ClawHub
Back to skill

Security audit

V2ray Proxy

Security checks for vulnerabilities and agentic risk

Overview

This is a real V2Ray proxy helper, but it uses an unsafe eval-based command wrapper and changes the user's shell profile without clear opt-in.

Review this before installing. It is purpose-aligned for managing a local V2Ray proxy, but the command wrapper should not be used with untrusted URLs, filenames, branch names, or user input, and the script may leave a persistent marker in ~/.bashrc. Prefer a version that removes eval, tracks its own V2Ray PID instead of using pkill -f, and makes any shell-profile changes explicit and reversible.

A.I.G

Vulnerability Patterns
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/v2ray-proxy.sh:173
Finding

Shell Command Injection Through eval in the Command Wrapper

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Note
Location
scripts/v2ray-proxy.sh:83
Finding

Implicit Persistent Modification of the User Shell Profile

Content
View full analysis
/dev/null; then echo "" >> ~/.bashrc echo "# V2Ray Proxy (managed by OpenClaw)" >> ~/.bashrc echo "export V2RAY_PROXY=1" >> ~/.bashrc fi ``` ### Technical Analysis The comment describes persistence as optional, but `enable_system_proxy` modifies `~/.bashrc` automatically whenever the marker is absent. The `on`, `auto`, `ensure`, and proxy-dependent `wrap` workflows can reach this function without a separate persistence opt-in. This change survives completion of the script and affects future interactive Bash sessions. The corresponding disable operation only unsets variables in the current child process and does not remove the inserted profile content. The persisted value does not itself enable the HTTP proxy or execute an external payload, so this is not evidence of a backdoor; the issue is unauthorized and incomplete management of persistent user state. The marker check is also imprecise. Any unrelated occurrence of `V2RAY_PROXY` prevents insertion, while the script has no reliable ownership marker or uninstall procedure for content it previously added. ### Attack Path 1. A user or automation invokes `on`, `auto`, `ensure`, or a `wrap` operation that requires the proxy. 2. Execution reaches `enable_system_proxy`. 3. If `~/.bashrc` does not contain `V2RAY_PROXY`, the script appends new shell-profile content. 4. The added export is loaded by future interactive Bash sessions. 5. Running `off` or `disable-sys` does not remove the persistent entry. ### Impact Assessment The script can alter persistent user configuration without explicit consent. The current inserted statement only defines `V2RAY_PROXY=1`, limiting direct security impact, but it can cause sta ...[truncated 209 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/v2ray-proxy.sh:53
Finding

Broad Process Matching Can Terminate Unrelated Applications

Content
View full analysis
Remediation
View remediation
/exe` resolves to the expected executable. 3. Verify the expected configuration path or process start time to defend against PID reuse. 4. Send `TERM`, wait for a bounded period, and use `KILL` only if necessary. 5. Remove stale PID files safely after confirmed shutdown. 6. Avoid `pgrep -f` and `pkill -f` for lifecycle ownership. Where supported, prefer a dedicated systemd user service and use `systemctl --user start/stop` so the service manager tracks the exact process group. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (11)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
85% confidence
Finding

The YARA hit is not evidence of malware by itself, but the matched behavior is real: the script appends to ~/.bashrc to create persistence. In this context it is concerning because the persistence is unnecessary for basic proxy toggling, not clearly disclosed, and can influence future shells and network behavior unexpectedly.

Content

Scanner excerpt · scripts/v2ray-proxy.sh (reported line 92)May include surrounding context.

sh
proxy="$PROXY_URL"
    export HTTP_PROXY="$PROXY_URL"
    export HTTPS_PROXY="$PROXY_URL"
    
    # 设置no_proxy（跳过本地地址）
    export no_proxy="localhost,127.0.0.1,::1,*.local"
    export NO_PROXY="$no_proxy"
    
    log_info "系统代理已开启: http_proxy=$PROXY_URL"
    
    # 持久化到bashrc（可选）
    if ! grep -q "V2RAY_PROXY" ~/.bashrc 2>/dev/null; then
        echo "" >> ~/.bashrc
        echo "# V2Ray Proxy (managed by OpenClaw)" >> ~/.bashrc
        echo "export V2RAY_PROXY=1" >> ~/.bashrc
    fi
}

# 清除系统代理
disable_system_proxy() {
    log_info "清除系统代理..."
    
    unset http_proxy https_proxy HTTP_PROXY HTTPS_PROXY
    unset no_proxy NO_PROXY
    
    log_info "系统代理已清除"
}

# 测试代理连接
test_proxy() {
    log_info "测试代理连接..."
    
    # 测试直连
    local direct_result=$(curl -s --connect-timeout 5 -o /dev/null -w "%{http_code}" https://www.google.com 2>/dev/null || echo "000")

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The wrap() function turns a proxy-management script into a generic command launcher by passing user-supplied input to eval. That greatly broadens the skill's capability beyond its stated purpose and creates command-injection risk if any caller passes untrusted or improperly quoted arguments, especially in an agent-driven environment where command strings may be constructed dynamically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README advertises automatic enabling/disabling of the system proxy, but does not clearly warn that this changes system-wide network behavior for other applications and may reroute or disrupt unrelated traffic. In a proxy-management skill, this omission is safety-relevant because users may invoke it expecting only local or per-command effects and unintentionally expose traffic to the configured proxy or break connectivity.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises shell-based operations but does not declare any tool scope or permission boundaries. This weakens reviewability and least-privilege controls, making it easier for an agent or user to invoke system-modifying commands without an explicit trust signal about what tools and side effects are expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill describes automatic proxy management but does not clearly warn that it changes system-wide proxy settings. Users may trigger it expecting an isolated networking change, while the script can redirect traffic for other applications, affecting confidentiality, availability, and troubleshooting across the host.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/v2ray-proxy.sh (reported line 38)May include surrounding context.

sh
log_info "启动 V2Ray..."
    cd "$V2RAY_DIR"
    nohup ./v2rayN > /dev/null 2>&1 &
    sleep 2
    
    if is_running; then

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script persistently modifies ~/.bashrc even though the described skill behavior is temporary proxy management. Undisclosed shell startup modification creates unexpected persistence, can affect future sessions, and in an agent context is more dangerous because it changes user environment outside the immediate command scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Persistent modification of ~/.bashrc is performed without prominent user-facing disclosure, so users may not realize the script leaves lasting changes after use. In this skill context, hidden persistence is riskier because proxy configuration affects later shells and network behavior beyond the immediate task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script executes arbitrary shell text through eval in wrap() without any explicit warning or safety boundary. In practice, the danger is not merely missing warning text but that shell metacharacters, substitutions, and concatenated input can be interpreted, enabling unintended command execution if upstream input is attacker-controlled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README states that the skill automatically tests reachability to external sites such as github.com and google.com, but does not disclose that this creates outbound network requests that may reveal usage patterns, trigger monitoring, or violate restricted-network expectations. In this context the behavior is expected for connectivity detection, but the missing privacy/network notice still creates a real transparency and policy risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The natural-language content is entirely in Chinese and does not indicate that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking context. Under the policy, forcing a specific language without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.