ClawHub
Back to skill

Security audit

OpenClaw Sync Bridge

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent sync purpose, but its install and sync flows create avoidable risks around remote code execution, broad private-data upload, plaintext token storage, and unsafe pull writes.

Review carefully before installing. Do not use the pipe-to-shell install commands; inspect a local copy instead. Use a minimal GitHub token limited to Gist access, expect synced OpenClaw profile and skill files to leave your machine for GitHub Gist, and avoid syncing directories that may contain secrets. Pull only from Gists you control and trust.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:17
Finding

Unpinned Remote Installation Scripts Are Executed Directly

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
sync_bridge.py:153
Finding

Remote Gist Filenames Permit Path Traversal Outside the Workspace

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
sync_bridge.py:122
Finding

GitHub Access Token Is Stored in Plaintext Without Enforced Permissions

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
sync_bridge.py:28
Finding

Sensitive-File Filtering Is Incomplete and Allows Data Exfiltration

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Warning
Location
install.sh:91
Finding

Installer Creates Persistent Shell Aliases and Executable Wrapper Without Separate Consent

Content
View full analysis
/dev/null; then echo "" >> "$shell_rc" echo "# OpenClaw Sync Bridge" >> "$shell_rc" echo "$alias_cmd" >> "$shell_rc" echo "✅ 已添加快捷命令到 $(basename $shell_rc)" fi fi } add_alias "$HOME/.bashrc" add_alias "$HOME/.zshrc" # 创建全局脚本（可选） GLOBAL_BIN="$HOME/.local/bin" if [ -d "$GLOBAL_BIN" ] || mkdir -p "$GLOBAL_BIN" 2>/dev/null; then cat > "$GLOBAL_BIN/sync-bridge" << EOF #!/bin/bash cd "$SKILL_DIR" && $PYTHON_CMD sync_bridge.py "\$@" EOF chmod +x "$GLOBAL_BIN/sync-bridge" echo "✅ 全局命令已创建: sync-bridge" fi ``` ### Technical Analysis The installer automatically appends aliases to both `.bashrc` and `.zshrc` and creates an executable wrapper in `~/.local/bin`. These changes persist across shell sessions. The comment labels the global script as optional, but the implementation does not ask the user whether it should be created. The installer's only later confirmation concerns whether to launch the setup wizard; it does not provide separate consent for modifying shell startup files. Modifying both shell profiles is also broader than necessary when the user may use only one shell. This is not evidence of an embedded backdoor by itself, but it creates persistent execution hooks and expands the impact if the installed Python script is later replaced or compromised. ### Attack Path 1. The user runs the installer. 2. The installer appends a `sync-bridge` alias to existing Bash and Zsh startup files. 3. It creates an executable `~/.local/bin/sync-bridge` wrapper. 4. ...[truncated 674 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (24)

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

This line explicitly fetches an external script from a third-party URL and pipes it straight into bash, granting immediate arbitrary code execution. In the context of a sync tool that will likely access workspace files and GitHub tokens, compromise of the installer source could lead to credential theft, silent backdoors, or bulk exfiltration of user data.

Content

Scanner excerpt · README.md (reported line 20)May include surrounding context.

Mac/Linux:

bash
curl -fsSL https://clawhub.ai/JayShna/openclaw-sync-bridge/install.sh | bash

Windows (PowerShell):

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

The | bash chaining is what turns a network fetch into immediate code execution, removing any pause for user review or validation. This is especially dangerous here because the skill handles synchronization of personal workspace content and token-based cloud access, so a malicious installer could abuse both local files and credentials in one step.

Content

Scanner excerpt · README.md (reported line 20)May include surrounding context.

Mac/Linux:

bash
curl -fsSL https://clawhub.ai/JayShna/openclaw-sync-bridge/install.sh | bash

Windows (PowerShell):

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The command curl -fsSL ... | bash causes immediate execution of code retrieved from a remote server in the user's shell environment. In the context of a skill installer, this is especially dangerous because users are encouraged to trust and run it during setup, making server compromise or content tampering equivalent to arbitrary command execution.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

Mac/Linux:

bash
curl -fsSL https://clawhub.ai/JayShna/openclaw-sync-bridge/install.sh | bash

Windows:

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

Piping network output directly into bash is a classic command-chaining abuse pattern because it removes the opportunity for inspection and turns content delivery into immediate code execution. In this skill's installation flow, that amplifies the blast radius of any compromise of the remote hosting endpoint or delivery path.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

Mac/Linux:

bash
curl -fsSL https://clawhub.ai/JayShna/openclaw-sync-bridge/install.sh | bash

Windows:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · sync_bridge.py (reported line 29)May include surrounding context.

python
CONFIG_FILE = "sync_config.json"
BACKUP_DIR = ".sync-bridge-backup"
DEFAULT_SYNC_FILES = ["SOUL.md", "AGENTS.md", "USER.md", "skills/", "IDENTITY.md", "TOOLS.md"]
IGNORE_PATTERNS = ["config.json", ".env", "*.token", "*.key", "sync_config.json", ".sync-bridge-backup"]

# 常见工作目录路径（按优先级排序）
WORKSPACE_CANDIDATES = [

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README promotes the skill as secure and selectively syncing only certain files, yet the primary install path instructs users to download and immediately execute remote scripts. This creates a trust-boundary violation: the fetched installer can perform arbitrary actions unrelated to the documented sync scope, including exfiltration of workspace contents, tokens, or modifying local files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The installation commands execute code fetched over the network directly in the shell (curl | bash and irm | iex) without any review or integrity verification step. If the hosting site, account, transport path, or installer is compromised, users will run attacker-controlled code immediately with their local privileges.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation instructs users to execute installer code fetched directly from a remote URL via shell or PowerShell without any integrity verification, review step, or safety warning. This creates a supply-chain execution path where compromise of the hosting domain, upstream content, or network trust chain can lead to arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The default sync scope includes files such as SOUL.md, AGENTS.md, USER.md, IDENTITY.md, TOOLS.md, and the entire skills directory, all of which may contain sensitive behavioral instructions, personal information, internal prompts, or embedded secrets. Syncing this material to GitHub Gist increases the chance of privacy leakage, unintended exposure through misconfiguration, and broader replication of sensitive workspace state across devices and cloud storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script persistently appends an alias to ~/.bashrc and ~/.zshrc without an upfront warning or explicit consent step. Persistent shell profile modification changes future command behavior and can be abused in principle for stealthy persistence, even though this specific alias appears limited to launching the skill.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
80% confidence
Finding

Creating a persistent executable in ~/.local/bin gives the skill a durable foothold across shell sessions. In this file the behavior is not overtly malicious, but persistence mechanisms in installers are security-relevant because they modify the user's long-term execution environment and can normalize future trust in the command.

Content

Scanner excerpt · install.sh (reported line 109)May include surrounding context.

sh
# 创建全局脚本（可选）
GLOBAL_BIN="$HOME/.local/bin"
if [ -d "$GLOBAL_BIN" ] || mkdir -p "$GLOBAL_BIN" 2>/dev/null; then
    cat > "$GLOBAL_BIN/sync-bridge" << EOF
#!/bin/bash
cd "$SKILL_DIR" && $PYTHON_CMD sync_bridge.py "\$@"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The installer silently creates an executable wrapper in ~/.local/bin, which establishes a persistent command in the user's environment without prior warning. Writing executables into a user bin directory is a persistence mechanism and should require clear disclosure and affirmative consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sync_bridge.py (reported line 208)May include surrounding context.

python
def verify_token(self):
        """验证 Token"""
        req = urllib.request.Request(
            "https://api.github.com/user",
            headers={"Authorization": f"token {self.token}", "User-Agent": "OpenClaw-Sync-Bridge"}
        )
        with urllib.request.urlopen(req, timeout=10) as resp:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sync_bridge.py (reported line 221)May include surrounding context.

python
def verify_token(self):
        """验证 Token"""
        req = urllib.request.Request(
            "https://api.github.com/user",
            headers={"Authorization": f"token {self.token}", "User-Agent": "OpenClaw-Sync-Bridge"}
        )
        with urllib.request.urlopen(req, timeout=10) as resp:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sync_bridge.py (reported line 226)May include surrounding context.

python
def verify_token(self):
        """验证 Token"""
        req = urllib.request.Request(
            "https://api.github.com/user",
            headers={"Authorization": f"token {self.token}", "User-Agent": "OpenClaw-Sync-Bridge"}
        )
        with urllib.request.urlopen(req, timeout=10) as resp:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · sync_bridge.py (reported line 230)May include surrounding context.

python
def verify_token(self):
        """验证 Token"""
        req = urllib.request.Request(
            "https://api.github.com/user",
            headers={"Authorization": f"token {self.token}", "User-Agent": "OpenClaw-Sync-Bridge"}
        )
        with urllib.request.urlopen(req, timeout=10) as resp:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill uploads workspace content to GitHub Gist, which is an external third-party service, but the setup and sync flows do not present a clear privacy warning about what data leaves the machine. Because the default sync set includes identity and skill files, users may unknowingly transmit sensitive configuration or prompt material to GitHub.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The setup flow saves the GitHub token directly into sync_config.json on disk without any warning, masking, permission hardening, or use of an OS credential store. Any local user, backup process, malware, or accidental file sharing of that config can expose the token and enable unauthorized access to the user's GitHub Gists.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
73% confidence
Finding

The natural-language instructions and UX examples are entirely in Chinese, and the document does not indicate that language selection is optional or that the skill is intended only for a Chinese-speaking context. Under the stated policy, forcing a specific language without user opt-in can be a locale policy issue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill documentation is entirely in Chinese and does not indicate that language selection is optional or that the skill is intended only for a Chinese-speaking audience. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
97% confidence
Finding

Most prompts and status messages are presented only in Chinese, which forces a specific language for interaction. There is no visible opt-in, fallback language, or justification that the skill is intended only for a Chinese-speaking or region-specific audience.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The section beginning at L085-L089 is presented as creating a shortcut command, but the implementation at L094-L099 appends content to ~/.bashrc and ~/.zshrc. This is a persistent side effect on user shell configuration, which is more intrusive than the nearby comments suggest.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description is written entirely in Chinese, which creates a language-specific presentation without any indication of user choice or a documented locale requirement. Under the policy, language constraints should either be optional for users or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring and interactive prompts are written in Chinese only, which imposes a specific language on users without opt-in or alternative locale support. The stated policy flags language-forcing behavior unless the tool offers a language choice or clearly documents a justified locale restriction.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.