Security audit

Clack

Security checks for vulnerabilities and agentic risk

Overview

Clack’s voice relay purpose is clear, but its installer and service use broad root-level persistence and under-scoped network/authentication controls that need review before installation.

Install only after reviewing the scripts and preferably on a dedicated host. Avoid multi-user machines, restrict firewall and Tailscale ACLs tightly, protect and rotate relay/gateway tokens, and be cautious with clack update until the service runs under an unprivileged account with pinned dependencies and implemented rate limits.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (8)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup.sh:347
Finding: Root Command Execution Through Unsafe API-Key Interpolation
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/setup.sh:367
Finding: User-Modifiable Skill Code Is Persistently Executed as Root
Content: View full analysis
"$SERVICE_FILE" <
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/clack.sh:27
Finding: Unverified Mutable Updates Are Immediately Activated by a Privileged Service
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: server.py:977
Finding: Public Pairing Endpoint Lacks the Documented Brute-Force Protections
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: server.py:593
Finding: All Clients in the Tailscale Address Range Bypass Application Authentication
Content: View full analysis
bool: """Check if an IP is in the Tailscale CGNAT range (100.64.0.0/10).""" try: return ipaddress.ip_address(ip) in TAILSCALE_NETWORK except ValueError: return False CLACK_GUEST_TOKEN = os.getenv("CLACK_GUEST_TOKEN", "") def verify_token(token: str, client_ip: str = "") -> bool: """Verify auth token. Tailscale IPs bypass pairing. Non-Tailscale requires valid token.""" if is_tailscale_ip(client_ip): return True if not RELAY_AUTH_TOKEN: return False # No token configured = Tailscale-only mode if CLACK_GUEST_TOKEN and hmac.compare_digest(token, CLACK_GUEST_TOKEN): return True return hmac.compare_digest(token, RELAY_AUTH_TOKEN) ``` ### Technical Analysis The application treats every client whose apparent source address belongs to `100.64.0.0/10` as authenticated. An IP address in the carrier-grade NAT range is not a cryptographic identity and does not prove that the client is the intended phone or administrator. Any reachable peer on a shared or compromised tailnet receives access equivalent to possession of the relay token. The application does not verify Tailscale user identity, node identity, tags, or grants. ### Attack Path 1. An attacker controls a device that can reach the server over the relevant tailnet or otherwise reaches it with an accepted source address. 2. The attacker calls a protected endpoint without supplying a token. 3. `verify_token()` sees an address in `100.64.0.0/10` and returns `True`. 4. The attacker reads history or context, generates pairing codes, lists sessions, or opens a voice session. 5. The attacker can interact with the OpenClaw agent and consume configured provider servic ...[truncated 339 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: server.py:1241
Finding: Unbounded WebSocket Audio Buffer Permits Memory Exhaustion
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup.sh:361
Finding: Long-Lived Authentication Secrets Are Embedded in Service Files and URL Query Strings
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/setup.sh:189
Finding: Privileged Setup Installs Unpinned Python Dependencies
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (72)

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · CHANGELOG.md (reported line 6)May include surrounding context.
md
## 1.5.3 (2026-02-26) ### Security - **Tailscale APT install**: Replaced `curl | sh` with official APT repository for Tailscale installation - **Context sanitization**: User context is stripped to natural-language characters only (letters, numbers, common punctuation). IP addresses and domains are removed. Capped at 1000 characters. - **Provider keys in config.json**: API keys stored in `config.json` (chmod 600) instead of systemd environment variables

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The skill markets itself primarily as deployment/management for a relay server, but it also includes uninstall behavior and privileged modification/removal of system files and services. That gap is risky because destructive system changes may be triggered under a benign-sounding skill description, especially in an agent context where users may not expect service removal or config deletion.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill markets itself primarily as deployment/management for a relay server, but it also includes uninstall behavior and privileged modification/removal of system files and services. That gap is risky because destructive system changes may be triggered under a benign-sounding skill description, especially in an agent context where users may not expect service removal or config deletion.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.
md
Context is sanitized before saving — only natural-language characters are kept (letters, numbers, common punctuation). IP addresses and domains are stripped. The server returns the sanitized text in the response so the app can show the user exactly what will be sent as context. Context persists across calls and server restarts. Clear it via `DELETE /context` or by sending an empty `set_context` message. ## Conversation History

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.
md
Context is sanitized before saving — only natural-language characters are kept (letters, numbers, common punctuation). IP addresses and domains are stripped. The server returns the sanitized text in the response so the app can show the user exactly what will be sent as context. Context persists across calls and server restarts. Clear it via `DELETE /context` or by sending an empty `set_context` message. ## Conversation History

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.
md
- **Max messages:** 50 (configurable via `CLACK_MAX_HISTORY`) - History persists across calls and server restarts - Viewable via `GET /history`, clearable via `DELETE /history` ## Echo Test Mode

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.
md
- **Max messages:** 50 (configurable via `CLACK_MAX_HISTORY`) - History persists across calls and server restarts - Viewable via `GET /history`, clearable via `DELETE /history` ## Echo Test Mode

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.
md
| `GET /voices` | GET | Yes | List available TTS voices | | `GET /sessions` | GET | Yes | List active sessions | | `GET /history` | GET | Yes | Get conversation history | | `DELETE /history` | DELETE | Yes | Clear conversation history | | `GET /context` | GET | Yes | Get current user context | | `PUT /context` | PUT | Yes | Set user context (query param `text`) | | `POST /context` | POST | Yes | Set user context (JSON body `{"text": "..."}`) |

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · scripts/pair.sh (reported line 29)May include surrounding context.
sh
fi # Generate pairing code RESPONSE=$(curl -s "http://localhost:${PORT}/pair?token=${RELAY_AUTH_TOKEN}") CODE=$(echo "$RESPONSE" | python3 -c "import sys,json; print(json.load(sys.stdin)['code'])" 2>/dev/null) if [[ -z "$CODE" ]]; then

Ssd 1

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The service accepts a client-supplied systemPrompt and uses it as the session’s top-level instruction, allowing any client to redefine safeguards and behavior. This defeats the server’s own protective prompt and makes jailbreaks, unsafe actions, and policy bypass straightforward.
Content: No source excerpt is available for this finding.

Ssd 1

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Untrusted context text is concatenated directly into the system prompt, giving user-supplied content system-level influence over downstream model behavior. In a voice-agent bridge, this can subvert safety rules, bias decisions, exfiltrate retained information, or manipulate future sessions because the context is also persisted.
Content: No source excerpt is available for this finding.

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · scripts/server.py (reported line 842)May include surrounding context.
python
session.update_context(ctx_text) await session.send_json({"type": "context_updated", "text": ctx_text}) else: # Clear context session.user_context = {} if CONTEXT_FILE.exists(): CONTEXT_FILE.unlink()

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · server.py (reported line 1136)May include surrounding context.
python
session.update_context(ctx_text) await session.send_json({"type": "context_updated", "text": ctx_text}) else: # Clear context session.user_context = {} if CONTEXT_FILE.exists(): CONTEXT_FILE.unlink()

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/setup.sh (reported line 230)May include surrounding context.
sh
if ! command -v tailscale &>/dev/null; then echo "" echo "Installing Tailscale via APT..." curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.noarmor.gpg | tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.tailscale-keyring.list | tee /etc/apt/sources.list.d/tailscale.list >/dev/null apt-get update -qq apt-get install -y -qq tailscale > /dev/null 2>&1

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/setup.sh (reported line 231)May include surrounding context.
sh
if ! command -v tailscale &>/dev/null; then echo "" echo "Installing Tailscale via APT..." curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.noarmor.gpg | tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.tailscale-keyring.list | tee /etc/apt/sources.list.d/tailscale.list >/dev/null apt-get update -qq apt-get install -y -qq tailscale > /dev/null 2>&1

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/setup.sh (reported line 287)May include surrounding context.
sh
if ! command -v tailscale &>/dev/null; then echo "" echo "Installing Tailscale via APT..." curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.noarmor.gpg | tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.tailscale-keyring.list | tee /etc/apt/sources.list.d/tailscale.list >/dev/null apt-get update -qq apt-get install -y -qq tailscale > /dev/null 2>&1

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/setup.sh (reported line 288)May include surrounding context.
sh
if ! command -v tailscale &>/dev/null; then echo "" echo "Installing Tailscale via APT..." curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.noarmor.gpg | tee /usr/share/keyrings/tailscale-archive-keyring.gpg >/dev/null curl -fsSL https://pkgs.tailscale.com/stable/ubuntu/noble.tailscale-keyring.list | tee /etc/apt/sources.list.d/tailscale.list >/dev/null apt-get update -qq apt-get install -y -qq tailscale > /dev/null 2>&1

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/uninstall.sh (reported line 12)May include surrounding context.
sh
echo "Stopping clack service..." systemctl stop clack 2>/dev/null || true systemctl disable clack 2>/dev/null || true rm -f /etc/systemd/system/clack.service systemctl daemon-reload echo " ✓ Service removed" else

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/uninstall.sh (reported line 25)May include surrounding context.
sh
# Remove CLI symlink if [[ -L /usr/local/bin/clack ]]; then rm -f /usr/local/bin/clack echo " ✓ 'clack' command removed" fi

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/uninstall.sh (reported line 45)May include surrounding context.
sh
# Remove venv if [[ -d "$SKILL_DIR/venv" ]]; then rm -rf "$SKILL_DIR/venv" echo " ✓ Python venv removed" fi

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The authentication logic allows unauthenticated WebSocket access when no relay token is configured by treating 'no token' as implicitly allowed, even though the startup log suggests otherwise. This can expose the voice relay, STT/TTS usage, history, and downstream OpenClaw interaction to any reachable client if the service is internet-accessible or mis-networked.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · CHANGELOG.md (reported line 8)May include surrounding context.
md
### Security - **Tailscale APT install**: Replaced `curl | sh` with official APT repository for Tailscale installation - **Context sanitization**: User context is stripped to natural-language characters only (letters, numbers, common punctuation). IP addresses and domains are removed. Capped at 1000 characters. - **Provider keys in config.json**: API keys stored in `config.json` (chmod 600) instead of systemd environment variables ### Features - **Sanitized context returned to client**: All context endpoints (PUT, POST, WebSocket) return the sanitized text so the app can show users exactly what is stored

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/setup.sh (reported line 359)May include surrounding context.
sh
### Security - **Tailscale APT install**: Replaced `curl | sh` with official APT repository for Tailscale installation - **Context sanitization**: User context is stripped to natural-language characters only (letters, numbers, common punctuation). IP addresses and domains are removed. Capped at 1000 characters. - **Provider keys in config.json**: API keys stored in `config.json` (chmod 600) instead of systemd environment variables ### Features - **Sanitized context returned to client**: All context endpoints (PUT, POST, WebSocket) return the sanitized text so the app can show users exactly what is stored

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The README instructs users to run a repository-controlled setup script with sudo bash, which grants full root privileges to whatever code is in the cloned repo. Even if the project is legitimate, this creates a real supply-chain and privilege-escalation risk because a compromised repo, malicious commit, or unsafe setup logic would execute as root on the host.
Content: Scanner excerpt · README.md (reported line 46)May include surrounding context.
bash
git clone https://github.com/fbn3799/clack-skill.git ~/.openclaw/skills/clack sudo bash ~/.openclaw/skills/clack/scripts/setup.sh

This clones the repo and runs the interactive setup.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 89)May include surrounding context.
md
## Configuration Service configuration is via environment variables (set in the systemd service file). Provider API keys are stored separately in `config.json` (created by the setup script). | Variable | Default | Description | |----------|---------|-------------|

Static analysis

No suspicious patterns detected.