OpenClaw AWS Deploy

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:25 PM UTC
• Version: 1.0.0

Overview

This AWS deployment skill is mostly purpose-aligned, but it creates broad cloud permissions, handles long-lived secrets unsafely, and installs mutable code as root, so it needs careful review before use.

Install only after reviewing and narrowing the IAM policy, avoiding IAM user access keys, pinning the OpenClaw package version, adding restrictive file permissions for generated secret files, and explicitly opting in to any heartbeat checks of email, calendar, repositories, or memory.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/setup_deployer_role.sh:150

Finding

Deployer IAM Policy Permits Privilege Escalation Through Arbitrary Role Policies

Content

View full analysis

Remediation

View remediation

:role/openclaw-*`. - Require a permissions boundary on every created role and deny creation or modification without that boundary. - Restrict `iam:PassRole` with both an exact role ARN and: ```json "Condition": { "StringEquals": { "iam:PassedToService": "ec2.amazonaws.com" } } ``` - Separate role provisioning from routine deployment. A trusted administrator should provision a fixed instance role in advance, while the deployer should only be able to pass that role. - Remove `iam:PutRolePolicy`, `iam:CreateRole`, and instance-profile creation from the routine deployer wherever possible. - Add explicit deny guardrails through an SCP or permissions boundary to prevent administrator, IAM-management, organization-management, and security-control privileges from being assigned. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/setup_deployer_role.sh:174

Finding

Deployer Policy Grants Account-Wide SSM Secret Access and Remote Command Execution

Content

View full analysis

Remediation

View remediation

::parameter/openclaw//*" ``` - Separate parameter permissions from SSM command and session permissions. - Restrict `ssm:SendCommand` and `ssm:StartSession` to instances tagged for the relevant OpenClaw deployment. - Restrict command execution to an approved SSM document rather than allowing arbitrary documents. - Use conditions such as `ssm:resourceTag/Project` or corresponding EC2 tag conditions. - Use a dedicated customer-managed KMS key for OpenClaw SecureStrings and scope `kms:Decrypt` to the instance role that needs those values. - Remove `ssm:DeleteParameter` for namespaces not created by the deployment. ]]>

T08 · Insecure Dependencies

Error

• Location: scripts/deploy_minimal.sh:879

Finding

Mutable npm Latest Release Is Installed Globally as Root

Content

View full analysis

&1 | tail -20 echo "[$(date)] OpenClaw path: $(which openclaw)" ``` ### Technical Analysis The EC2 user-data bootstrap runs as root and installs `openclaw@latest` globally. The `latest` npm distribution tag is mutable, so the code installed during a future deployment can differ from the code reviewed during this audit. npm packages can define lifecycle scripts that run during installation. Because the installation is performed by root, a compromised package release, maintainer account, or transitive dependency can execute arbitrary commands with root privileges. The script does not pin an exact version, verify a package integrity value, or constrain lifecycle scripts. ### Attack Path 1. An attacker compromises the npm package, a maintainer account, or a dependency included by a future `latest` release. 2. The attacker publishes a malicious release and moves the `latest` tag to it. 3. A user runs the deployment script. 4. EC2 user-data executes `npm install -g openclaw@latest` as root. 5. Malicious package installation code executes with root privileges. 6. The payload can modify the host, steal instance-role credentials, retrieve SSM secrets, or install additional persistence. ### Impact Assessment Successful exploitation provides root-level control over newly deployed EC2 instances. The attacker can access the instance role, OpenClaw configuration, Telegram token, gateway token, optional Gemini key, and all AWS resources permitted to the instance role. ]]>

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/deploy_minimal.sh:922

Finding

Generated Configuration Files Containing Secrets Lack Explicit Restrictive Permissions

Content

View full analysis

/home/openclaw/.openclaw/openclaw.json < /home/openclaw/.openclaw/agents/main/agent/auth-profiles.json <

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup_deployer_role.sh:308

Finding

Long-Lived AWS Secret Access Key Is Printed to Terminal and Logs

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (49)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code substantially matches the core deployment description: it securely deploys OpenClaw on AWS, creates networking and an ARM64 EC2 instance, uses SSM-only management with no SSH rules, and supports configurable models including Bedrock and Gemini. However, there are material description/behavior mismatches. First, the description says the skill can be used for tearing down deployments, but this code chunk is a deploy script only; rollback/cleanup depends on an external teardown.sh and teardown is not implemented here. Second, 'Creates ... Telegram channel' is misleading: the code provisions Telegram bot token configuration inside OpenClaw and optionally approves pairing, but does not create a Telegram channel in Telegram itself. Third, the script also sets up optional CloudWatch alarms/log shipping, which is an undeclared additional capability. Because of these materially inaccurate claims, this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description claims an operational deployment tool that securely deploys OpenClaw on AWS and can also tear down an existing deployment. The actual code chunk is a preparatory preflight checker only. While its inputs align with the broader deployment domain (region, auth mode, channel/model/cost profiles), its behavior is limited to validation and report generation using AWS read-only identity and capability checks. This is a materially different primary purpose from deployment/teardown, so the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The description claims this skill deploys OpenClaw on AWS and manages the full runtime environment. The supplied code chunk instead is a preparatory IAM bootstrap script whose purpose is to create a minimally privileged deployer identity (role or user) for later use by deployment scripts. While the policy permissions align with supporting AWS deployment/teardown operations, the code itself does not perform the declared primary function of deploying OpenClaw infrastructure. It also introduces undeclared IAM identity-management behavior, including user creation and access-key generation, which is materially different and security-sensitive. Therefore the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is about AWS deployment and teardown of OpenClaw infrastructure and related integrations. The supplied code chunk does none of that: it is a standalone smoke-test script that checks an already-running service's /health endpoint and an authenticated path, records pass/fail results in JSON, and exits accordingly. This is a materially different primary purpose and uses different resources and inputs than described, so it is a clear mismatch.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/TROUBLESHOOTING.md (reported line 217)May include surrounding context.

Solution: Use systemd EnvironmentFile:

bash

# Create env file
echo "GEMINI_API_KEY=your-key" | sudo tee /etc/openclaw/env
sudo chmod 600 /etc/openclaw/env

# Add to systemd service (under [Service])

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup_deployer_role.sh (reported line 275)May include surrounding context.

sh

log "=========================================="
  log ""
  log "  To use with deploy script:"
  log "    # Add to ~/.aws/config:"
  log "    [profile openclaw-deployer]"
  log "    role_arn = $ROLE_ARN"
  log "    source_profile = default"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup_deployer_role.sh (reported line 325)May include surrounding context.

sh

log "    AWS_SECRET_ACCESS_KEY=$SECRET_KEY"
  log "    AWS_DEFAULT_REGION=$REGION"
  log ""
  log "  Option 2: Add to ~/.aws/credentials:"
  log "    [openclaw-deployer]"
  log "    aws_access_key_id = $ACCESS_KEY"
  log "    aws_secret_access_key = $SECRET_KEY"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill explicitly instructs users to run shell scripts that can create, modify, and destroy AWS infrastructure, but it declares no tool scope or allowed-tools metadata. That omission weakens review and enforcement boundaries, making it easier for an agent to use shell access in broader-than-expected ways when handling cloud credentials and deployment actions.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

• .env.starfish in workspace root (recommended) or skill directory:

  text

  TELEGRAM_BOT_TOKEN=...     # from @BotFather (required)
  TELEGRAM_USER_ID=...       # your Telegram user ID (optional, enables auto-approve pairing)
  GEMINI_API_KEY=...         # from aistudio.google.com (optional, for Gemini models)
  

• aws CLI installed OR Docker for sandboxed access

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/deploy_minimal.sh (reported line 75)May include surrounding context.

sh

- `.env.starfish` in workspace root (recommended) or skill directory:
  ```
  TELEGRAM_BOT_TOKEN=...     # from @BotFather (required)
  TELEGRAM_USER_ID=...       # your Telegram user ID (optional, enables auto-approve pairing)
  GEMINI_API_KEY=...         # from aistudio.google.com (optional, for Gemini models)
  ```
- `aws` CLI installed OR Docker for sandboxed access

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/deploy_minimal.sh (reported line 91)May include surrounding context.

sh

- `.env.starfish` in workspace root (recommended) or skill directory:
  ```
  TELEGRAM_BOT_TOKEN=...     # from @BotFather (required)
  TELEGRAM_USER_ID=...       # your Telegram user ID (optional, enables auto-approve pairing)
  GEMINI_API_KEY=...         # from aistudio.google.com (optional, for Gemini models)
  ```
- `aws` CLI installed OR Docker for sandboxed access

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · scripts/deploy_minimal.sh (reported line 1499)May include surrounding context.

sh

- `.env.starfish` in workspace root (recommended) or skill directory:
  ```
  TELEGRAM_BOT_TOKEN=...     # from @BotFather (required)
  TELEGRAM_USER_ID=...       # your Telegram user ID (optional, enables auto-approve pairing)
  GEMINI_API_KEY=...         # from aistudio.google.com (optional, for Gemini models)
  ```
- `aws` CLI installed OR Docker for sandboxed access

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The teardown examples include --yes, which suppresses confirmation for destructive actions, yet the surrounding text does not prominently warn that this will delete AWS resources. In a cloud-deployment skill, that raises the risk of accidental irreversible deletion, especially when an agent or user copies commands verbatim.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The guidance to create auth-profiles.json in the agent directory implies local persistence of provider credentials or auth configuration on disk. In a deployment skill handling API keys and cloud access, persistent auth material increases exposure through file disclosure, backup leakage, or compromised service accounts, especially since the document also notes some hardening was removed for reliability.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

### Model
- **Gemini 2.0 Flash** — recommended (free tier: 15 RPM, 1M tokens/day, supports tools)
- **Auth profiles required** — create `auth-profiles.json` in agent dir
- **Bedrock format** — `amazon-bedrock/MODEL_ID` (not `bedrock/`)
- **Bedrock models need console enablement** — Anthropic requires use case form

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · assets/agent-defaults/AGENTS.md (reported line 30)May include surrounding context.

md

## Safety

- Don't exfiltrate private data. Ever.
- Don't run destructive commands without asking.
- `trash` > `rm`
- When in doubt, ask.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The heartbeat instructions explicitly direct the agent to access email, calendar, project repositories, and memory files on a recurring basis without any requirement for user consent, data minimization, or contextual authorization. In an autonomous agent deployment skill, this creates a real privacy and overreach risk because the agent is being told to proactively inspect potentially sensitive personal and organizational data outside an explicit user-triggered request.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description says to 'Monitor what you're asked to monitor' across broad domains like systems, markets, and news, but does not define clear activation conditions, explicit trigger phrases, or exclusions. In a markdown skill description, this ambiguity can cause unintended invocation because the scope overlaps with many common monitoring-related requests.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/TROUBLESHOOTING.md (reported line 28)May include surrounding context.

Gateway service check failed: Error: systemctl --user unavailable: Failed to connect to bus

text

**Cause:** `openclaw gateway start` tries to create a user-level systemd service

**Solution:** Use foreground mode instead:
```bash

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The troubleshooting step tells users to kill processes and restart the service without any warning about service interruption, possible termination of unrelated matching processes, or need to verify the target first. In an ops runbook this can cause avoidable denial of service or disrupt production sessions if copied blindly.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 105)May include surrounding context.

Solution: Kill existing gateway before restart:

bash

sudo pkill -f openclaw-gateway
sleep 2
sudo systemctl restart openclaw

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

Solution: Kill existing gateway before restart:

bash

sudo pkill -f openclaw-gateway
sleep 2
sudo systemctl restart openclaw

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 233)May include surrounding context.

Solution: Kill existing gateway before restart:

bash

sudo pkill -f openclaw-gateway
sleep 2
sudo systemctl restart openclaw

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/TROUBLESHOOTING.md (reported line 65)May include surrounding context.

Solution: Kill existing gateway before restart:

bash

sudo pkill -f openclaw-gateway
sleep 2
sudo systemctl restart openclaw

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/TROUBLESHOOTING.md (reported line 67)May include surrounding context.

Solution: Kill existing gateway before restart:

bash

sudo pkill -f openclaw-gateway
sleep 2
sudo systemctl restart openclaw

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/TROUBLESHOOTING.md (reported line 217)May include surrounding context.

Solution: Kill existing gateway before restart:

bash

sudo pkill -f openclaw-gateway
sleep 2
sudo systemctl restart openclaw

Static analysis

No suspicious patterns detected.