Security audit

Agent Peer Lan

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its LAN peer-collaboration purpose, but it exposes an agent-control gateway and passes gateway tokens over plain HTTP, so users should review it carefully before use.

Use this only on a trusted, isolated LAN. Prefer binding the gateway to a specific LAN IP, restrict firewall rules to exact peer IPs, require gateway authentication, and use TLS or an encrypted tunnel before sending tokens or sensitive tasks. Do not run the sudo/admin firewall commands blindly, and rotate gateway tokens if they may have been exposed.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:137
Finding: Gateway Credentials and Agent-Control Traffic Transmitted over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:43
Finding: Gateway May Be Exposed on All Network Interfaces
Content: View full analysis
``` ```json { "gateway": { "bind": "0.0.0.0", "port": 18789 } } ``` The documentation does recommend source-restricted firewall rules. However, those restrictions are separate manual actions and are not enforced by the binding or forwarding configuration. ### Technical Analysis Binding the gateway to `0.0.0.0` causes it to listen on every available IPv4 interface. On systems connected to multiple networks, this can include trusted LAN, guest Wi-Fi, VPN, container bridge, virtual-machine, and potentially public-facing interfaces. The WSL `portproxy` example has the same broad exposure characteristic. The security of this configuration depends entirely on correctly installed and persistent firewall rules. If the user omits the firewall step, selects an overly broad subnet, applies the rule to the wrong firewall profile, or later changes network topology, unauthorized systems may be able to reach the agent-control gateway. Binding directly to the intended LAN address would enforce a narrower exposure boundary at the socket level and reduce dependence on external firewall configuration. ### Attack Path 1. A user follows the easier documented option and configures the gateway or WSL proxy to listen on `0.0.0.0`. 2. The firewall restriction is omitted, incorrectly ...[truncated 1397 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (10)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill instructs the agent to edit configuration files, create peer config files, and run shell/network commands, but it declares no explicit tool scope or permission boundaries. That increases the chance an agent platform will invoke file-write and shell capabilities implicitly, enabling broader-than-expected host changes during routine use.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad enough to match ordinary collaboration requests, which could cause the skill to activate unexpectedly in contexts where network exposure and peer connectivity were not intended. That raises the risk of an agent proposing or performing network reconfiguration, file creation, or remote message routing under an ambiguous prompt.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 84% confidence
Finding: The skill includes a privileged command that modifies the local firewall, which can materially change host network exposure. Even though the example restricts access to a trusted subnet, use of sudo in a broadly-triggered skill is dangerous because it can normalize privileged execution and lead to unintended opening of the gateway service.
Content: Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.
Linux (ufw):

bash
# Replace 192.168.1.0/24 with your trusted subnet sudo ufw allow from 192.168.1.0/24 to any port 18789

Linux (iptables):

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 86% confidence
Finding: The iptables example requires root privileges and permanently alters packet-filtering behavior unless carefully managed. In the context of this skill, that is risky because it enables remote reachability of the gateway and may be applied incorrectly on systems where rule order, persistence, or broader accept rules create more exposure than the user expects.
Content: Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.
Linux (iptables):

bash
# Replace 192.168.1.0/24 with your trusted subnet sudo iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 18789 -j ACCEPT

Windows:

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/troubleshooting.md (reported line 25)May include surrounding context.
md
### "Connection timed out" 1. **Firewall blocking.** The most common issue. - Linux: `sudo ufw allow from <trusted-subnet> to any port 18789` - Windows: `New-NetFirewallRule -DisplayName "OpenClaw" -Direction Inbound -LocalPort 18789 -Protocol TCP -Action Allow -RemoteAddress <trusted-subnet>` 2. **Wrong subnet.** Both machines must be on the same subnet (or have routing between subnets).

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The guide explicitly shows how to retrieve and pass a peer gateway auth token, but does not label the token as a sensitive secret or warn against exposing it in logs, screenshots, shell history, or shared notes. In a LAN peer-agent skill, that omission is meaningful because possession of the token appears sufficient to authenticate to the peer gateway, enabling unauthorized agent interaction if the token leaks.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/peer_config.py (reported line 27)May include surrounding context.
python
"""Try to detect the local LAN IP address.""" # Try ipconfig on Windows try: result = subprocess.run( ["ipconfig"], capture_output=True, text=True, timeout=5 )

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/peer_config.py (reported line 47)May include surrounding context.
python
# Try ip on Linux/macOS try: result = subprocess.run( ["ip", "route", "get", "1.1.1.1"], capture_output=True, text=True, timeout=5 )

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The manifest frames the skill as enabling direct LAN collaboration between two OpenClaw agents. While network reachability is relevant, the documented capability extends into host firewall administration across Linux and Windows, which is broader than the core collaboration function and grants system-level network access changes not explicitly justified by the manifest.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.