ClawBot Network

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:21 PM UTC
• Version: 1.0.0

Overview

The skill’s collaboration goal is coherent, but its default setup relies on plaintext remote code downloads, unauthenticated agent APIs, and a hard-coded external server path that users should review carefully before installing.

Install only in a trusted test environment unless you first replace HTTP/ws with HTTPS/wss, remove curl-to-bash setup, verify all downloaded code, configure your own trusted server, add authentication/authorization for every agent and API call, and avoid letting remote tasks automatically trigger OpenClaw execution without human approval.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:55

Finding

Documentation Executes Mutable Remote Scripts over Plaintext HTTP

Content

View full analysis

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Error

• Location: assets/install-clawbot.sh:39

Finding

Installer Downloads and Executes Unverified Python Payloads

Content

View full analysis

start.sh <

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/index.js:24

Finding

Unauthenticated APIs Permit Agent Impersonation, Data Disclosure, and Task Injection

Content

View full analysis

{ const groups = await db.getGroups(); res.json(groups); }); // Create group app.post('/api/groups', async (req, res) => { const { name, description, ownerId } = req.body; const group = await db.createGroup(name, description, ownerId); res.json(group); }); // Get group messages app.get('/api/groups/:id/messages', async (req, res) => { const messages = await db.getGroupMessages(req.params.id, 50); res.json(messages); }); // Get agent inbox app.get('/api/agents/:id/inbox', async (req, res) => { const inbox = await db.getAgentInbox(req.params.id); res.json(inbox); }); // Get tasks app.get('/api/tasks', async (req, res) => { const tasks = await db.getTasks(); res.json(tasks); }); // Create task app.post('/api/tasks', async (req, res) => { const task = await db.createTask(req.body); // Notify assignee if online const assigneeClient = clients.get(task.assigneeId); if (assigneeClient) { assigneeClient.ws.send(JSON.stringify({ type: 'task_assigned', task: task })); } res.json(task); }); ``` `scripts/index.js:127-156`: ```javascript case 'register': agentId = msg.agent.id; clients.set(agentId, { ws, info: msg.agent, groups: new Set(), joinedAt: new Date().toISOString() }); console.log(`✅ Agent registered: ${msg.agent.name} (${agentId})`); // Send confirmation ws.send(JSON.stringify({ type: 'registered', agentId: agentId, serverTime: new Date().toISOString() })); // Broadcast to all agents broadcastAg ...[truncated 2673 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/clawbot_connector.py:42

Finding

Local Device Identity and Collaboration Data Are Disclosed over Plaintext Connections

Content

View full analysis

str: """Generate a unique bot ID""" import socket hostname = socket.gethostname().replace('.', '-') return f"clawdbot-{hostname}" def _detect_bot_name(self) -> str: """Detect bot name""" # Attempt to read the name from SOUL.md soul_path = os.path.expanduser('~/.openclaw/workspace-clawdbot/SOUL.md') if os.path.exists(soul_path): try: with open(soul_path) as f: content = f.read() import re match = re.search(r'(?:Name:|\*\*Name:\*\*)\s*(.+)', content) if match: return match.group(1).strip() except: pass import socket return f"ClawBot@{socket.gethostname()}" def _detect_device(self) -> str: """Detect device type ...[truncated 4232 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/package.json:10

Finding

Unpinned Dependency Installation Prevents Reproducible and Verifiable Builds

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (43)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

Fetching and executing a shell script directly from an external endpoint is a classic remote code execution pattern. Here it is especially dangerous because the example uses plain HTTP, so both server compromise and on-path tampering can replace the installer and fully compromise the target machine.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Option A: One-line install (MacBook/Mac Mini)

bash

curl -fsSL http://YOUR-VPS:3001/install-clawbot.sh | bash

Then start:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Piping downloaded content directly into bash removes any opportunity for inspection and turns a network response into immediate execution. In this skill, which establishes cross-device agent connectivity, that pattern is particularly hazardous because a compromised installer can implant persistent remote-control functionality across multiple machines.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

Option A: One-line install (MacBook/Mac Mini)

bash

curl -fsSL http://YOUR-VPS:3001/install-clawbot.sh | bash

Then start:

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md

**Connection refused:**
- Check server is running: `curl http://your-vps:3001/api/health`
- Check firewall: `sudo ufw allow 3001/tcp && sudo ufw allow 3002/tcp`

**Messages not received:**
- Verify `bot_id` is unique per device

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The advertised installation method instructs users to pipe a remotely hosted script directly into bash from an unauthenticated HTTP endpoint. This is dangerous because any compromise of the host, transit path, or DNS/network layer results in immediate arbitrary shell execution on the target machine with no opportunity for user review.

Content

Scanner excerpt · assets/install-clawbot.sh (reported line 5)May include surrounding context.

sh

# ClawBot Network Connector - Quick Setup
# 让任何设备上的 clawdbot 快速接入 Agent Network
#
# 用法: curl -fsSL http://3.148.174.81:3001/install-clawbot.sh | bash

set -e

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Using '| bash' executes whatever bytes are returned by the remote endpoint immediately, collapsing download, trust, and execution into one step. In the context of a networking skill that connects multiple agent instances, this is especially dangerous because it normalizes unsafe installation and could rapidly propagate malicious bootstrap code across several devices.

Content

Scanner excerpt · assets/install-clawbot.sh (reported line 5)May include surrounding context.

sh

# ClawBot Network Connector - Quick Setup
# 让任何设备上的 clawdbot 快速接入 Agent Network
#
# 用法: curl -fsSL http://3.148.174.81:3001/install-clawbot.sh | bash

set -e

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The installer fetches executable Python components from a remote server over plain HTTP and writes them into the user's environment without integrity verification or a clear upfront warning. This allows network attackers or a compromised server to replace the downloaded code with arbitrary malicious payloads, leading to code execution when the user later runs start.sh or imports the connector.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

This command downloads a shell script from an external host and pipes it directly into bash, removing any opportunity for review and making execution dependent on the integrity of a remote HTTP endpoint. Because this skill is specifically designed to connect multiple agent instances across devices, compromise of the setup script could spread code execution across several systems in the operator's environment.

Content

Scanner excerpt · references/QUICKSTART.md (reported line 9)May include surrounding context.

MacBook 用户（小邢）

bash

curl -fsSL http://3.148.174.81:3001/setup.sh | bash -s -- xiaoxing-macbook "小邢" "DevOps"
cd agent-network-client && ./start.sh

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

This is the same unsafe remote-script execution pattern: code from an external server is piped straight into bash over unsecured HTTP. If the source or traffic is tampered with, the user's Mac Mini could execute arbitrary attacker-controlled commands immediately.

Content

Scanner excerpt · references/QUICKSTART.md (reported line 15)May include surrounding context.

Mac Mini 用户（小金）

bash

curl -fsSL http://3.148.174.81:3001/setup.sh | bash -s -- xiaojin-macmini "小金" "金融市场分析"
cd agent-network-client && ./start.sh

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

This one-liner again creates an unauthenticated, unverified remote code execution path by piping a fetched script directly to bash over HTTP. In a distributed agent-collaboration skill, that is especially dangerous because it targets machines intended to trust and communicate with each other, increasing blast radius if one setup path is subverted.

Content

Scanner excerpt · references/QUICKSTART.md (reported line 21)May include surrounding context.

Mac Mini 2 用户（小陈）

bash

curl -fsSL http://3.148.174.81:3001/setup.sh | bash -s -- xiaochen-macmini "小陈" "美股交易"
cd agent-network-client && ./start.sh

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/clawbot_connector.py (reported line 100)May include surrounding context.

python

if system == "Darwin":
            # macOS - 检测是 MacBook 还是 Mac Mini
            try:
                result = os.popen("sysctl -n hw.model").read().strip()
                if "MacBook" in result:
                    return "MacBook"
                elif "Macmini" in result:

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · scripts/python_client.py (reported line 230)May include surrounding context.

python

}))
    
    async def send_message(self, group_id: str, content: str):
        """Send message to group"""
        if self.ws and self.connected:
            await self.ws.send(json.dumps({
                "type": "message",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents shell, network, and environment-capable operations but does not declare any explicit tool scope or permissions boundary. In a distributed-agent skill, this omission increases the chance that consumers will run commands or connect to remote services without clear sandboxing expectations or least-privilege controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill recommends a one-line installer that downloads and executes a remote shell script, but it does not provide a prominent warning that this runs arbitrary code from the server. Because the server is user-hosted and fetched over plain HTTP in the example, any compromise of the server or network path can immediately lead to code execution on the client machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The task-assignment examples normalize remote messages and tasks as inputs that can trigger execution-oriented actions on connected agents, yet no warning or approval requirement is described. In a multi-agent network, this creates a dangerous trust boundary where a spoofed, compromised, or misrouted message could induce automated command execution or downstream agent spawning.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 79% confidence

Finding

The troubleshooting guidance instructs use of sudo to open firewall ports, which can normalize privileged execution without clarifying scope or risk. In this context the commands are not inherently malicious, but they alter host network exposure and should be treated as security-sensitive administrative actions.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md

**Connection refused:**
- Check server is running: `curl http://your-vps:3001/api/health`
- Check firewall: `sudo ufw allow 3001/tcp && sudo ufw allow 3002/tcp`

**Messages not received:**
- Verify `bot_id` is unique per device

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script's descriptive comments and most runtime prompts are presented in Chinese, and there is no indication that the user can select another language. This creates a language/locale constraint without opt-in, which fits the policy's natural-language violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The quickstart instructs users to fetch and immediately execute a shell script from a remote server over plain HTTP using curl-pipe-bash. This creates a direct remote code execution path where any compromise of the server, network path, or DNS could result in arbitrary commands running on the user's machine without inspection.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manual installation steps tell users to download executable Python client code and configuration over plain HTTP without any integrity verification or trust warning. An attacker able to tamper with the server or traffic could deliver a trojanized client that the user then runs locally.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/QUICKSTART.md (reported line 106)May include surrounding context.

md

# 重启服务器
kill $(cat server.pid)
nohup node server/index.js > server.log 2>&1 &

# 查看状态
curl http://localhost:3001/api/health

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill's stated purpose is to connect OpenClaw instances for messaging, mentions, task assignment, and group chat across devices. Invoking os.popen("sysctl -n hw.model") adds command-execution capability on the host, which is stronger than what is obviously required for a network connector and is not declared in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The connector automatically initiates a network connection to a hard-coded remote server and transmits bot identity, device information, and presence without any user consent, trust verification, or warning. In a distributed agent skill, this is especially dangerous because it creates an unvetted command-and-control channel through which external parties may message the bot, assign tasks, and potentially influence downstream agent behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The clearOfflineMessages function performs a destructive DELETE operation on stored offline messages, but the code provides no confirmation prompt, user-visible log, or warning around this data removal. Because this removes persisted user/agent message data, it qualifies as a safety-relevant operation lacking disclosure in the code shown.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This server stores group messages and offline direct/mention messages in the database and transmits message contents over WebSocket connections, but the file provides no user-facing disclosure, confirmation, or warning about retention and transmission of user data. Because these operations affect user privacy and data handling, they meet the missing-warning criterion for code files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The usage example hardcodes Chinese display names and message content, which signals a specific language expectation in the skill's natural-language interface. Because the file does not offer an opt-in language choice or explain that the client is intended only for a Chinese-speaking environment, this is a locale policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/python_client.py (reported line 280)May include surrounding context.

python

def create_task(self, title: str, description: str, assignee_id: str, **kwargs) -> dict:
        """Create a task"""
        try:
            response = requests.post(f"{self.rest_url}/api/tasks", json={
                "title": title,
                "description": description,
                "assigneeId": assignee_id,

Static analysis

No suspicious patterns detected.