Security checks for vulnerabilities and agentic risk
Overview
The skill appears to be a real migration helper, but it asks users to run high-impact commands with broad credentials, unsafe SSH settings, and an unverified downloaded script.
Only install or use this skill after reviewing the migration commands carefully. Prefer a bundled or checksum-verified migration script, short-lived least-privilege cloud credentials, SSH key authentication with verified host keys, protected secret handling, explicit backups, a rollback plan, and a manual confirmation before overwriting any OpenClaw instance data.
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T03 · Remote Payload Retrieval and Execution
Error
Location
SKILL.md:111
Finding
Unverified Remote Python Payload Download and Execution
Content
View full analysis
\
--src-secret-key \
--dst-secret-id \
--dst-secret-key \
--pairs-file instances.txt
```
### Technical Analysis
The skill instructs the agent to retrieve a mutable Python file from an external object-storage URL and execute it. It does not pin a release, verify a cryptographic checksum, validate a publisher signature, or include an auditable local copy of the script.
TLS protects the connection in transit but does not establish that the current object is the same object reviewed when the skill was published. Anyone who can modify the bucket object, compromise its hosting account, or otherwise control the response can change the effective code after review.
The downloaded program is especially sensitive because it receives source and destination cloud API credentials and is likely to run with administrative host privileges during migration. The external Python payload was not included in the audited project, so its behavior could not be statically verified.
### Attack Path
1. An attacker compromises or legitimately controls the object-storage account or object referenced by the fixed URL.
2. The attacker replaces `claw2ten
...[truncated 1008 chars]
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
Location
SKILL.md:48
Finding
SSH Host Authentication Disabled During Migration
Content
View full analysis
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
Location
references/migration_commands.md:51
Finding
Infrastructure Credentials Exposed Through Process Arguments and Plaintext Files
Content
View full analysis
```
Cloud credentials supplied as command-line arguments:
```bash
python3 claw2tencentcloud.py \
--src-secret-id \
--src-secret-key \
--dst-secret-id \
--dst-secret-key \
--pairs-file instances.txt
```
### Technical Analysis
The workflow places reusable host passwords directly in command arguments and stores source login passwords in a plaintext `instances.txt` file. It also sends source and destination cloud SecretKeys as command-line arguments.
Command-line secrets may be exposed through shell history, process listings, diagnostic tooling, audit systems, terminal recordings, job logs, or error reports. The pairing file can be disclosed through permissive default file modes, backups, support bundles, or failure to delete it after migration.
The documentation does not require restrictive permissions, secure creation, redaction, cleanup, or credential rotation.
### Attack Path
1. The user substitutes real SSH and cloud credentials into the documented commands and pairing file.
2. A local user, monitoring tool, process collector, shell-history reader, backup operator,
...[truncated 858 chars]
Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
The skill content is written entirely in Chinese and instructs behavior in that language, while providing no option for the user to choose another language. Under the policy criteria, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content
No source excerpt is available for this finding.
Sudo/Root Execution
Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content
Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.
sed -i 's|/app/extensions/|/root/.openclaw/extensions/|g' /root/.openclaw/openclaw.json
The instructions place SSH passwords and cloud API secrets directly on command lines and in flat files, which exposes them to shell history, process listings, logs, and accidental file disclosure. The use of 'StrictHostKeyChecking=no' also weakens SSH trust validation, increasing the risk of credential theft via man-in-the-middle attacks.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding
The migration procedure overwrites the current instance's OpenClaw state and restarts the gateway, which can cause service interruption, data loss, or rollback complexity if run on the wrong host or with incompatible data. Although a backup is mentioned, there is no explicit confirmation gate, dry-run, compatibility validation, or prominent warning before destructive steps.
Content
No source excerpt is available for this finding.
Sudo/Root Execution
Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content
Scanner excerpt · references/migration_commands.md (reported line 34)May include surrounding context.
The file forces a specific language for all operational instructions and does not provide an opt-in, alternative language, or justification for a Chinese-only restriction. This can violate language/locale policy where skills should not mandate a language without user choice or documented rationale.
