ClawHub
Back to skill

Security audit

RescueClaw

Security checks for vulnerabilities and agentic risk

Overview

This looks like a rollback safety tool, but it automatically installs an unverified external executable into a command path during installation.

Install only if you trust the RescueClaw publisher and are comfortable with a post-install hook downloading and installing a native executable into ~/.local/bin. Prefer a release that bundles or verifies the binary with pinned checksums or signatures, and avoid using checkpoints around long-running operations until the rollback trigger and disable controls are clear.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
install.js:54
Finding

Unverified Remote Native Binary Download and Installation

Content
View full analysis

Vulnerability Details

File Location: install.js:54-70; lifecycle registration at package.json:20-22
Vulnerability Type: Unverified remote payload retrieval and installation
Risk Level: High

Vulnerable Code

javascript
// 4. Download from GitHub Releases
const tarName = `${assetName}.tar.gz`;
const url = `https://github.com/${REPO}/releases/download/v${VERSION}/${tarName}`;
const installDir = path.join(os.homedir(), '.local', 'bin');
const installPath = path.join(installDir, 'rescueclaw');

console.log(`📦 Downloading ${assetName} v${VERSION}...`);
console.log(`   From: ${url}`);

fs.mkdirSync(installDir, { recursive: true });

const tmpFile = path.join(os.tmpdir(), tarName);

try {
  execSync(`curl -fsSL "${url}" -o "${tmpFile}"`, { stdio: 'inherit', timeout: 60000 });
  execSync(`tar xzf "${tmpFile}" -C "${installDir}"`, { stdio: 'inherit' });
  fs.chmodSync(installPath, 0o755);

The download occurs automatically through the package lifecycle configuration:

json
"clawhub": {
  "category": "safety",
  "postInstall": "install.js"
}

Technical Analysis

The post-install hook retrieves a platform-specific native executable from a GitHub release and installs it into ~/.local/bin. Although the release URL includes version 0.2.0 and HTTPS protects the connection in transit, the installer does not verify a cryptographic checksum, trusted signature, or authenticated manifest before installing the executable.

A versioned GitHub release URL is not equivalent to immutable, content-addressed pinning. If the repository, release asset, maintainer account, or release workflow is compromised, the remotely hosted archive can be replaced while retaining the expected URL. The package would then install content that was not present during review.

This behavior exceeds the minimum privileges required by the local JavaScript checkpoint API, which primarily writes and removes a ...[truncated 1715 chars]

Remediation
View remediation

Remediation Suggestions

  1. Publish a SHA-256 or stronger digest for every platform archive through a separately authenticated and reviewable channel.
  2. Embed the expected digest for the exact release artifact in the reviewed package and verify it before extraction.
  3. Prefer signed release manifests and verify signatures against a pinned maintainer or project public key.
  4. Fail closed if verification cannot be completed; do not install or execute unverifiable content.
  5. Require explicit user approval before downloading and installing a native executable during package installation.
  6. Consider bundling the auditable executable in the package if package size and platform support permit it.
  7. Ensure the bundled or downloaded binary source is reproducible and independently reviewable.
  8. Document the automatic network download accurately, including the source, installed files, integrity controls, and execution lifecycle.

T09 · Insecure Skill Coding Practices

Warning
Location
install.js:64
Finding

Unsafe Extraction Through a Predictable Temporary Archive Path

Content
View full analysis

Vulnerability Details

File Location: install.js:64-71
Vulnerability Type: Unsafe temporary-file handling and unvalidated archive extraction
Risk Level: Medium

Vulnerable Code

javascript
const tmpFile = path.join(os.tmpdir(), tarName);

try {
  execSync(`curl -fsSL "${url}" -o "${tmpFile}"`, { stdio: 'inherit', timeout: 60000 });
  execSync(`tar xzf "${tmpFile}" -C "${installDir}"`, { stdio: 'inherit' });
  fs.chmodSync(installPath, 0o755);
  fs.unlinkSync(tmpFile);

Technical Analysis

The installer uses a predictable shared temporary filename derived only from the platform asset name, such as /tmp/rescueclaw-linux-amd64.tar.gz. It does not create a private temporary directory or open the destination with exclusive, symlink-safe semantics. On a multi-user system, another local process may be able to prepare or manipulate that path, creating a race or symlink-based file-placement risk depending on operating-system protections and curl behavior.

The downloaded archive is passed directly to the system tar utility without first validating its member names or types. The code does not reject absolute paths, ../ traversal entries, symbolic links, hard links, device files, or unexpected additional files. It also does not verify that the archive contains exactly one regular file named rescueclaw.

Consequently, control of the release archive can provide broader file-write capabilities than the declared installation of one executable. This issue compounds the unverified-download finding but remains independently relevant because even a checksum-verified archive should be extracted defensively.

Attack Path

Remote archive path:

  1. An attacker gains control of the downloaded release archive.
  2. The attacker inserts traversal paths, links, or additional files into the archive.
  3. The installer downloads the archive and invokes tar without inspecting its entries.
  4. Archive me ...[truncated 1404 chars]
Remediation
View remediation

Remediation Suggestions

  1. Create a private temporary directory with fs.mkdtempSync() and restrictive permissions.
  2. Store the archive under that private directory rather than using a predictable global temporary filename.
  3. Remove the entire temporary directory in a finally block after installation.
  4. List and validate archive entries before extraction.
  5. Reject absolute paths, traversal components, symbolic links, hard links, device files, and any unexpected member.
  6. Require the archive to contain exactly one expected regular executable with a fixed name.
  7. Extract into a private staging directory rather than directly into ~/.local/bin.
  8. Verify the staged file's cryptographic digest or signature before installation.
  9. Atomically rename the verified staged executable into the final destination.
  10. Prefer a maintained archive library that supports explicit path and file-type validation instead of invoking unrestricted system tar.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

The installer fetches a remote binary from GitHub Releases during post-install and executes shell commands to download and unpack it without any cryptographic checksum or signature verification. If the release asset, repository, network trust boundary, or local extraction path is compromised, users could install a trojaned executable that will later run from their PATH.

Content

Scanner excerpt · install.js (reported line 5)May include surrounding context.

js
/**
 * Post-install hook for RescueClaw skill
 * Downloads the correct binary from GitHub Releases for the user's platform.
 * No curl | bash — pinned versioned URL, platform-detected.
 */

const { execSync } = require('child_process');

Session Persistence

Medium
Category
Rogue Agent
Confidence
81% confidence
Finding

The skill intentionally creates persistent checkpoint state and a monitored rollback mechanism that survives beyond a single command, which is a form of session persistence. In this context, persistence is not inherently malicious, but it is security-sensitive because it can autonomously trigger state restoration later, potentially overwriting legitimate changes or masking the cause of system behavior.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

Before Risky Operations

Before modifying config, installing skills, or updating the gateway, create a checkpoint:

javascript
const rescueclaw = require('./rescueclaw-checkpoint');

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation describes automatic restore behavior after agent unresponsiveness, but it does not clearly foreground this as a safety-critical warning near usage instructions. That omission can cause operators to invoke checkpoints without appreciating that temporary hangs or long-running tasks may trigger rollback and unexpectedly revert configuration or state.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
The daemon binary is bundled for supported platforms (linux/arm64). On install, it copies to `~/.local/bin/rescueclaw`. For other platforms, download from [GitHub Releases](https://github.com/harman314/rescueclaw/releases).

Data is stored in `~/.openclaw/rescueclaw/` (user-local, no sudo required).

## API Reference

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The installation section states that a bundled daemon binary is copied into ~/.local/bin, but it does not present this as a security-relevant action requiring user review. Silent placement of an executable into a PATH-like directory can alter future command execution trust assumptions and increases supply-chain risk if users do not verify the binary source and integrity.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The header comment explicitly says 'No curl | bash', suggesting the installer avoids shell-driven download execution patterns. However, the code later invokes curl and tar through execSync, so the documentation contradicts the actual implementation approach even though it does not literally pipe curl to bash.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
install.js:37

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
rescueclaw-checkpoint.js:68