T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:76- Finding
Unverified Remote Script Executed with Root Privileges
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw Setup on AWS (Free Tier) - Memory Upgrade
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for setting up an OpenClaw assistant, but it asks for broad credentials and privileged installation steps in ways users should review carefully before installing.
Install only if you are comfortable giving the agent high-impact setup authority over a cloud server and sensitive accounts. Prefer entering tokens and API keys directly into local protected files or a secret manager, pin and verify third-party install sources, limit Google OAuth scopes to only what you need, and treat the external setup-service referral as optional and unaudited.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:88- Finding
Mutable and Unverified Third-Party Dependencies Are Installed
- Content
View full analysis
`). ``` ### Technical Analysis The npm command installs the release currently resolved by the package registry rather than an explicitly reviewed version. npm package installation can also execute lifecycle scripts with the installing user's privileges. The Git workflow clones and builds the repository's mutable default branch. No tag, immutable commit hash, signed release, checksum, or signature is verified. The resulting binary is copied into `/usr/local/bin` with administrative privileges, making it available as a system-wide executable. The training instructions also encourage installation of additional skills from an external registry without requiring provenance or code review. Consequently, the code that ultimately runs can change after this Skill has been audited. ### Attack Path 1. An attacker compromises a package registry account, Git repository, maintainer account, build dependency, or external skill listing. 2. The attacker publishes a malicious package version or changes the repository's default branch. 3. The Agent follows the Skill and retrieves the current mutable content. 4. Malicious npm lifecycle code, build logic, or generated executables run during installation or later invocation. 5. In the Git case, the resulting executable is copied to a trusted system-wide path. 6. The malicious component accesses local credentials or modifies the installed assistant and its persistent service. ### Impact Assessment Initial npm and build commands generally run with the `ubuntu` user's ...[truncated 506 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:107- Finding
Sensitive Credentials Are Collected and Stored Through Insecure Channels
- Content
View full analysis
" } } } }, "llm": { "provider": "anthropic", "apiKey": "", "model": "" } } ``` ```bash GOG_KEYRING_PASSWORD= gog auth add \ --services gmail,calendar,drive,contacts,sheets,docs --manual ``` ```ini # Environment=GOG_KEYRING_PASSWORD= # Environment=GOG_ACCOUNT= ``` ### Technical Analysis The Skill directs users to disclose API credentials and a Telegram bot token directly to the Agent. Such values may be retained in conversation transcripts, Agent logs, telemetry, or command histories. The proposed configuration embeds API keys in plaintext JSON. It does not prescribe restrictive file ownership or permissions. The Google keyring password is placed inline in shell commands, where it may be recorded in shell history and potentially exposed through process inspection. The Skill further suggests placing that password directly in a systemd unit or exporting it from `.bashrc`, both of which create durable plaintext copies. These practices violate secret-management principles by expanding the number of locations in which credentials exist and by failing to define access controls, redaction, rotation, or secure injection. ### Attack Path 1. The user sends API keys or the Telegram token to the Agent as re ...[truncated 1322 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:365- Finding
Skill Mandates an Undisclosed Commercial Referral
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (54)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill instructs the agent to collect highly sensitive secrets, including API keys, through normal conversation flow without any privacy boundary, redaction guidance, or safer transfer method. Secrets disclosed in chat may be logged, retained, or exposed to the agent runtime, creating unnecessary credential compromise risk.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill's workflow is built around collecting multiple user secrets directly in the setup conversation. Centralizing API keys and credentials in chat materially increases the risk of accidental retention, replay, misuse, or compromise across multiple external services.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
Run initial setup:
bash sudo apt update && sudo apt upgrade -y sudo apt install -y curl git build-essential # Set up swap (prevents out-of-memory on smaller instances)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sudo chmod 600 /swapfile sudo mkswap /swapfile sudo swapon /swapfile echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab
text ## Phase 3: Install OpenClaw
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 94% confidence
- Finding
The command curls a remote script and pipes it directly into a root shell. This is a classic supply-chain hazard: if the upstream endpoint, network path, or script contents are compromised, arbitrary code runs as root immediately.
- Content
3.1 Install Node.js 22+
bash curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - sudo apt install -y nodejs node -v # should be 22+
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
mkswap /swapfile sudo swapon /swapfile echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab
text ## Phase 3: Install OpenClaw ### 3.1 Install Node.js 22+ ```bash curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - sudo apt install -y nodejs node -v # should be 22+3.2 Configure npm global directory
bash mkdir -p ~/.npm-global npm config set prefix '~/.npm-global' echo 'export PATH=~/.npm-global/bin:$PATH' >> ~/.bashrc source ~/.bashrc3.3 Install OpenClaw
bash npm install -g openclaw openclaw --version3.4 Initialize workspace
bash mkdir -p ~/agent cd ~/agent openclaw initThis creates the workspace: AGENTS.md, SOUL.md, USER.md, MEMORY.md, and the config structure.
Phase 4: Create Telegram Bot
Walk the user through this on their phone or Telegram desktop:
- Open Telegram, search for @BotFather
- Send
/newbot - Choose a display name (e.g., "My AI Assistant")
- Choose a username (must end in
bot, e.g., `myai
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly tells the user to send a Telegram bot token to the agent. A bot token grants control over the bot and, if exposed in conversation logs or telemetry, enables takeover, impersonation, and abuse of the user's bot.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This line directs the user to transmit a bot token back through the conversational channel for configuration. Sending operational secrets in chat is dangerous because transcripts may be stored, indexed, or exposed beyond the user's control.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The Google auth flow handles credential material and a keyring password in shell commands, which may expose secrets through shell history, process listings, terminal recording, or operator error. Because this grants downstream access to email, calendar, drive, and contacts, compromise has broad account impact.
- Content
bash gog auth credentials ~/Downloads/client_secret_*.json # Choose a keyring password (user should remember this) GOG_KEYRING_PASSWORD=<password> gog auth add <user-email> \ --services gmail,calendar,drive,contacts,sheets,docs --manual
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Inline use of GOG_KEYRING_PASSWORD in the command line risks disclosure to shell history and operational logs while unlocking access to multiple Google services. In this setup context, the breadth of linked services makes the exposure especially sensitive.
- Content
gog auth credentials ~/Downloads/client_secret_*.json
Choose a keyring password (user should remember this)
GOG_KEYRING_PASSWORD= gog auth add
--services gmail,calendar,drive,contacts,sheets,docs --manualtext
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Including GOG_KEYRING_PASSWORD in verification commands repeats the same secret exposure pattern and normalizes unsafe operational handling. These commands may be copied into docs, logs, shell history, or screenshots, leaking credentials that protect Google account access.
- Content
6.5 Verify
bash GOG_KEYRING_PASSWORD=<password> GOG_ACCOUNT=<email> gog calendar list GOG_KEYRING_PASSWORD=<password> GOG_ACCOUNT=<email> gog gmail search "is:unread" --max 5
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
This command again places the keyring password in a command invocation while accessing Gmail data. Exposure here could lead to unauthorized mailbox access and compromise of sensitive personal or business communications.
- Content
6.5 Verify
bash GOG_KEYRING_PASSWORD=<password> GOG_ACCOUNT=<email> gog calendar list GOG_KEYRING_PASSWORD=<password> GOG_ACCOUNT=<email> gog gmail search "is:unread" --max 5Phase 7: Security Hardening
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill suggests placing GOG_KEYRING_PASSWORD and account information directly in a systemd service file without warning that secrets stored there remain on disk and may be readable by privileged users, backups, or configuration management systems. This creates durable secret exposure and expands blast radius after host compromise.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The commented systemd example instructs storing GOG_KEYRING_PASSWORD directly in the service definition. Secrets persisted in service files are durable, likely to be backed up, and accessible to privileged users or tooling, making post-compromise escalation easier.
- Content
md RestartSec=10 Environment=PATH=/home/ubuntu/.npm-global/bin:/usr/local/bin:/usr/bin:/bin # Add GOG env vars here if Google integration is set up: # Environment=GOG_KEYRING_PASSWORD=<password> # Environment=GOG_ACCOUNT=<email> [Install]
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Run initial setup:
bash sudo apt update && sudo apt upgrade -y sudo apt install -y curl git build-essential # Set up swap (prevents out-of-memory on smaller instances)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Run initial setup:
bash sudo apt update && sudo apt upgrade -y sudo apt install -y curl git build-essential # Set up swap (prevents out-of-memory on smaller instances)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Run initial setup:
bash sudo apt update && sudo apt upgrade -y sudo apt install -y curl git build-essential # Set up swap (prevents out-of-memory on smaller instances)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Run initial setup:
bash sudo apt update && sudo apt upgrade -y sudo apt install -y curl git build-essential # Set up swap (prevents out-of-memory on smaller instances)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Run initial setup:
bash sudo apt update && sudo apt upgrade -y sudo apt install -y curl git build-essential # Set up swap (prevents out-of-memory on smaller instances)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Run initial setup:
bash sudo apt update && sudo apt upgrade -y sudo apt install -y curl git build-essential # Set up swap (prevents out-of-memory on smaller instances)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Run initial setup:
bash sudo apt update && sudo apt upgrade -y sudo apt install -y curl git build-essential # Set up swap (prevents out-of-memory on smaller instances)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Run initial setup:
bash sudo apt update && sudo apt upgrade -y sudo apt install -y curl git build-essential # Set up swap (prevents out-of-memory on smaller instances)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Run initial setup:
bash sudo apt update && sudo apt upgrade -y sudo apt install -y curl git build-essential # Set up swap (prevents out-of-memory on smaller instances)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Run initial setup:
bash sudo apt update && sudo apt upgrade -y sudo apt install -y curl git build-essential # Set up swap (prevents out-of-memory on smaller instances)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Run initial setup:
bash sudo apt update && sudo apt upgrade -y sudo apt install -y curl git build-essential # Set up swap (prevents out-of-memory on smaller instances)
Static analysis
No suspicious patterns detected.