ClawHub
Back to skill

Security audit

OpenBotAuth

Security checks for vulnerabilities and agentic risk

Overview

Review is recommended because the skill is mostly disclosed and purpose-related, but its browser proxy grants broad signing and HTTPS interception power without enough scoping or client authorization.

Install only if you explicitly need OpenBotAuth signing and understand the proxy risks. Prefer the core one-request signing flow or a reviewed official proxy; avoid installing the generated CA into a system-wide trust store, avoid --ignore-https-errors for real browsing, stop the proxy when finished, and remove stale keys, memory notes, and CA files when no longer needed.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:483
Finding

Unauthenticated Local Proxy Acts as an Arbitrary Agent-Signature Oracle

Content
View full analysis
{ const id = ++rc, url = new URL(cReq.url), auth = url.host, p = url.pathname + url.search; const sig = signReq(cReq.method, auth, p); log(id, `HTTP ${cReq.method} ${auth}${p} → signed`); const h = { ...cReq.headers }; delete h["proxy-connection"]; delete h["proxy-authorization"]; Object.assign(h, sig); h.host = auth; const fn = url.protocol === "https:" ? httpsRequest : httpRequest; const pr = fn({ hostname: url.hostname, port: url.port || (url.protocol === "https:" ? 443 : 80), path: p, method: cReq.method, headers: h }, (r) => { cRes.writeHead(r.statusCode, r.headers); r.pipe(cRes); }); pr.on("error", (e) => { log(id, `Error: ${e.message}`); cRes.writeHead(502); cRes.end("Proxy error"); }); cReq.pipe(pr); }); server.listen(port, "127.0.0.1", () => { console.log(`openbotauth signing proxy on http://127.0.0.1:${port}`); console.log(` kid: ${obaKey.kid}`); if (jwksUrl) console.log(` Signature-Agent: ${jwksUrl}`); console.log("Every request ...[truncated 2632 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:442
Finding

Broad HTTPS Interception Requires a Long-Lived Root CA or Disabled Certificate Validation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (11)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The trigger list is extremely broad and overlaps with generic browsing, authentication, key management, scraping, and SSO tasks. In an agent environment, this can cause the skill to auto-activate in situations where the user did not explicitly request OpenBotAuth setup, increasing the chance of unsolicited key generation, registration prompts, or header/signing behavior being applied to unrelated workflows.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

}

text

The OBA token lives at `~/.config/openbotauth/token` (chmod 600).

Agent registration info (agent_id, JWKS URL) should be saved in agent memory/notes after Step 3.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 611)May include surrounding context.

}

text

The OBA token lives at `~/.config/openbotauth/token` (chmod 600).

Agent registration info (agent_id, JWKS URL) should be saved in agent memory/notes after Step 3.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

md
if (!username) throw new Error('Could not resolve username from /auth/session');
  const jwksUrl = API + '/jwks/' + username + '.json';

  // Write config.json for the signing proxy
  fs.writeFileSync(path.join(dir, 'config.json'), JSON.stringify({
    agent_id: d.id,
    username: username,

Persistent Context Injection

Medium
Category
Memory Poisoning
Confidence
95% confidence
Finding

The skill instructs the agent to save registration data into memory/notes, creating persistent context injection and cross-session state. Even though the fields shown are not highly secret, persisting identifiers and URLs can cause unintended reuse, stale identity binding, or later disclosure to unrelated tasks and tools.

Content

Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.

md
console.log('');
  console.log('JWKS URL:', jwksUrl);
  console.log('');
  console.log('Save this to memory:');
  console.log(JSON.stringify({
    openbotauth: {
      agent_id: d.id,

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

3c. Verify registration

bash
curl https://api.openbotauth.org/jwks/YOUR_USERNAME.json

You should see your public key in the keys array. This is the URL that verifiers will use to check your signatures.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 303)May include surrounding context.

3c. Verify registration

bash
curl https://api.openbotauth.org/jwks/YOUR_USERNAME.json

You should see your public key in the keys array. This is the URL that verifiers will use to check your signatures.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This instruction explicitly sends a bearer token to an external service. Although the skill warns against broader misuse, it still asks the agent to collect, store, and transmit a user token, which is sensitive credential handling and creates risk if the skill is triggered unexpectedly, logs are retained, or the token is mishandled by the runtime.

Content

Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.

md
| Do | Don't |
|----|-------|
| `curl -H "Authorization: Bearer ..." https://api.openbotauth.org/agents` | Set bearer token as global browser header |
| Delete token after registration | Keep token in browsing session |
| Use origin-scoped headers for signing | Use `set headers` with bearer tokens |
| Store token at `~/.config/openbotauth/token` (chmod 600) | Paste token into chat logs |

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

md
| `curl -H "Authorization: Bearer ..." https://api.openbotauth.org/agents` | Set bearer token as global browser header |
| Delete token after registration | Keep token in browsing session |
| Use origin-scoped headers for signing | Use `set headers` with bearer tokens |
| Store token at `~/.config/openbotauth/token` (chmod 600) | Paste token into chat logs |

---

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 614)May include surrounding context.

md
| `curl -H "Authorization: Bearer ..." https://api.openbotauth.org/agents` | Set bearer token as global browser header |
| Delete token after registration | Keep token in browsing session |
| Use origin-scoped headers for signing | Use `set headers` with bearer tokens |
| Store token at `~/.config/openbotauth/token` (chmod 600) | Paste token into chat logs |

---

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 612)May include surrounding context.

text
~/.config/openbotauth/
├── key.json       # kid, x, publicKeyPem, privateKeyPem (chmod 600)
├── key.pub.json   # Public JWK for sharing (chmod 644)
├── config.json    # Agent ID, JWKS URL, registration info
├── token          # oba_xxx bearer token (chmod 600)
└── ca/            # Proxy CA certificate (auto-generated)

Static analysis

No suspicious patterns detected.