess.run is invoked without a local shell, the remote ssh target still interprets the final argument as a shell command, so this becomes remote command injection on the managed server.

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Content
if args.yes or input("Continue? (y/N): ").lower() == 'y':
            for s in to_install:
                print(f"Installing {s}...")
                result = os.system(f"skillhub install {s} 2>&1 | tail -3")
                if result != 0:
                    print(f"  ⚠️  Installation may have failed")
            print("Done. Re-run with 'diff' to verify.")
Confidence
99% confidence
Finding
The code uses os.system with an f-string containing a skill name derived from file/remote data, which allows shell metacharacters in a crafted skill name to execute arbitrary local commands. Because this runs on the local machine during sync-to-local, a malicious remote server or tampered skills list could achieve local command execution.

Description-Behavior Mismatch

Medium
Confidence
88% confidence
Finding
The skill is presented as remote OpenClaw management, but sync-to-local installs software on the operator's local machine based on remote state. This scope expansion is dangerous because users may expect remote-only actions and may unknowingly permit local package installation from an untrusted or compromised remote host.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The port-fix logic kills remote processes by pattern using pkill, which can terminate unrelated services that merely match the command line. In a remote administration context, this exceeds simple status checking and introduces destructive behavior that can disrupt production workloads or be abused to cause denial of service.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The README documents a `fix-port` workflow that can kill remote processes and restart the gateway, but it does not clearly warn about service disruption, accidental termination of legitimate processes, or the need to verify the target before acting. In a remote-management skill, this is materially risky because users may run the command against production hosts and cause outages.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The `fix-port` workflow performs destructive remote administration by killing processes and restarting the remote gateway, but the description presents it as an automatic fix without a strong warning about service disruption. In a remote-management context, this can interrupt legitimate SSH tunnels or production services and may be triggered by an unsuspecting user without understanding the blast radius.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The sync actions move and install skills between local and remote systems, affecting both environments, but the skill description does not clearly warn that this can import unreviewed code or modify the remote server state. Because skills are executable artifacts, synchronization can become a supply-chain path for propagating risky or malicious capabilities across trust boundaries.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The fix-port action proceeds to kill processes and restart the remote gateway with no meaningful warning about service interruption or collateral impact. Even if intended for maintenance, this can unexpectedly disrupt active sessions and availability on the remote OpenClaw server.

Missing User Warnings

Low
Confidence
77% confidence
Finding
The log tail feature prints remote logs directly to local output, and these logs may contain tokens, identifiers, chat content, or operational details. In a remote management skill, exposing such contents without warning or redaction increases the risk of accidental sensitive-data disclosure.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The manifest advertises broad remote administrative capabilities such as health checks, fixing port conflicts, syncing skills, and monitoring channels without narrowing when or how those actions may be invoked. In an agent ecosystem, this creates dangerous ambiguity that can enable high-impact operations against arbitrary remote hosts with insufficient user understanding or policy gating.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The manifest describes impactful remote actions like fix-port, sync-to-local, sync-to-remote, and tail-logs without warning that they may modify systems, overwrite data, expose sensitive logs, or disrupt service. For a remote admin skill, the lack of user-facing warnings increases the chance of unsafe invocation and lowers operator awareness at the point of use.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
"name": "yes",
      "type": "boolean",
      "default": false,
      "description": "Auto-confirm prompts without asking"
    }
  ],
  "environment": {
Confidence
84% confidence
Finding
The manifest explicitly supports automatic confirmation 'without asking,' which is unsafe when combined with remote admin features that can alter another server. This weakens human-in-the-loop safeguards and makes accidental or adversarially induced execution more likely to have operational consequences.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
"name": "yes",
      "type": "boolean",
      "default": false,
      "description": "Auto-confirm prompts without asking"
    }
  ],
  "environment": {
Confidence
84% confidence
Finding
The manifest explicitly supports automatic confirmation 'without asking,' which is unsafe when combined with remote admin features that can alter another server. This weakens human-in-the-loop safeguards and makes accidental or adversarially induced execution more likely to have operational consequences.

Credential Access

High
Category
Privilege Escalation
Content
{
      "name": "key",
      "type": "string",
      "default": "~/.ssh/id_rsa",
      "description": "Path to SSH private key"
    },
    {
Confidence
89% confidence
Finding
Defaulting to ~/.ssh/id_rsa encourages use of a highly privileged personal SSH private key for remote administration, increasing the likelihood that sensitive credentials are used implicitly and against arbitrary hosts. In the context of a remote-management skill, this can lead to credential misuse, lateral movement, or accidental disclosure if the key path is accessed, logged, or applied to untrusted systems.

Static analysis

No suspicious patterns detected.