T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:40- Finding
Unverified Remote Installer Executed Directly Through a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Peer via Tailscale
Security checks for vulnerabilities and agentic risk
Overview
This skill has a coherent peer-agent networking purpose, but its defaults expose gateways broadly and persist sensitive tokens in plaintext.
Install only after reviewing and tightening the setup: bind OpenClaw to the Tailscale IP instead of 0.0.0.0, require strong gateway authentication, avoid storing gateway tokens in peer-config.md, use one-time short-lived Tailscale auth keys, do not disable the whole Windows Firewall, and avoid the curl-to-sh installer path unless you independently verify it.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:70- Finding
OpenClaw Gateway Bound to Every Network Interface
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/peer_config.py:119- Finding
Gateway Bearer Tokens Collected Interactively and Stored in Plaintext Markdown
- Content
View full analysis
'} **Tailscale IP:** {peer_tailscale_ip} **Gateway URL:** {peer_gateway_url} **Gateway Token:** {peer_token} ``` File creation at `scripts/peer_config.py:205-208`: ```python os.makedirs("peer-agent", exist_ok=True) output_path = os.path.join("peer-agent", "peer-config.md") with open(output_path, "w", encoding="utf-8") as f: f.write(config_content) ``` ### Technical Analysis The script uses `input()` for gateway bearer tokens, causing the secrets to remain visible on the terminal while entered. It then interpolates both parties' tokens into a Markdown document and writes the document with permissions determined by the user's current umask. No explicit restrictive file mode is applied. The file resides under the project workspace, where it may be read by other local users, agent tools, editor extensions, indexing services, backup software, or source-control operations. The generated quick-reference exampl ...[truncated 1331 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/troubleshooting.md:32- Finding
Troubleshooting Guidance Disables All Windows Firewall Profiles
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/tailscale-setup.md:67- Finding
Reusable Tailscale Enrollment Key Recommended and Exposed on the Command Line
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (15)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The skill instructs users to execute a remote shell script directly via curl | sh, which bypasses normal review of fetched code and creates an obvious supply-chain execution risk. In a security-sensitive networking setup, this is especially dangerous because compromise of the download path, hosting, or a copy-pasted variant could lead to arbitrary code execution on the host.
- Content
md # Download and install Tailscale winget install Tailscale.Tailscale # Windows # or: brew install tailscale # macOS # or: curl -fsSL https://tailscale.com/install.sh | sh # Linux # Start Tailscale and authenticate tailscale up --accept-routes
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
Piping a remotely fetched installer script directly into
shexecutes unreviewed code from the network with the user's privileges, creating a supply-chain and man-in-the-middle risk if the source or transport is compromised. In an agent networking skill, this is especially sensitive because the installed software controls network connectivity and trust relationships between hosts.- Content
Linux (Ubuntu/Debian)
bash curl -fsSL https://tailscale.com/install.sh | sh tailscale up --accept-routes
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
The
| shpattern is a dangerous command-chaining construct because it immediately executes whatever bytes are returned by the remote server, eliminating an inspection step and amplifying the impact of compromise. This makes accidental or malicious code execution on the host much more likely.- Content
Linux (Ubuntu/Debian)
bash curl -fsSL https://tailscale.com/install.sh | sh tailscale up --accept-routes
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill includes operational instructions that use shell commands and direct file creation/configuration, but it declares no explicit tool scope or allowed-tools boundary. That omission can cause an agent platform to invoke the skill in contexts where shell or file-write actions are not expected, increasing the chance of unintended command execution or unsafe modification.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The manifest description includes generic triggers such as "connect two agents" and "peer agents," which are broad natural-language phrases that could overlap with ordinary discussion rather than a clear invocation intent. The file does not provide negative examples or constraints to clarify when these phrases should or should not activate the skill.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill recommends binding the OpenClaw gateway to 0.0.0.0, which exposes the service on every network interface rather than only the Tailscale interface. In the context of an agent gateway that accepts remote sessions_send traffic, this broadens the reachable attack surface and could permit access from unintended local networks or internet-exposed interfaces if firewalling is misconfigured.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The instructions recommend generating and sharing a reusable auth key without clearly stating that the key grants admission to the tailnet and should be tightly scoped, time-limited, and revoked after use. In a cross-machine agent collaboration skill, compromise of that key could give an untrusted device persistent network access to agent hosts and their exposed services.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The guide expands beyond agent-to-agent connectivity into general-purpose file sharing and proxying, which materially increases the attack surface of the tailnet. In this skill context, encouraging ad hoc HTTP serving and proxy use can enable unintended data exposure or misuse of the peer machine as a network pivot.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Suggesting
python3 -m http.server 9000without warning exposes the current working directory to other devices on the tailnet, which can unintentionally publish sensitive files. In this skill, where the goal is agent collaboration, users may run the command from a project or home directory and leak credentials, models, logs, or source code.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The troubleshooting guide instructs users to disable Windows Firewall across all profiles as a test step, which weakens host protections and can expose unrelated services to the network if users forget to re-enable it. In this skill's context, the risk is elevated because it is specifically about making a network-accessible gateway reachable over Tailscale, so users are already changing bind settings and opening connectivity paths.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python if os.path.exists("/usr/local/bin/tailscale") or os.path.exists("/usr/bin/tailscale"): import subprocess try: result = subprocess.run( ["tailscale", "ip", "-4"], capture_output=True, text=True,
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python if os.path.exists("/usr/local/bin/tailscale") or os.path.exists("/usr/bin/tailscale"): import subprocess try: result = subprocess.run( ["tailscale", "ip", "-4"], capture_output=True, text=True,
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script explicitly asks for both agents' gateway tokens and persists them into
peer-agent/peer-config.mdin plaintext along with reachable gateway URLs and agent IDs. Those credentials appear sufficient to send messages to peer agents, so compromise of the file, accidental sharing, backup leakage, or source-control commit could enable unauthorized agent access or impersonation.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The generated markdown file contains sensitive credentials and internal network connection details in cleartext, yet the script presents this as a normal collaboration artifact and even instructs users to share sections of it. In this skill's context—connecting autonomous agents across machines—plaintext tokens and network endpoints materially increase the blast radius of accidental disclosure, unauthorized cross-agent messaging, and lateral movement within the Tailscale network.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The shared log example uses the Chinese pronoun "你" in otherwise English guidance, which implicitly introduces a language choice in the skill documentation. There is no opt-in, explanation, or region-specific justification for this locale shift, so it can violate a language consistency policy.
- Content