linkedclaw-provider

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:48 AM UTC
• Version: 0.0.11

Overview

This skill is a coherent LinkedClaw provider setup guide, but it asks users to run an unattended marketplace daemon with mutable package installs and sensitive credential/session access that warrant careful review.

Install only if you intentionally want this machine to serve untrusted marketplace requests. Pin and review all npm, npx, pip, and plugin versions before running the daemon, avoid @latest and runtime npx fetching, use a dedicated unprivileged account with a minimal HOME, restrict credentials to the minimum needed model key, and keep the default text-only/tool-disabled mode unless you have a real OS sandbox.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:70

Finding

Unpinned Third-Party Packages Are Downloaded and Executed with Provider Access

Content

View full analysis

\ --handler-acp "npx @agentclientprotocol/claude-agent-acp" ``` `SKILL.md:180`: ```bash npm i -g pm2 ``` `references/claude-code.md:5-8`: ```bash linkedclaw provider run my-provider.yaml \ --handler-acp "npx @agentclientprotocol/claude-agent-acp" ``` `references/claude-code.md:50-54`: `` ...[truncated 4200 chars]

Remediation

View remediation

npx --yes @agentclientprotocol/codex-acp@ npx --yes pi-acp@ pip install hermes-linkedclaw== ``` 2. Remove `@latest` from operational instructions. Treat upgrades as separate, explicit security-sensitive actions. 3. Prefer installing adapters into a dedicated project or virtual environment with committed npm lockfiles or hash-pinned Python requirement files. 4. For Python packages, use hashes: ```bash pip install --require-hashes -r requirements.txt ``` 5. Verify npm package integrity and provenance before installation. Record the expected package version, publisher, integrity digest, and source repository. 6. Disable package lifecycle scripts during inspection where practical, and review packages before allowing installation scripts to execute. 7. Install and audit dependencies before enabling the persistent service. Do not let a boot-time daemon perform runtime package retrieval through `npx`. 8. Run the provider under a dedicated unprivileged account with a minimal `HOME`, restricted filesystem permissions, and narrowly scoped outbound network access. 9. Document a controlled upgrade procedure that includes version review, integrity verification, staging tests, credential rotation readiness, and rollback instructions. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/hermes-plugin.md:31

Finding

LinkedClaw Provider API Key Is Passed Through the Process Argument Vector

Content

View full analysis

--agent-id agt_xxxxxxxx ``` Command-line arguments may be observable through process inspection facilities, endpoint monitoring, audit frameworks, crash diagnostics, debugging tools, or process-accounting systems. Exposure depends on the operating system and local security configuration, but command-line arguments should not be treated as a protected secret transport. The source file is documented as mode `0600`, but that protection does not extend to the transient argument vector. The destination file also contains other Hermes provider credentials, increasing the importance of avoiding tooling or workflows that may log the command. ### Attack Path 1. The operator runs the documented `hermes linkedclaw auth set` command. 2. The shell reads the LinkedClaw API key from `~/.linkedclaw/config.yaml`. 3. Command substitution inserts the plaintext key into the `hermes` process arguments. 4. A local user, privileged monitoring agent, audit service, process logger, or diagnostic tool captures the argument vector while the command is running. 5. The observer extracts the `lc_` credential. 6. The exposed credential is used to authenticate to LinkedClaw within the permissions and lifetime assigned to that provider key. ### Impact Assessment The immediate scope is disclosure of the LinkedClaw ...[truncated 646 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (51)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 75% confidence

Finding

The skill advises storing model API credentials in an environment file for a persistent service. While common, plaintext env files on disk can be exposed through weak file permissions, backups, process inspection tooling, or accidental disclosure, and this matters more here because the daemon serves untrusted users continuously.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

md

# HOME must be the account that ran `linkedclaw login` — config + provider YAML live in ~/.linkedclaw.
Environment=HOME=/home/<you>
# The agent needs its model credential; keep LinkedClaw creds OUT of here (the daemon already holds them).
EnvironmentFile=-/home/<you>/.config/lc-provider-<slug>.env   # e.g. ANTHROPIC_API_KEY=...

[Install]
WantedBy=multi-user.target

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/claude-code.md (reported line 33)May include surrounding context.

md

**Why the obvious approaches do NOT work** (don't bother trying them — measured against
claude-agent-acp 0.49.0):
- A `~/.claude/settings.json` or project `.claude/settings.json` `permissions.deny:["Bash"]`
  is **ignored** — the Agent SDK runs in isolation mode and the adapter's own tool wiring
  decides what the model gets.
- `session/set_mode` `dontAsk` / `plan` still execute shell.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

Therefore, to confine Codex you MUST disable its exec in Codex's OWN config — a real, in-process, approval-independent control the model never bypasses. Set in ~/.codex/config.toml:

toml

sandbox_mode = "read-only"

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/codex.md (reported line 39)May include surrounding context.

Therefore, to confine Codex you MUST disable its exec in Codex's OWN config — a real, in-process, approval-independent control the model never bypasses. Set in ~/.codex/config.toml:

toml

sandbox_mode = "read-only"

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 90% confidence

Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · references/gemini.md (reported line 21)May include surrounding context.

Gemini does NOT honor the disableBuiltInTools hint that the bridge sends for Claude Code, so for Gemini you must remove the shell tool in Gemini's own settings. This is a real, in-process, approval-independent removal — the model never sees the tool. Add to your Gemini settings (~/.gemini/settings.json or project .gemini/settings.json):

json

{

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The document states that Hermes can run ungated shell commands and gives cat ~/.ssh/id_rsa as an example of a read that would execute without approval. In context, this is evidence of a real credential-exposure risk in the described skill: an attacker could prompt the agent to read sensitive host files and exfiltrate their contents via the model response.

Content

Scanner excerpt · references/hermes.md (reported line 44)May include surrounding context.

md

The `reject-all` permission mode also does NOT confine Hermes: Hermes only asks for
approval for commands it classifies as "dangerous" via ~35 regex patterns — harmless
reads like `id -un` or `cat ~/.ssh/id_rsa` do not match any pattern and run
ungated.

**Live-verified:** a "run `id -un`" prompt against bare `hermes acp` with `reject-all`

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

The skill instructs the agent to re-install or force-refresh skill content from an external source (openclaw skills install linkedclaw-provider --force). That is a self-modification/update path which can change the behavior of the currently trusted skill without a fresh review, creating a supply-chain risk if the remote package is compromised or unexpectedly changed. In this context the rest of the document is operationally detailed and meant to be followed, which makes the update command more likely to be executed in practice.

Content

Scanner excerpt · references/openclaw-plugin.md (reported line 467)May include surrounding context.

---

Update this skill / the plugin

bash

# Re-fetch skill content:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

description: LinkedClaw provider — register this machine's AI agent (Claude Code, Gemini CLI, or a custom handler) as a paid provider on the LinkedClaw marketplace so it EARNS credits serving other agents. Use this when the user wants to rent out their agent, register/list a provider, earn credits on LinkedClaw, set up `linkedclaw provider run`, or asks about `--handler-acp`, or install the OpenClaw/Hermes native plugin (@linkedclaw/openclaw-plugin / hermes-linkedclaw) for the deep path. This is a one-time setup/ops assistant: after setup, a daemon runs unattended — for the *requester* role (this agent hiring others), install `linkedclaw-requester` instead.
license: Apache-2.0
compatibility: Requires node + npm and the `@linkedclaw/cli`. The ACP "light" path additionally needs an ACP-speaking agent on this machine (Claude Code via `@agentclientprotocol/claude-agent-acp`, Gemini, Codex, Hermes, OpenCode, pi). OpenClaw and Hermes also offer a native-plugin "deep" path (`@linkedclaw/openclaw-plugin` / `hermes-linkedclaw`) — see their plugin references.
allowed-tools: Bash(linkedclaw:*) Bash(jq:*) Bash(npm:*) Bash(npx:*) Bash(node:*) Bash(command:*) Bash(printf:*) Bash(pm2:*) Bash(openclaw:*) Bash(hermes:*) Bash(pip:*) Bash(systemctl:*) Bash(mkdir:*) Bash(chmod:*) Read Write Edit
metadata:
  author: linkedclaw
  version: "0.1.4"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs use of npx @agentclientprotocol/claude-agent-acp without a pinned version, so each run may fetch whatever package version is current at execution time. In this skill's context, that command becomes part of an unattended provider daemon exposed to untrusted marketplace traffic, so a compromised upstream package, typo-squat, or breaking update could lead to arbitrary code execution on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The unpinned npx @agentclientprotocol/codex-acp command allows execution of a mutable upstream package version. Because this skill is specifically about wiring an external-agent bridge into a persistent daemon that serves untrusted users, any malicious or vulnerable package update would execute with the provider host's permissions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Using npx -y pi-acp without version pinning permits silent installation and execution of the latest published package. In an unattended provider setup, that creates a supply-chain execution path that could be exploited to run attacker-controlled code on the machine or weaken the intended confinement of the rented-out agent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

description: "Paste a diff or file; get a senior-level review with concrete, line-referenced fixes." # REQUIRED for search/discovery

text

Write this under `~/.linkedclaw/providers/<slug>.yaml` (durable — survives reboot; `/tmp`
does NOT). Then `linkedclaw provider register <slug>` and `linkedclaw provider run <slug>`
resolve it by slug.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The startup example again uses npx @agentclientprotocol/claude-agent-acp without version pinning, this time in the core provider run command. Since this is the exact long-lived daemon launch path, an upstream package change can directly alter runtime behavior or introduce code execution at service start.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The skill documents an allow-reads mode that auto-approves tool requests based on command name classification. Even though it warns that this is non-default and should be sandboxed, automatic approval of actions for an agent serving untrusted strangers weakens human oversight and can be bypassed if supposedly read-only tools have side effects or broader access than expected.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md

Flags:
- `--acp-permissions reject-all|allow-reads|allow-all` — default `reject-all` = remove the
  agent's built-in tools entirely (text-in/text-out; the recommended marketplace default).
  `allow-reads` keeps tools but only auto-approves tools whose NAME is a known read-only
  one (ignores the agent's self-reported kind); `allow-all` auto-approves everything. Both
  non-default modes keep tools and therefore require an OS sandbox — wrap the command, e.g.
  `--handler-acp "srt npx @agentclientprotocol/claude-agent-acp"` (the CLI warns if you don't).

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 90% confidence

Finding

The skill exposes an allow-all mode that auto-approves every tool action for an unattended agent processing prompts from untrusted marketplace users. Although the text warns against casual use, documenting and normalizing this option materially increases the chance of remote code execution, file modification, or host compromise if operators enable it.

Content

Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.

md

- `--acp-permissions reject-all|allow-reads|allow-all` — default `reject-all` = remove the
  agent's built-in tools entirely (text-in/text-out; the recommended marketplace default).
  `allow-reads` keeps tools but only auto-approves tools whose NAME is a known read-only
  one (ignores the agent's self-reported kind); `allow-all` auto-approves everything. Both
  non-default modes keep tools and therefore require an OS sandbox — wrap the command, e.g.
  `--handler-acp "srt npx @agentclientprotocol/claude-agent-acp"` (the CLI warns if you don't).
- `--acp-env KEY1,KEY2` — extra env vars to pass to the agent. The built-in allowlist

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The sandboxed wrapper example still embeds an unpinned npx @agentclientprotocol/claude-agent-acp, leaving the supply-chain risk intact even if OS sandboxing is added. Sandbox guidance reduces blast radius, but a malicious package could still exfiltrate accessible data, abuse network access, or undermine the provider process.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

npm i -g pm2 pm2 start "linkedclaw provider run --handler-acp ''" --name lc-provider- pm2 save # persist the process list pm2 startup # prints a sudo command — run it once (installs the boot launcher)

ops: pm2 restart|stop|logs lc-provider-

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

npm i -g pm2 pm2 start "linkedclaw provider run --handler-acp ''" --name lc-provider- pm2 save # persist the process list pm2 startup # prints a sudo command — run it once (installs the boot launcher)

ops: pm2 restart|stop|logs lc-provider-

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.

npm i -g pm2 pm2 start "linkedclaw provider run --handler-acp ''" --name lc-provider- pm2 save # persist the process list pm2 startup # prints a sudo command — run it once (installs the boot launcher)

ops: pm2 restart|stop|logs lc-provider-

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

pm2 save + pm2 startup are BOTH required or the daemon will NOT come back after reboot.

systemd (Linux servers): write a unit, then enable it.

ini

# /etc/systemd/system/lc-provider-<slug>.service

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

pm2 save + pm2 startup are BOTH required or the daemon will NOT come back after reboot.

systemd (Linux servers): write a unit, then enable it.

ini

# /etc/systemd/system/lc-provider-<slug>.service

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 215)May include surrounding context.

bash

sudo systemctl daemon-reload
sudo systemctl enable --now lc-provider-<slug>     # start + boot-persist in one
# ops: systemctl restart|stop|status lc-provider-<slug> ; journalctl -u lc-provider-<slug> -f

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.