HostLink

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:02 AM UTC
• Version: 0.1.0

Overview

This skill openly provides host-machine command execution, but it does so with broad triggers, persistent root-capable setup, and under-scoped installation and secret handling that require careful review.

Install only if you intentionally want OpenClaw to have a host-command channel. Before using it, pin and review the HostLink source, avoid sudo make install from an unverified checkout, run the daemon as a dedicated unprivileged user, disable boot persistence unless needed, restrict socket permissions, keep the token out of source-controlled or broadly readable config, and require explicit human approval for filesystem, Docker, service, package, or credential-related commands.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (4)

T06 · System Persistence

Error

• Location: references/setup.md:59

Finding

Persistent Root-Privileged Arbitrary Command Service

Content

View full analysis

Vulnerability Details

File Location: references/setup.md, lines 59-64
Vulnerability Type: Persistent privileged command-execution service
Risk Level: Critical

Vulnerable Code

bash

sudo cp ~/hostlink/hostlink.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable hostlinkd
sudo systemctl start hostlinkd
sudo systemctl status hostlinkd

The guide further states at references/setup.md:134-136:

text

- All commands run as the user hostlinkd is started as (typically root if using systemd).
  Consider running as a dedicated less-privileged user for production use.

Technical Analysis

The installation procedure copies a systemd unit into the system service directory and enables it at startup. This causes the daemon to survive reboots and future sessions. The daemon exposes arbitrary shell-command execution and, according to the documentation, normally runs as root when installed through systemd.

Although persistent service registration can be operationally reasonable for a host-management daemon, the documented configuration does not apply least privilege. Generic host command execution does not inherently require root access, and unrestricted /bin/bash execution gives the client every privilege held by the daemon.

The actual hostlink.service file and daemon source are not included in the audited project. Consequently, systemd sandboxing, privilege dropping, request authorization, token validation, command restrictions, and logging behavior cannot be verified.

Attack Path

1. An attacker compromises the OpenClaw agent, its container, or the authentication token.
2. The attacker connects to the enabled HostLink service through the mounted Unix socket.
3. The attacker submits an arbitrary shell command using hostlink exec.
4. hostlinkd executes the command with its service identity, documented as typically root.
5. The attacker modifies ...[truncated 557 chars]

Remediation

View remediation

Remediation Suggestions

• Do not enable the daemon automatically as part of the default setup. Require an explicit, documented administrator decision before creating a persistent service.
• Run hostlinkd under a dedicated, non-login, unprivileged account instead of root.
• Replace unrestricted shell execution with narrowly scoped, allowlisted RPC operations.
• Require explicit approval or separate authorization for privileged operations.
• Use a privilege-separation helper for the small subset of operations that genuinely require elevation.
• Harden the systemd unit with options such as NoNewPrivileges=yes, ProtectSystem=strict, ProtectHome=yes, PrivateTmp=yes, PrivateDevices=yes, RestrictSUIDSGID=yes, capability restrictions, syscall filtering, and restrictive filesystem access.
• Disable unnecessary network listeners and bind only to the protected Unix socket.
• Add comprehensive command, identity, result, and authorization logging.
• Publish the complete service unit and daemon source with the Skill so their security properties can be audited.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:17

Finding

Unrestricted Host Shell Breaks the Container Least-Privilege Boundary

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-20
Vulnerability Type: Unrestricted host command execution from an AI-controlled container
Risk Level: Critical

Vulnerable Code

bash

# Execute a command on the host
hostlink exec "ls /home/jebadiah"

Additional documented use cases include host filesystem access and Docker administration:

bash

hostlink exec "cat /etc/hostname"
hostlink exec "docker ps"
hostlink exec "docker stats --no-stream"

Technical Analysis

The Skill intentionally gives an agent operating inside a container a generic host shell. This defeats the primary isolation boundary between the container and its host. There is no documented command allowlist, path restriction, read-only mode, per-operation authorization, or interactive approval requirement.

The risk is amplified because natural-language agents may act on untrusted content. Prompt injection, compromised tools, or an incorrect agent decision can be converted directly into host-side shell execution. Docker management is particularly sensitive because access to a privileged Docker daemon commonly enables host filesystem mounting, privileged container creation, and effective host takeover.

Host interaction may be legitimate for the declared functionality, but unrestricted shell and Docker access materially exceed the minimum privileges needed for narrower activities such as querying GPU status or reading a specific project directory.

Attack Path

1. The agent processes attacker-controlled instructions from a document, repository, web response, or user message.
2. The injected instructions induce the agent to invoke hostlink exec.
3. The agent sends attacker-selected shell syntax to the host daemon.
4. The command reads or modifies host files, invokes administrative tools, or controls Docker.
5. If Docker access is available, the attacker starts a privileged container or mounts the host ...[truncated 457 chars]

Remediation

View remediation

Remediation Suggestions

• Replace arbitrary exec functionality with a fixed set of narrowly scoped operations.
• Apply command and argument allowlists; do not rely solely on filtering shell metacharacters.
• Avoid invoking commands through /bin/bash; use direct process execution with separately validated arguments.
• Restrict filesystem access to explicitly approved directories and default to read-only access.
• Disable Docker management by default and expose it only through a separate, strongly authorized administrative role.
• Require human confirmation for file modification, package management, service control, credential access, and Docker operations.
• Use separate credentials for read-only and administrative functionality.
• Apply per-request identity, authorization, rate limits, timeouts, output limits, and tamper-resistant audit logging.

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/setup.md:8

Finding

Unpinned Remote Source Is Built and Installed with Elevated Privileges

Content

View full analysis

Vulnerability Details

File Location: references/setup.md, lines 8-14
Vulnerability Type: Mutable remote dependency and privileged installation
Risk Level: High

Vulnerable Code

bash

git clone https://github.com/jebadiahgreenwood/hostlink ~/hostlink
cd ~/hostlink
make
sudo make install
# Installs: /usr/local/bin/hostlinkd, /usr/local/bin/hostlink-cli
# Creates:  /etc/hostlink/, /run/hostlink/, /var/log/hostlink/

Technical Analysis

The guide clones the repository's mutable default branch without pinning a commit, verifying a signed release, or checking an artifact hash. It then runs the fetched build logic and executes the repository-controlled make install target with sudo.

A later change to the upstream default branch, compromise of the upstream account or repository, or malicious modification of the Makefile can change what users execute without changing this reviewed Skill. The privileged installation target can write beyond the documented paths and execute arbitrary commands as root.

This is both an unsafe supply-chain dependency and a remote payload execution channel: the effective installation payload is selected from an external source at setup time and can differ from what an auditor previously reviewed.

Attack Path

1. An attacker compromises the upstream repository, maintainer account, release process, or default branch.
2. The attacker modifies source code, the Makefile, or the systemd unit.
3. A user follows the setup instructions and clones the mutable repository state.
4. make executes attacker-controlled build logic as the user.
5. sudo make install executes attacker-controlled installation logic as root.
6. The malicious binary or service is installed and can persist through the systemd procedure.

Impact Assessment

Successful exploitation can result in arbitrary root-level code execution during installation, replacement of system binaries, cre ...[truncated 230 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specific reviewed commit or immutable release.
• Require cryptographic checksum verification and a trusted release signature.
• Vendor the reviewed source and systemd unit with the Skill when practical.
• Publish reproducible build instructions and provenance attestations.
• Never run a repository-controlled build target with sudo.
• Build as an unprivileged user, inspect the resulting artifacts, and install only explicitly listed files with narrowly scoped privileged commands.
• Review the Makefile, service unit, and daemon source before installation.
• Monitor upstream ownership and release-signing key changes.

T09 · Insecure Skill Coding Practices

Error

• Location: references/setup.md:92

Finding

Root-Capable Authentication Token Stored in Plaintext Configuration and Environment Variables

Content

View full analysis

Vulnerability Details

File Location: references/setup.md, lines 92-97 and 107-121
Vulnerability Type: Plaintext storage of a high-impact authentication secret
Risk Level: High

Vulnerable Code

yaml

services:
  openclaw-gateway:
    volumes:
      - /run/hostlink/hostlink.sock:/run/hostlink/hostlink.sock
    environment:
      - HOSTLINK_SOCKET=/run/hostlink/hostlink.sock
      - HOSTLINK_TOKEN=SAME_TOKEN_AS_IN_HOSTLINK_CONF

The guide also recommends placing the token in the OpenClaw JSON configuration:

json

{
  "env": {
    "vars": {
      "HOSTLINK_TOKEN": "your_auth_token_here",
      "HOSTLINK_SOCKET": "/run/hostlink/hostlink.sock"
    }
  }
}

Technical Analysis

The authentication token is described as the daemon's only secret, yet the setup places it directly in Docker Compose environment configuration, a host .env file, or openclaw.json. Environment variables may be exposed through container inspection, process diagnostics, crash reports, support bundles, debugging tools, or compromised processes. Plaintext configuration files may also enter backups, shell histories, source-control commits, or broadly readable workspace data.

The token protects a channel that can execute unrestricted commands with the daemon's identity. It is therefore a high-value administrative credential rather than an ordinary application setting. Static, shared bearer tokens also provide no request-level identity, limited revocation granularity, or resistance to replay.

Attack Path

1. An attacker obtains read access to the container environment, Compose configuration, .env file, openclaw.json, backup, diagnostic output, or an accidentally committed configuration file.
2. The attacker extracts HOSTLINK_TOKEN.
3. The attacker accesses the mounted Unix socket from the compromised container or reaches an enabled HostLink transport.
4. The attacker authenticates using ...[truncated 423 chars]

Remediation

View remediation

Remediation Suggestions

• Store the credential using Docker secrets, a protected read-only secret file, or an operating-system credential facility rather than a normal environment variable.
• Set restrictive ownership and permissions on every secret-bearing file.
• Keep secrets outside source trees, workspace directories, images, logs, and backups unless backups are strongly encrypted.
• Use short-lived, scoped credentials instead of a single long-lived shared token.
• Implement mutual authentication and bind credentials to a specific client identity.
• Support immediate revocation and routine credential rotation.
• Separate read-only and administrative credentials.
• Redact credentials from diagnostics, process dumps, status output, and logs.
• Retain strict Unix socket ownership and group permissions as an independent authorization layer rather than relying only on the bearer token.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill introduces host command execution as a normal capability but does not prominently warn that it crosses the container boundary and can affect the entire host system. In this context, lack of a clear warning is dangerous because users or higher-level agents may treat the tool as routine automation rather than a privileged remote shell with access to host files, processes, and Docker.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger list is very broad and includes generic phrases like 'host machine' and 'outside container', which can cause the skill to activate in contexts where the user did not explicitly request privileged host execution. Because this skill provides host-level command execution, accidental invocation materially increases the chance of unintended boundary crossing, sensitive file access, or dangerous command execution on the host.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md

## Troubleshooting

**"Connection failed" / exit 2:**
- hostlinkd not running on host: `sudo systemctl start hostlinkd`
- Socket not mounted: check docker-compose volume mount
- Wrong socket path: check `HOSTLINK_SOCKET` env var

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 11)May include surrounding context.

git clone https://github.com/jebadiahgreenwood/hostlink ~/hostlink cd ~/hostlink make sudo make install

Installs: /usr/local/bin/hostlinkd, /usr/local/bin/hostlink-cli

Creates: /etc/hostlink/, /run/hostlink/, /var/log/hostlink/

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 23)May include surrounding context.

git clone https://github.com/jebadiahgreenwood/hostlink ~/hostlink cd ~/hostlink make sudo make install

Installs: /usr/local/bin/hostlinkd, /usr/local/bin/hostlink-cli

Creates: /etc/hostlink/, /run/hostlink/, /var/log/hostlink/

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 29)May include surrounding context.

git clone https://github.com/jebadiahgreenwood/hostlink ~/hostlink cd ~/hostlink make sudo make install

Installs: /usr/local/bin/hostlinkd, /usr/local/bin/hostlink-cli

Creates: /etc/hostlink/, /run/hostlink/, /var/log/hostlink/

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 30)May include surrounding context.

git clone https://github.com/jebadiahgreenwood/hostlink ~/hostlink cd ~/hostlink make sudo make install

Installs: /usr/local/bin/hostlinkd, /usr/local/bin/hostlink-cli

Creates: /etc/hostlink/, /run/hostlink/, /var/log/hostlink/

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 48)May include surrounding context.

git clone https://github.com/jebadiahgreenwood/hostlink ~/hostlink cd ~/hostlink make sudo make install

Installs: /usr/local/bin/hostlinkd, /usr/local/bin/hostlink-cli

Creates: /etc/hostlink/, /run/hostlink/, /var/log/hostlink/

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.

git clone https://github.com/jebadiahgreenwood/hostlink ~/hostlink cd ~/hostlink make sudo make install

Installs: /usr/local/bin/hostlinkd, /usr/local/bin/hostlink-cli

Creates: /etc/hostlink/, /run/hostlink/, /var/log/hostlink/

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 61)May include surrounding context.

git clone https://github.com/jebadiahgreenwood/hostlink ~/hostlink cd ~/hostlink make sudo make install

Installs: /usr/local/bin/hostlinkd, /usr/local/bin/hostlink-cli

Creates: /etc/hostlink/, /run/hostlink/, /var/log/hostlink/

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 62)May include surrounding context.

git clone https://github.com/jebadiahgreenwood/hostlink ~/hostlink cd ~/hostlink make sudo make install

Installs: /usr/local/bin/hostlinkd, /usr/local/bin/hostlink-cli

Creates: /etc/hostlink/, /run/hostlink/, /var/log/hostlink/

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 63)May include surrounding context.

git clone https://github.com/jebadiahgreenwood/hostlink ~/hostlink cd ~/hostlink make sudo make install

Installs: /usr/local/bin/hostlinkd, /usr/local/bin/hostlink-cli

Creates: /etc/hostlink/, /run/hostlink/, /var/log/hostlink/

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 64)May include surrounding context.

git clone https://github.com/jebadiahgreenwood/hostlink ~/hostlink cd ~/hostlink make sudo make install

Installs: /usr/local/bin/hostlinkd, /usr/local/bin/hostlink-cli

Creates: /etc/hostlink/, /run/hostlink/, /var/log/hostlink/

text

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/setup.md (reported line 26)May include surrounding context.

sudo cp hostlinkd /usr/local/bin/

text

### 2. Create config

```bash
sudo mkdir -p /etc/hostlink /run/hostlink /var/log/hostlink

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 48)May include surrounding context.

log_file = /var/log/hostlink/hostlinkd.log log_level = info EOF sudo chmod 640 /etc/hostlink/hostlink.conf

text

**Important:** Change `auth_token` to a strong random secret:

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

Enabling HostLink as a persistent boot-time service establishes a standing host-command execution channel. In a normal daemon this might be low concern, but here the service’s purpose is authenticated command execution on the host, so persistence increases the attack window if the socket or token is later exposed.

Content

Scanner excerpt · references/setup.md (reported line 62)May include surrounding context.

bash

sudo cp ~/hostlink/hostlink.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable hostlinkd
sudo systemctl start hostlinkd
sudo systemctl status hostlinkd

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 78% confidence

Finding

The manual test instruction runs hostlinkd in the foreground as root, and the security notes later state commands typically execute as the user running hostlinkd. In this skill’s context, that means any authenticated client could obtain root-level command execution on the host, which greatly amplifies impact if the token or socket access is compromised.

Content

Scanner excerpt · references/setup.md (reported line 69)May include surrounding context.

Option B — manual foreground (testing):

bash

sudo hostlinkd -f -c /etc/hostlink/hostlink.conf

4. Verify socket exists

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The guide instructs users to place the HostLink auth token in OpenClaw config or a .env file but does not clearly warn that this secret grants host-command execution if exposed. In this skill’s context, the token is effectively equivalent to remote shell access to the host, so storing it in commonly copied, logged, mounted, or source-controlled locations materially increases compromise risk.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/setup.md:32