ClawHub
Back to skill

Security audit

1panel-install

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real 1Panel installer, but it performs root-level system changes, runs an unverified downloaded installer, exposes admin credentials, and includes a dangerous test script that can disrupt an existing installation.

Review before installing. Use this only on a server where root-level 1Panel installation is intended, verify the downloaded package independently, avoid running test.sh on a production machine, and treat any displayed panel password as sensitive; rotate it immediately after installation.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
install.sh:20
Finding
Unverified Remote Installer Is Executed with Root Privileges<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:20-23`, `install.sh:72-102`, and `install.sh:104-124` **Vulnerability Type**: Unverified remote payload retrieval and privileged execution **Risk Level**: High ### Vulnerable Code ```bash TAR_DIR="/root/.openclaw/workspace/1panel-v2.1.4-linux-amd64" TAR_FILE="/root/.openclaw/workspace/1panel-v2.1.4-linux-amd64.tar.gz" ONEDRIVE_URL="https://resource.fit2cloud.com/1panel/package/v2/stable/v2.1.4/release/1panel-v2.1.4-linux-amd64.tar.gz" VERSION="v2.1.4" ``` ```bash download_install_package() { local retry_count=3 local retry_delay=2 if [[ -d "$TAR_DIR" ]]; then log_info "安装包已存在，跳过下载" return 0 fi log_info "正在下载 1Panel $VERSION 安装包..." for i in $(seq 1 $retry_count); do if curl -fSL --retry 3 --retry-delay $retry_delay "$ONEDRIVE_URL" -o "$TAR_FILE"; then log_success "下载完成" break else if [[ $i -lt $retry_count ]]; then log_warning "下载失败，第 $i 次重试..." sleep $retry_delay else log_error "下载失败，请检查网络连接" return 1 fi fi done # 解压 log_info "正在解压安装包..." if tar -xzf "$TAR_FILE" -C /root/.openclaw/workspace/; then log_success "解压完成" return 0 else log_error "解压失败，安装包可能损坏" return 1 fi } ``` ```bash run_install_script() { log_info "开始安装 1Panel..." log_info "安装路径: $INSTALL_DIR (默认)" log_info "是否安装 Docker: 否" log_info "语言: 中文" echo "" cd "$TAR_DIR" # 使用 heredoc 自动输入安装选项 # 选项顺序： # 2 - 选择中文 # (回车) - 使用默认路径 /opt # n - 不安装 Docker if echo -e "2\n\nn" | ./install.sh; then log_success "安装脚本执行完成" return 0 else log_error "安装脚本执行失败" return 1 fi } ``` ### Technical Analysis The Skill requires root privileges and downloads a compressed installation package from an ext ...[truncated 2692 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Publish and pin the expected SHA-256 or SHA-512 digest for the exact `v2.1.4` archive. 2. Verify the digest before extraction and terminate with a nonzero status on any mismatch: ```bash EXPECTED_SHA256="vendor-published-digest" printf '%s %s\n' "$EXPECTED_SHA256" "$TAR_FILE" | sha256sum --check --status || { log_error "Package integrity verification failed" rm -f -- "$TAR_FILE" exit 1 } ``` 3. Prefer verification using a vendor-signed release manifest with a pinned, independently obtained public key. 4. Never trust `$TAR_DIR` merely because it exists. Remove it and perform a fresh verified extraction, or verify every cached artifact before reuse. 5. Download to a newly created root-owned temporary directory using `mktemp -d`, restrictive permissions, and an `EXIT` cleanup trap. 6. Validate archive entries before extraction to reject absolute paths, `..` traversal, and unexpected symbolic links. 7. Use `curl` options that explicitly constrain acceptable protocols and TLS behavior, such as `--proto '=https'`. 8. Log the verified version and digest so administrators can audit exactly which artifact was executed. 9. Where supported by the vendor, use a trusted operating-system package repository with package-signature verification rather than directly executing an archive installer. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
test.sh:39
Finding
Destructive Root Test Can Leave the Production Installation Disabled or Partially Removed<![CDATA[ ## Vulnerability Details **File Location**: `test.sh:39-58` and `test.sh:91-133` **Vulnerability Type**: Unsafe destructive testing and incomplete rollback **Risk Level**: High ### Vulnerable Code The test moves a live installation and disables its services before the user has agreed to run the installation test: ```bash BACKUP_DIR="/tmp/1panel-backup-$(date +%s)" if command -v 1pctl &> /dev/null; then echo "测试 2：模拟未安装状态（临时备份 1Panel）..." echo "备份目录：$BACKUP_DIR" # 备份已安装的文件 mkdir -p "$BACKUP_DIR" if [[ -d "/opt/1panel" ]]; then mv /opt/1panel "$BACKUP_DIR/" fi if command -v 1pctl &> /dev/null; then mv /usr/bin/1pctl "$BACKUP_DIR/" fi # 停止服务 systemctl stop 1panel-core 2>/dev/null || true systemctl stop 1panel-agent 2>/dev/null || true systemctl disable 1panel-core 2>/dev/null || true systemctl disable 1panel-agent 2>/dev/null || true echo "已临时移除 1Panel" echo "" else echo "测试 2：跳过（1Panel 未安装）" echo "" fi ``` Restoration is optional and defaults to not restoring the original installation: ```bash if [[ -d "$BACKUP_DIR" ]]; then echo "" read -p "是否恢复之前的 1Panel 备份？(y/N): " -n 1 -r echo "" if [[ $REPLY =~ ^[Yy]$ ]]; then echo "恢复备份..." # 停止新安装的服务 systemctl stop 1panel-core 2>/dev/null || true systemctl stop 1panel-agent 2>/dev/null || true systemctl disable 1panel-core 2>/dev/null || true systemctl disable 1panel-agent 2>/dev/null || true # 清理新安装的文件 rm -rf /opt/1panel rm -f /usr/bin/1pctl rm -f /etc/systemd/system/1panel-*.service # 恢复备份 if [[ -f "$BACKUP_DIR/1pctl" ]]; then cp "$BACKUP_DIR/1pctl" /usr/bin/ chmod +x /usr/bin/1pctl fi if [[ -d "$BACKUP_DIR/1panel" ]]; then cp -r "$BACKUP_DIR/1panel" /opt/ fi # 重新加载 systemd systemctl daemo ...[truncated 3684 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Do not run installation tests against an active host installation. Use a disposable virtual machine, container, or dedicated test server. 2. Remove the live-installation simulation from `test.sh`, or require an explicit destructive-test flag and a clear confirmation before making any changes. 3. Ask whether installation testing should proceed before moving files or stopping services. 4. Implement guaranteed rollback immediately after establishing the backup: ```bash rollback() { # Validate and restore the original installation atomically. : } trap rollback EXIT INT TERM HUP ``` 5. Track the original enabled and active state of each service separately, then restore exactly that state rather than always enabling `1panel-core`. 6. Create backups with `mktemp -d`, ensure root ownership, and apply mode `0700`. 7. Validate backup completeness before deleting or replacing any active installation. 8. Restore with atomic renames on the same filesystem where possible instead of recursive copies. 9. Do not suppress all systemd errors. Record failures and abort safely when the expected service state cannot be established. 10. Avoid broad deletion patterns such as `/etc/systemd/system/1panel-*.service`; maintain an explicit list of files created during the test. 11. Preserve and restore configuration, data, service unit files, ownership, permissions, extended attributes, and security labels. 12. Add automated tests confirming rollback after installation failure, `SIGINT`, `SIGTERM`, and unexpected process termination. ]]>

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (26)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
The code does relate to 1Panel installation, but it does not primarily implement the declared end-user skill behavior. Instead of being the one-click installer that automatically detects installation state and installs or returns access info, this chunk is a testing script for such an installer. It performs additional destructive/admin actions not stated in the description, including backing up and temporarily removing an existing installation, stopping/disabling services, and restoring backups. It also requires root and interactive prompts, which differs from the described automatic installation flow. Therefore the supplied code chunk does not accurately represent the declared purpose.

Ssd 3

High
Confidence
97% confidence
Finding
The installed-instance flow tells the assistant to fetch and disclose existing panel access information, which may include active administrative credentials. Retrieving and echoing pre-existing secrets is especially dangerous because it can expose long-lived access to an already deployed management plane.

Ssd 3

High
Confidence
98% confidence
Finding
The skill instructs the assistant to return newly generated admin access URLs, usernames, and passwords in plain-language output. Exposing credentials in chat or logs can leak administrative access to anyone with transcript access, creating immediate account and server compromise risk.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
systemctl disable 1panel-agent 2>/dev/null || true
        
        # 清理新安装的文件
        rm -rf /opt/1panel
        rm -f /usr/bin/1pctl
        rm -f /etc/systemd/system/1panel-*.service
Confidence
100% confidence
Finding
The script recursively deletes /opt/1panel as root during restoration cleanup. In the context of an installation test script, deleting application directories on the host is dangerous because it can destroy user data or a valid installation, especially if the backup/restore flow fails or if the host was not meant to be modified.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
systemctl disable 1panel-agent 2>/dev/null || true
        
        # 清理新安装的文件
        rm -rf /opt/1panel
        rm -f /usr/bin/1pctl
        rm -f /etc/systemd/system/1panel-*.service
Confidence
100% confidence
Finding
The script recursively deletes /opt/1panel as root during restoration cleanup. In the context of an installation test script, deleting application directories on the host is dangerous because it can destroy user data or a valid installation, especially if the backup/restore flow fails or if the host was not meant to be modified.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
# 清理新安装的文件
        rm -rf /opt/1panel
        rm -f /usr/bin/1pctl
        rm -f /etc/systemd/system/1panel-*.service
        
        # 恢复备份
Confidence
95% confidence
Finding
Removing /usr/bin/1pctl as root directly alters a system executable outside package-management safeguards. If the restoration sequence fails or the binary belongs to a different installation source/version, the host can be left without a working management CLI.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
# 清理新安装的文件
        rm -rf /opt/1panel
        rm -f /usr/bin/1pctl
        rm -f /etc/systemd/system/1panel-*.service
        
        # 恢复备份
        if [[ -f "$BACKUP_DIR/1pctl" ]]; then
Confidence
95% confidence
Finding
Deleting /etc/systemd/system/1panel-*.service removes service definitions from the host. In a root-executed test script this can break service management or permanently alter system state if the units are not fully restored, making the install skill more dangerous because it targets persistent host configuration rather than a sandbox.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README states that the skill will automatically install 1Panel and return the generated access URL, username, and password during normal use. That creates a real security risk because it performs privileged system changes and exposes fresh administrative credentials in chat/output without requiring an explicit confirmation or warning at the point of use.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```bash
cd /root/.openclaw/workspace/skills/1panel-install
chmod +x install.sh
sudo ./install.sh
```

预期输出：
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares shell-capable behavior but does not explicitly constrain tool scope with a permissions or allowed-tools policy. In a skill that performs installation, service management, and filesystem changes, missing tool scoping increases the chance of unintended or overly broad command execution.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The activation description is broad enough that normal discussion of installing, deploying, or configuring 1Panel could trigger privileged system actions. Because this skill installs software as root and changes system state, ambiguous activation materially raises the risk of accidental execution.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill does not prominently warn up front that it will execute a remote installation script with root privileges and alter the host system. Running network-fetched code as root is a high-risk action, and failing to disclose that deprives the user of informed consent and increases the chance of unsafe use.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger examples use catch-all wording that can cause over-activation for requests that may only seek advice rather than execution. In the context of a root-level installer, this can lead to unintended remote script execution and system modification.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
### 2. 检查 root 权限

此脚本需要 root 权限安装系统服务。如果当前用户不是 root，提示用户使用 sudo 执行。

## 安装流程
Confidence
89% confidence
Finding
The skill explicitly requires root or sudo execution to install services and modify the system. Privileged execution is not inherently malicious, but in this context it amplifies the risk of any mistake, overbroad trigger, or compromised remote installer into full-system impact.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The script announces '语言: 中文' and then hard-codes menu option '2' into the installer input to select Chinese. This is a natural-language policy concern because it imposes a specific language choice on users without giving them a choice or requiring explicit consent.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The script downloads an external tarball from the network and then executes its embedded install.sh as root with no integrity verification, no signature/hash check, and no user confirmation. In the context of an agent skill that may auto-run installation, this creates a supply-chain risk where a compromised download source, DNS/TLS interception, or replaced local archive could lead to full root remote code execution.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
#!/bin/bash

# 测试脚本：验证 1panel-install skill 的功能
# 用法：sudo ./test.sh

set -e
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
#!/bin/bash

# 测试脚本：验证 1panel-install skill 的功能
# 用法：sudo ./test.sh

set -e
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
#!/bin/bash

# 测试脚本：验证 1panel-install skill 的功能
# 用法：sudo ./test.sh

set -e
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
#!/bin/bash

# 测试脚本：验证 1panel-install skill 的功能
# 用法：sudo ./test.sh

set -e
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The test script, when run as root, intentionally moves an existing 1Panel installation out of place, stops services, and disables them to simulate an uninstalled state. Even though this is framed as testing, it performs destructive system changes beyond simple validation and can disrupt a production installation or leave the host in an inconsistent state if the script aborts mid-run.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The restoration path deletes system files and service units, then replaces binaries and application directories from a temporary backup. In a root-run script this is risky because any failure, stale backup, or path mismatch can remove working software or alter service state unexpectedly, which exceeds what a normal install-skill test should do.

Session Persistence

Medium
Category
Rogue Agent
Content
# 如果原服务存在，重新启用
        if systemctl list-unit-files | grep -q 1panel-core; then
            systemctl enable 1panel-core 2>/dev/null || true
            systemctl start 1panel-core 2>/dev/null || true
        fi
Confidence
80% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Low
Confidence
95% confidence
Finding
The README includes a fixed language setting of '中文', which can constitute a language-policy issue when presented as a default constraint without offering alternatives. There is no nearby wording indicating that the user can choose another language or that the locale restriction is required for a region-specific purpose.

Natural-Language Policy Violations

Low
Confidence
98% confidence
Finding
The installation flow explicitly says it will '自动选择中文语言', which imposes a language choice on the user. This is a locale/language policy issue because the skill does not offer a choice or document a justified region-specific requirement.

Static analysis

No suspicious patterns detected.