ClawHub
Back to skill

Security audit

0G Compute

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for setting up 0G Compute providers, but it handles wallet keys, provider secrets, fund movement, and a global unpinned CLI install with insufficient safety boundaries.

Review this carefully before installing. Use a dedicated low-balance wallet, avoid running npm as root, pin and verify the CLI package if possible, do not paste private keys into command arguments on shared or monitored systems, restrict permissions on 0G and OpenClaw config files, keep openclaw.json out of source control and logs, and confirm every fund-moving command manually.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:13
Finding

Unpinned npm Package Installed Globally

Content
View full analysis
Remediation
View remediation
``` 2. Document the official package source and expected package integrity or provenance. 3. Verify package signatures, npm provenance attestations, or published checksums where available. 4. Prefer a project-local installation with a lockfile over global installation when operationally possible. 5. Use `npm install --ignore-scripts` if the package supports operation without installation lifecycle scripts. 6. Review release changes before updating the pinned version. 7. Explicitly warn users not to run the installation as root or through `sudo`. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:15
Finding

Wallet Private Key Passed Through Process Arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
references/openclaw-config.md:54
Finding

Provider API Secret Stored Directly in Plaintext Configuration

Content
View full analysis
``` Save this secret — it will be your `apiKey`. ## Step 5: Add to OpenClaw Config Edit your `openclaw.json` file. Add a new provider under `models.providers`: ```json { "models": { "providers": { "0g-llama3-70b": { "baseUrl": "https://provider-url.example.com/v1/proxy", "apiKey": "", "api": "openai-completions", "models": [ { "id": "llama-3-70b", "name": "Llama 3 70B (0G)" } ] } } } } ``` ``` ### Technical Analysis The setup guide tells users to save a provider API secret directly in `openclaw.json`. It does not require restrictive file permissions, exclusion from source control and backups, or the use of environment or secret-manager references. Plaintext configuration is not automatically exploitable by a remote party. Exploitation requires access to the file through local permissions, an accidental repository commit, backup disclosure, diagnostic bundles, or another information leak. Nevertheless, persisting a reusable API credential without documented protections expands its exposure surface. ### Attack Path 1. The user retrieves a provider API secret using `get-secret`. 2. The user copies the secret into `openclaw.json` as instructed. 3. The configuration is created with permissive permissions, synchronized to an insecure backup, included in a support bundle, or accidentally committed to source control. 4. An unauthorized party obtains the configuration file and extracts the `apiKey`. 5. The party uses the key against the configured provider endpoint until the credential expire ...[truncated 497 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code’s behavior is narrowly focused on public-data price comparison. It uses CoinGecko for the 0G token price, the 0g-compute-cli to list providers, and OpenRouter’s models endpoint to compare token pricing. That aligns with one slice of the description: discovering providers/models and comparing prices. However, the declared purpose emphasizes a much broader skill centered on using 0G providers in OpenClaw, including TEE/Intel TDX integrity verification, wallet/sub-account management, and OpenClaw configuration. None of those core capabilities appear in this code chunk. Because the actual code implements only a subset and omits several prominently claimed functions, the description does not accurately represent what this supplied code chunk actually does.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The skill instructs the user to obtain a provider secret and paste it into a local configuration file, which is a credential-handling step with meaningful exposure risk. If that secret is stored in plaintext, committed to source control, shared in logs, or written with weak file permissions, an attacker could reuse it to access the provider endpoint or impersonate the user for billable or sensitive inference operations.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

4. Configure OpenClaw Provider

Get API key from a verified provider (interactive — prompts for expiration):

bash
0g-compute-cli inference get-secret --provider <address>

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/0g-price-compare.sh (reported line 15)May include surrounding context.

sh
# 1. 0G token price (CoinGecko ID: zero-gravity)
echo -e "\033[2mFetching 0G token price...\033[0m"
OG_USD=$(curl -sf 'https://api.coingecko.com/api/v3/simple/price?ids=zero-gravity&vs_currencies=usd' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['zero-gravity']['usd'])" 2>/dev/null || echo "")

if [ -z "$OG_USD" ]; then

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documents multiple shell commands and its metadata requires installing and invoking a CLI, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates a governance and containment gap: an agent may execute shell-capable behavior without an auditable, least-privilege declaration, increasing the chance of unintended command execution around wallet, network, and config operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation instructs users to retrieve and display a provider API secret directly in terminal output (API Secret: sk-abc123...) without warning that this value is sensitive. Secrets printed to stdout can be exposed through terminal logs, screen sharing, shell history capture, CI logs, or clipboard reuse, which is especially relevant because this skill manages wallets and paid inference providers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The document tells users to retrieve a provider secret and place it directly into openclaw.json, but it does not warn that this value is a credential that must be protected from source control, logs, backups, and broad local read access. In this skill’s context, the secret authorizes paid inference access against a funded on-chain sub-account, so disclosure could let an attacker consume balance, impersonate the user to the provider, or pivot through a trusted model endpoint.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/0g-price-compare.sh (reported line 15)May include surrounding context.

sh
# 1. 0G token price (CoinGecko ID: zero-gravity)
echo -e "\033[2mFetching 0G token price...\033[0m"
OG_USD=$(curl -sf 'https://api.coingecko.com/api/v3/simple/price?ids=zero-gravity&vs_currencies=usd' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['zero-gravity']['usd'])" 2>/dev/null || echo "")

if [ -z "$OG_USD" ]; then

Static analysis

No suspicious patterns detected.