ClawHub
Back to skill

Security audit

ClawRoam

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate sync purpose, but its implementation has high-impact security and scoping problems that should be reviewed before installation.

Do not install this skill on a machine with sensitive OpenClaw data until the maintainer fixes the cloud authentication flow, removes curl-to-bash installers and eval-based package installs, restores SSH host key verification, and replaces broad OpenClaw directory mirroring with an explicit allowlist. If you test it, use a throwaway vault, a non-sensitive provider account, and no private credentials or session files.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (6)

T03 · Remote Payload Retrieval and Execution

Error
Location
providers/dropbox.sh:12
Finding

Unverified Remote Installer Is Executed with Root Privileges

Content
View full analysis
/dev/null || curl https://rclone.org/install.sh | bash ;; Linux) curl https://rclone.org/install.sh | sudo bash ;; ``` ```bash # providers/gdrive.sh:30-31 Darwin) brew install rclone 2>/dev/null || curl https://rclone.org/install.sh | bash ;; Linux) curl https://rclone.org/install.sh | sudo bash ;; ``` ```bash # providers/s3.sh:11 case "$(uname -s)" in Darwin) brew install rclone 2>/dev/null || curl https://rclone.org/install.sh | bash ;; Linux) curl https://rclone.org/install.sh | sudo bash ;; esac ``` ```bash # providers/webdav.sh:11 case "$(uname -s)" in Darwin) brew install rclone 2>/dev/null || curl https://rclone.org/install.sh | bash ;; Linux) curl https://rclone.org/install.sh | sudo bash ;; esac ``` ### Technical Analysis These provider setup functions download a mutable shell script and immediately execute it. The downloaded content is not pinned to a particular version and is not verified using a cryptographic checksum or trusted release signature. On Linux, the downloaded script is passed to `sudo bash`, granting the remote payload root privileges. Although `rclone.org` is the expected upstream domain, this design makes DNS, TLS trust, upstream hosting, and the mutable installer script part of the trusted execution boundary. This exceeds the minimum privileges needed to configure a storage provider. Installing `rclone` does not inherently require executing arbitrary, unreviewed network content as root. ### Attack Path 1. A user selects Dropbox, Google Drive, S3, or WebDAV. 2. The system does not have `rclone` installed. 3. Provider setup downloads `https://rclone.org/install.sh`. 4. An up ...[truncated 671 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
cloud-api-worker/src/index.ts:259
Finding

Existing Cloud Accounts Can Be Taken Over Through the Public Signup Endpoint

Content
View full analysis
{ const body = await c.req.json<{ email: string; public_key: string; hostname?: string; os?: string; instance_id?: string }>(); if (!body.email) return c.json({ error: "email required" }, 400); const db = c.env.DB; const existing = await db.prepare( "SELECT id FROM vaults WHERE email = ?" ).bind(body.email).first<{ id: string }>(); if (existing) { if (body.public_key) { const fp = await computeFingerprintAsync(body.public_key); const dup = await db.prepare( "SELECT id FROM vault_keys WHERE vault_id = ? AND fingerprint = ? AND revoked_at IS NULL" ).bind(existing.id, fp).first(); if (!dup) await db.prepare( "INSERT INTO vault_keys (id, vault_id, public_key, fingerprint, hostname, instance_id) VALUES (?, ?, ?, ?, ?, ?)" ).bind( crypto.randomUUID(), existing.id, body.public_key, fp, body.hostname || "", body.instance_id || "" ).run(); } return c.json({ vault_id: existing.id, status: "existing" }); } ``` ### Technical Analysis The public signup endpoint looks up an existing vault solely by email address. If the account exists, it registers the caller's public key without requiring: - Proof of email ownership. - A signature from an existing authorized key. - An authenticated recovery token. - Administrator approval. - Any other account authentication. The endpoint also returns the existing account's vault ID. Consequently, knowledge of a victim's email address is sufficient to add an attacker-controlled Ed25519 key to the victim's vault. The new key is treated as an ordinary active vault key by `authenticateVault`, allowing the attacker to ...[truncated 1264 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
cloud-api-worker/src/index.ts:248
Finding

Dashboard Authentication Treats Email Address and Vault ID as Credentials

Content
View full analysis
{ const { email, vault_id } = await c.req.json<{ email: string; vault_id: string }>(); if (!email || !vault_id) return c.json({ error: "email and vault_id required" }, 400); const vault = await c.env.DB.prepare( "SELECT id, email FROM vaults WHERE id = ? AND email = ?" ).bind(vault_id, email).first<{ id: string; email: string }>(); if (!vault) return c.json({ error: "Invalid credentials" }, 401); const now = Math.floor(Date.now() / 1000); const token = await signJWT( { vault_id, email, iat: now, exp: now + 86400 }, c.env.JWT_SECRET ); return c.json({ token, vault_id, email, expires_in: 86400 }); }); ``` ### Technical Analysis The endpoint issues a 24-hour bearer token after checking only that an email address corresponds to a vault ID. Neither value is a secret authentication factor. There is no password, email challenge, Ed25519 challenge-response, WebAuthn assertion, or other proof that the requester owns the vault. The signup vulnerability separately discloses an existing user's vault ID when supplied with their email, making the two defects directly chainable. The returned JWT is accepted by the common `auth` function for vault-wide dashboard operations. ### Attack Path 1. The attacker obtains or guesses a victim's email address. 2. The attacker calls the vulnerable signup endpoint and receives the corresponding vault ID. 3. The attacker submits the email and vault ID to `/v1/dashboard/auth`. 4. The endpoint issues a valid 24-hour JWT. 5. The attacker sends `Authorization: Bearer ` to protected API endpoints. 6. The common authorization function accepts the token as dashboard-level access to the victim's vault. ### Impact Assessment The ...[truncated 557 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
src/sync-engine.sh:151
Finding

Default Synchronization Copies the Entire OpenClaw Directory Contrary to the Declared Opt-In Scope

Content
View full analysis
/dev/null | head -1 | awk '{print $2}' | tr -d '"') if [[ -z "$openclaw_dir" || ! -d "$openclaw_dir" ]]; then return 0 fi # Mirror entire openclaw directory into vault (excluding .git and runtime files) mkdir -p "$VAULT_DIR/openclaw" rsync -a --delete \ --exclude '.git/' \ --exclude 'node_modules/' \ --exclude '*.swp' \ --exclude '*.swo' \ "$openclaw_dir/" "$VAULT_DIR/openclaw/" 2>/dev/null || true } ``` ### Technical Analysis The documented synchronization policy states that OpenClaw configuration and credentials are opt-in. The implementation instead mirrors almost the entire OpenClaw directory during every push. Only Git metadata, `node_modules`, and editor swap files are excluded. There is no allowlist for the documented files and no default exclusion for credential stores, tokens, sessions, runtime state, channel authentication, private configuration, or other unknown sensitive files. The mirrored data is placed under `~/.clawroam/openclaw`. Provider push operations then include that directory unless separately excluded. The managed cloud provider encrypts its archive, but the examined BYOS providers synchronize vault files directly and do not apply equivalent ClawRoam archive encryption. ### Attack Path 1. OpenClaw stores configuration, credentials, session state, or another sensitive file inside its main directory. 2. The user initializes ClawRoam. 3. The user starts synchronization or performs a manual push. 4. `sync_from_openclaw` recursively mirrors the OpenClaw directory into the vault. 5. The configured provider uploads the mirrored `openclaw/` directory. 6. Anyone with access to the provider storage ma ...[truncated 590 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
track-packages.sh:275
Finding

Synchronized Package Names Are Executed Through Shell Eval

Content
View full analysis
/dev/null | grep '^\s*- name:' | awk -F'"' '{print $2}') for pkg in $mgr_pkgs; do if echo "$missing" | grep -qx "$pkg"; then mgr_missing="$mgr_missing $pkg" fi done if [[ -n "$mgr_missing" ]]; then local cmd="" case "$mgr" in brew) cmd="brew install$mgr_missing" ;; apt) cmd="sudo apt install -y$mgr_missing" ;; npm_global) cmd="npm install -g$mgr_missing" ;; pip_global) cmd="pip3 install$mgr_missing" ;; snap) cmd="sudo snap install$mgr_missing" ;; flatpak) cmd="flatpak install$mgr_missing" ;; esac if [[ -n "$cmd" ]]; then echo "Install command ($mgr):" echo " $cmd" echo "" read -rp "Run this command? [y/N]: " yn if [[ "$yn" =~ ^[Yy] ]]; then eval "$cmd" || log "Some packages failed to install" fi fi fi done ``` ### Technical Analysis Package names are extracted from a synchronized requirements file and concatenated into a shell command string. The string is then executed using `eval`. `eval` causes shell metacharacters, command substitutions, redirections, pipes, and separators inside a package name to be interpreted as shell syntax. A package entry such as a name containing `;`, `$(...)`, or backticks can therefore execute arbitrary commands. The user confirmation prompt does not neutralize the input. It only asks whether the already constructed command should run, and users may reasonably trust package data restored by the Skill. ### Attack Path 1. An attacker obtains write access to remote vault data or exploits the cloud account-take ...[truncated 1002 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
providers/ftp.sh:45
Finding

SSH Server Identity Verification Is Disabled for SFTP and Git Providers

Content
View full analysis
/dev/null || true rsync -avz -e "ssh -i $key -p $port -o StrictHostKeyChecking=no" \ $EXCLUDE "$VAULT_DIR/" "$user@$host:$target_path/" 2>&1 | tail -3 ``` ```bash # providers/ftp.sh:58-64 if ! ssh -i "$key" -p "$port" -o StrictHostKeyChecking=no \ "$user@$host" "ls '$rpath/profiles'" &>/dev/null; then source_path="$rpath" log "No profiles found, falling back to root..." fi rsync -avz -e "ssh -i $key -p $port -o StrictHostKeyChecking=no" \ --exclude local/ "$user@$host:$source_path/" "$d/" 2>&1 | tail -3 ``` ```bash # providers/git.sh:8 _git() { GIT_SSH_COMMAND="ssh -i $VAULT_DIR/keys/clawroam_ed25519 -o StrictHostKeyChecking=no" \ git -C "$REPO_DIR" "$@" } ``` ```bash # providers/git.sh:33 GIT_SSH_COMMAND="ssh -i $VAULT_DIR/keys/clawroam_ed25519 -o StrictHostKeyChecking=no" \ git clone "$remote_url" "$REPO_DIR" 2>/dev/null || { ``` ### Technical Analysis `StrictHostKeyChecking=no` causes SSH to accept unknown host keys without requiring meaningful user verification. This weakens the server-authentication property of SSH, particularly during first use, DNS redirection, or connections from an environment with a compromised `known_hosts` state. Although public-key authentication protects the client's private key from being directly transmitted, it does not ensure that vault content is sent to the intended server when host identity verification is bypassed. The FTP provider name is also misleading: its implementation is effectively SFTP/SSH through `rsync`, and secure SSH host authentication is therefore essential. ### Attack Path 1. A user configures an SSH Git or SFTP provider. 2. An ...[truncated 1126 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (137)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

A tool described as automatic encrypted vault sync but functioning as a manual package-tracking and package-execution utility is a substantial trust mismatch. Users may invoke it expecting benign backup behavior while actually granting execution paths that can change the system state.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

A tool described as automatic encrypted vault sync but functioning as a manual package-tracking and package-execution utility is a substantial trust mismatch. Users may invoke it expecting benign backup behavior while actually granting execution paths that can change the system state.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

A tool described as automatic encrypted vault sync but functioning as a manual package-tracking and package-execution utility is a substantial trust mismatch. Users may invoke it expecting benign backup behavior while actually granting execution paths that can change the system state.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

A tool described as automatic encrypted vault sync but functioning as a manual package-tracking and package-execution utility is a substantial trust mismatch. Users may invoke it expecting benign backup behavior while actually granting execution paths that can change the system state.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

A tool described as automatic encrypted vault sync but functioning as a manual package-tracking and package-execution utility is a substantial trust mismatch. Users may invoke it expecting benign backup behavior while actually granting execution paths that can change the system state.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.2 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High
Category
Supply Chain
Confidence
97% confidence
Finding

The application has a direct runtime dependency on hono 4.12.2, and the listed advisories include cookie handling and route/mount prefix validation issues that can affect HTTP request handling and response construction. Because this skill is a cloud sync/identity vault service, flaws in cookie writing, routing, or header construction are especially sensitive and could contribute to session compromise, response splitting, or authorization bypass depending on how the framework features are used.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: sharp==0.34.5 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)

High
Category
Supply Chain
Confidence
91% confidence
Finding

sharp 0.34.5 is present as a transitive devDependency through miniflare, and the advisories concern inherited vulnerabilities in native image-processing libraries such as libvips/libheif. In this file's context the risk is mostly to local development or preview tooling rather than production worker runtime, but parsing attacker-controlled media in development pipelines can still expose maintainers to crashes or potentially worse native-library exploitation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==7.18.2 — 16 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +13 more

High
Category
Supply Chain
Confidence
94% confidence
Finding

undici 7.18.2 is included transitively via miniflare and has multiple reported HTTP parsing/request smuggling issues. Even though this is a devDependency, tooling that proxies, fetches remote content, or simulates worker networking can become a meaningful attack surface, and for a sync/cloud-oriented skill this raises concern because network interactions are central to the product's function.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.18.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
92% confidence
Finding

ws 8.18.0 is present transitively and carries advisories for uninitialized memory disclosure and memory exhaustion DoS. Since this dependency is pulled in through local tooling rather than the declared production app dependency, the primary risk is against development and preview environments, but WebSocket flaws can still be exploited if those services are reachable or process untrusted traffic.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.2 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High
Category
Supply Chain
Confidence
80% confidence
Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The dashboard auth endpoint issues a valid bearer token when given only an email address and vault ID, with no password, email verification, signed challenge, or other proof of identity. Because later routes accept this JWT as full authorization, anyone who can guess or obtain those two identifiers can read, modify, copy, revoke keys for, and otherwise fully control the victim's vault.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @hono/node-server==1.19.9 — 3 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode); CVE-2026-29087 (@hono/node-server has authorization bypass for protected static paths via encode)

High
Category
Supply Chain
Confidence
97% confidence
Finding

The lockfile pins @hono/node-server to 1.19.9, which is identified by multiple advisories for serve-static path traversal and authorization/middleware bypass issues. In a cloud API skill that likely exposes HTTP routes and handles synced vault data, a vulnerable server adapter can let attackers reach protected static resources or bypass path-based protections, making this more dangerous than a generic dependency issue.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · docs/plans/2026-02-23-file-sync-rules.md (reported line 108)May include surrounding context.

Step 4: Test with real JWT (get token first)

bash
TOKEN=$(curl -s -X POST https://clawroam-api.ovisoftblue.workers.dev/v1/dashboard/auth \
  -H "Content-Type: application/json" \
  -d '{"vault_id":"cccd796a-d618-43c7-9009-6c39ea796e83","email":"ovisoftblue@yahoo.com"}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · docs/plans/2026-02-23-file-sync-rules.md (reported line 171)May include surrounding context.

Step 4: Test with real JWT (get token first)

bash
TOKEN=$(curl -s -X POST https://clawroam-api.ovisoftblue.workers.dev/v1/dashboard/auth \
  -H "Content-Type: application/json" \
  -d '{"vault_id":"cccd796a-d618-43c7-9009-6c39ea796e83","email":"ovisoftblue@yahoo.com"}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · docs/plans/2026-02-23-file-sync-rules.md (reported line 517)May include surrounding context.

Step 4: Test with real JWT (get token first)

bash
TOKEN=$(curl -s -X POST https://clawroam-api.ovisoftblue.workers.dev/v1/dashboard/auth \
  -H "Content-Type: application/json" \
  -d '{"vault_id":"cccd796a-d618-43c7-9009-6c39ea796e83","email":"ovisoftblue@yahoo.com"}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['token'])")

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

Using config/secrets.yaml as a sample excluded path needlessly exposes that the system may contain a secrets file and instructs users to transmit that exact metadata to the server. While it is not credential theft in the direct sense, it normalizes handling secret-bearing filenames in remote API examples and leaks potentially sensitive repository structure.

Content

Scanner excerpt · docs/plans/2026-02-23-file-sync-rules.md (reported line 183)May include surrounding context.

md
curl -s -X PUT "$BASE/vaults/$VAULT/profiles/192/sync-rules" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"excluded":["knowledge/private-notes.md","config/secrets.yaml"]}'
# Expected: {"status":"ok","excluded_count":2}

# Read back

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The read-back example confirms the remote service stores and returns the config/secrets.yaml path, demonstrating persistence of sensitive metadata on the server. This can aid attackers or insiders by revealing naming conventions and the presence of secret material even without disclosing contents.

Content

Scanner excerpt · docs/plans/2026-02-23-file-sync-rules.md (reported line 189)May include surrounding context.

md
# Read back
curl -s "$BASE/vaults/$VAULT/profiles/192/sync-rules" \
  -H "Authorization: Bearer $TOKEN"
# Expected: {"excluded":["config/secrets.yaml","knowledge/private-notes.md"]}

# Clear
curl -s -X PUT "$BASE/vaults/$VAULT/profiles/192/sync-rules" \

Self-Modification

High
Category
Rogue Agent
Confidence
87% confidence
Finding

The plan explicitly instructs updating the installed skill on another machine via rsync --delete, which is self-modification of deployed code and can remove files on the target. In an agent-skill context this is more dangerous because skill updates change future agent behavior and can propagate mistakes or malicious modifications across hosts.

Content

Scanner excerpt · docs/plans/2026-02-23-file-sync-rules.md (reported line 567)May include surrounding context.

npx wrangler deploy

text

**Step 2: Update skill on jasper**

```bash
rsync -av --delete \

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · docs/plans/2026-02-23-file-sync-rules.md (reported line 463)May include surrounding context.

md
ts=$(date +%s)
  local sig
  sig=$(sign_request "sync-rules:${vault_id}:${profile_name}:${ts}" 2>/dev/null || echo "unsigned")
  $CURL -sf \
    -H "X-ClawRoam-Signature: $sig" \
    -H "X-ClawRoam-Timestamp: $ts" \
    "$API_BASE/vaults/$vault_id/profiles/$profile_name/sync-rules" 2>/dev/null \

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · providers/cloud.sh (reported line 52)May include surrounding context.

sh
ts=$(date +%s)
  local sig
  sig=$(sign_request "sync-rules:${vault_id}:${profile_name}:${ts}" 2>/dev/null || echo "unsigned")
  $CURL -sf \
    -H "X-ClawRoam-Signature: $sig" \
    -H "X-ClawRoam-Timestamp: $ts" \
    "$API_BASE/vaults/$vault_id/profiles/$profile_name/sync-rules" 2>/dev/null \

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Push transmits user vault data to the cloud and separately uploads a plaintext manifest of filenames and sizes, but the user is not explicitly warned that metadata is exposed to the provider. Because this skill markets storage as automatic and encrypted, the lack of disclosure makes the metadata leak more dangerous and misleading in context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The pull path restores a remote-controlled 'openclaw' directory into an external path read from config, outside the vault boundary. That means remote cloud content can overwrite files in another local directory tree, expanding impact from vault sync to arbitrary workspace modification and increasing the risk of code/config tampering.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

Fetching an external script and piping it directly into bash executes untrusted code without verification or review. Even without sudo on Darwin, this still grants arbitrary code execution in the user context and can steal vault material, alter configs, or install persistence.

Content

Scanner excerpt · providers/dropbox.sh (reported line 12)May include surrounding context.

sh
if ! command -v rclone &>/dev/null; then
    log "rclone not found. Installing..."
    case "$(uname -s)" in
      Darwin) brew install rclone 2>/dev/null || curl https://rclone.org/install.sh | bash ;;
      Linux)  curl https://rclone.org/install.sh | sudo bash ;;
    esac
  fi

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script pipes a remote installer directly into bash, and on Linux does so via sudo, resulting in immediate execution of unreviewed remote code with elevated privileges. A compromised upstream script, DNS/TLS interception, or supply-chain attack would yield arbitrary code execution as the user or root.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
100% confidence
Finding

This is the most dangerous variant of external script fetching because the downloaded content is executed immediately with sudo privileges. A successful upstream or network compromise would produce full root-level arbitrary code execution on the host.

Content

Scanner excerpt · providers/dropbox.sh (reported line 13)May include surrounding context.

sh
log "rclone not found. Installing..."
    case "$(uname -s)" in
      Darwin) brew install rclone 2>/dev/null || curl https://rclone.org/install.sh | bash ;;
      Linux)  curl https://rclone.org/install.sh | sudo bash ;;
    esac
  fi
}

Static analysis

Detected: suspicious.insecure_tls_verification, suspicious.obfuscated_code

HTTPS certificate verification is disabled.

Warn
Code
suspicious.insecure_tls_verification
Location
cloud-api/src/db.ts:8

Potential obfuscated payload detected.

Warn
Code
suspicious.obfuscated_code
Location
src/keypair.sh:55