Security audit

LiveClaw

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent livestreaming purpose, but it takes over broad agent behavior and exposes sensitive live, credential, and remote-control surfaces with weak scoping.

Install only after careful review. Use isolated, least-privileged Tencent credentials, assume viewer traffic may expose prompts and outputs, do not expose port 19000 or the OpenClaw gateway publicly without authentication, and avoid enabling the callback token or bundled skills unless you intend remote users to trigger agent actions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:23
Finding: Persistent Cross-Channel Agent Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/setup.py:1120
Finding: Public Disclosure of Plaintext TRTC, CAM, and IM Credentials
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/setup.py:1168
Finding: Unauthenticated UserSig Minting and Agent Event Injection
Content: View full analysis
0 else {} text = body.get("text", "").strip() kind = body.get("kind", "task") if not text: self._json_response({"error": "text is required"}, 400) return if kind not in ("task", "info"): kind = "task" event = { "ts": _dt.datetime.now().isoformat(), "kind": kind, "icon": _icon_map.get(kind, "[TASK]"), "text": text, "detail": "", } bus_file = os.path.join(SERVE_DIR, "agent_events.jsonl") with open(bus_file, "a", encoding="utf-8") as f: f.write(json.dumps(event, ensure_ascii=False) + "\n") ``` Any caller can choose a user ID and receive a seven-day UserSig: ```python def _handle_gen_usersig(self): from urllib.parse import urlparse, parse_qs qs = parse_qs(urlparse(self.path).query) userid = qs.get("userid", [""])[0] if not userid or not _gen_usersig or not _cfg.get("secret_key"): self.send_response(400) self.end_headers() return sdkappid = _cfg.get("sdkappid", 0) secret = _cfg["secret_key"] usersig = _gen_usersig(sdkappid, secret, userid, 604800) resp = { "userid": userid, "usersig": usersig, "sdkappid" ...[truncated 2111 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/setup.py:628
Finding: Wildcard Remote Agent Access and Public Gateway Binding
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/setup.py:607
Finding: Unpinned Executable Dependencies and Unverified Mutable Remote Assets
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: skills/music-search/music_downloader.py:443
Finding: TLS Certificate Verification Disabled for Music Search and Downloads
Content: View full analysis
bool: headers = { "User-Agent": HEADERS["User-Agent"], "Referer": referer, } try: resp = self.session.get( url, headers=headers, timeout=60, stream=True, verify=False ) resp.raise_for_status() size = int(resp.headers.get('content-length', 0)) if size < 1024: print(f"File too small: {size} bytes") return False os.makedirs(os.path.dirname(save_path), exist_ok=True) with open(save_path, 'wb') as f: for chunk in resp.iter_content(8192): if chunk: f.write(chunk) return True except Exception as e: print(f"Download failed: {e}") return False ``` ### Technical Analysis Passing `verify=False` disables server certificate and hostname validation. The client therefore cannot distinguish the intended music provider from an attacker performing a man-in-the-middle attack. Suppressing warnings removes the primary runtime indication that HTTPS security has been disabled. The unsafe setting applies to search results, metadata, redirects, playback URL discovery, and downloaded media. Because URLs returned by one request are later downloaded or submitted to TRTC, an attacker can substitute both metadata and media content. ...[truncated 1096 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (137)

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The HTTP server generates UserSig tokens for any requested userid using the configured secret key and returns them over an unauthenticated endpoint with permissive CORS. That effectively turns the service into a public signing oracle, enabling unauthorized clients to mint valid credentials for TRTC/IM access and impersonate arbitrary users.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The README advertises real-time streaming of the agent's full reasoning, tool calls, and execution results to a TRTC room with public viewing, but it does not prominently warn that this can expose sensitive prompts, secrets, personal data, or operational details. In an agent context, chain-of-thought and tool outputs frequently contain highly sensitive information, so broadcasting them materially increases confidentiality risk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 该代码块仅实现 TRTC/IM 所需的鉴权签名生成，属于底层支撑性的认证工具，而非技能描述中的完整 Agent 实时推流与交互系统。虽然生成 UserSig 与 TRTC/IM 场景相关，可视为相关配套组件，但它没有任何媒体流处理、浏览器渲染、语音合成、消息收发、Agent 调度或网络暴露逻辑。因此代码行为与声明的主要用途存在明显且实质性的不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向实时音视频与交互集成的能力集合，核心应包括 TRTC 推流、浏览器端虚拟形象渲染、TTS 播报、IM 触发和公网访问支持。但给出的代码仅是一个本地事件记录模块：把 agent 事件写入工作目录下的 agent_events.jsonl 和 agent_state.json，提供去重、裁剪、读取状态等功能。代码中没有任何 TRTC、音视频流、浏览器渲染、TTS、IM、网络监听、远程访问或 Lighthouse 相关实现。其主要用途与声明的主功能明显不同，因此属于明显描述-行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个完整的实时直播/交互系统，包含 TRTC 推流、虚拟形象叠加、TTS、IM 触发和公网访问等能力。但提供的代码块实际只是其中一个非常局部的 UI 渲染组件：它读取本地事件文件，绘制左右布局的 dashboard，并返回 numpy 图像数组供其他组件后续编码使用。代码中没有网络连接、TRTC SDK 调用、音频/TTS、消息收发、Agent 触发或公网访问处理。虽然注释提到“供 PyAV 编码”，且左侧为 avatar 预留区域，但这些都只是配套渲染细节，不足以支撑已声明的完整功能，因此描述与该代码块实际行为存在明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 声明描述的是一个面向 TRTC 房间实时推流的 Agent 直播能力，强调推理链路推流、虚拟形象叠加、TTS、IM 交互和公网访问。但本代码片段并未实现这些核心业务能力；它主要是一个跨平台系统工具库，负责为其他组件提供运行环境支持。尤其值得注意的是，代码包含未在描述中体现的系统管理能力：查找/杀死进程、守护进程启动、以及尝试通过 sudo + apt/yum/dnf 自动安装字体和 tkinter 包。这些属于系统运维/环境配置能力，而不是所声明的直播/交互功能本身。虽然其中的 FFmpeg 采集命令可能是直播链路的支撑细节，但整体代码的实际主要用途与声明的产品级功能描述存在明显偏差，因此应判定为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述聚焦于“把 Agent 推到 TRTC 直播、带虚拟形象/TTS/IM 交互/公网访问”的产品功能，整体上与代码的核心直播用途相关；但该代码块实际权限和行为明显更广。它不仅做直播与 viewer 生成，还会：1）把主 skill 和多个附带 skills 安装/覆盖到全局 OpenClaw skills 目录；2）通过 openclaw CLI 安装/配置 timbot 插件并修改 gateway 配置；3）直接调用腾讯 IM REST API 创建群、发消息、查成员；4）启动一个对外监听的 HTTP 服务并提供多个 API；5）保存 secret_key、CAM 密钥并自动 pip 安装依赖。上述能力中，尤其是“安装其他 skills”“修改 OpenClaw 全局配置/插件”“REST API 管理 IM 资源”都不是声明里明确表述的 supporting detail，而是额外的管理与集成能力。因此描述不能充分准确代表该代码的实际行为，应判定为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: 代码核心围绕腾讯云 TRTC 的在线媒体流输入接口：生成 TC3-HMAC-SHA256 签名、调用 StartStreamIngest/UpdateStreamIngest/StopStreamIngest/DescribeStreamIngest，把给定 URL 的媒体流推入 TRTC 房间，并管理 task_id、本地歌曲状态和日志。虽然有少量与 Dashboard/Agent 相关的事件记录字段（如 agent_events.jsonl、日志文案中的 Agent Music Search），但这些只是外围日志展示，不构成“完整推理链路推流”“TTS 状态播报”“虚拟形象叠加”或“IM 双向交互触发 Agent 执行”等声明能力。声明描述的是一个更完整的 Agent 可视化/交互式直播系统，而实际代码仅实现了其中较窄的一部分：向 TRTC 房间注入在线音视频流。因此描述与代码存在明显能力和主用途不一致。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是面向业务功能的实时推流/虚拟形象/TTS/IM 交互/TRTC 访问能力；而本代码片段本身并未实现这些核心功能。它实际实现的是运维性质的监督器：检查 stream_daemon 和 tts_worker 是否存活、必要时重启、写入 PID 与日志、按平台后台运行，并处理信号。虽然它与推流/TTS 系统相关，属于配套基础设施，但其主要目的与声明的主要功能并不一致，且包含未在声明中体现的进程管理与自愈保活能力。因此应判定为描述与代码行为存在明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: 声明描述的是一个综合直播/交互系统，核心能力包括：将完整推理链路推流到 TRTC、虚拟形象叠加、TTS 播报、IM 双向交互、以及公网访问支持。而提供的代码仅实现了其中很窄的一部分——TTS 播报工作进程。它读取本地事件文件 agent_events.jsonl，按事件类型组织播报文本，调用 TTS 合成，并把音频写入本地队列目录。代码中没有任何 TRTC SDK/房间连接、音视频推流、浏览器渲染、虚拟形象处理、IM 收发、网络监听、Lighthouse IP 暴露等实现迹象。因此，这段代码与声明的整体用途存在实质性不匹配；最多只能说它部分支持了“TTS 语音播报 Agent 状态”这一子能力。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is about real-time TRTC streaming of an agent reasoning pipeline with multimedia and interactive messaging features. The supplied code does none of that. Its sole substantive purpose is outbound email delivery over SMTP, including attachments and test messages. This is a materially different primary purpose and introduces undeclared capabilities (email transmission and file attachment handling) while lacking the declared streaming, rendering, TTS, IM, and networking behaviors. Therefore the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个 TRTC 实时推流与 Agent 可视化/语音播报/IM 交互相关技能；而实际代码的核心功能是音乐搜索与下载。代码中没有看到 TRTC 房间推流、音视频流处理、虚拟形象浏览器端渲染、TTS、IM 双向交互、Lighthouse 公网访问配置等实现。唯一与声明略有表面关联的是 _emit_dashboard() 会向 /tmp/trtc_stream/agent_events.jsonl 写日志，但这只是简单事件上报，不构成 TRTC 推流或所述完整链路能力。因此该代码块与声明用途存在明显且实质性的功能不匹配。
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill mandates that every reply from any channel be relayed through agent_bus during live operation, effectively duplicating conversation content into a broadcast/event system by default. This creates a high-risk data leakage path because sensitive prompts, secrets, and private user messages may be exposed to viewers, logs, TTS, or downstream services without contextual consent.
Content: No source excerpt is available for this finding.

Chaining Abuse

High

Category: Tool Misuse
Confidence: 75% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
Content: Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.
Linux (Debian/Ubuntu)

bash
# 必须：中文字体（若 setup.py --start 自动安装失败） sudo apt-get update && sudo apt-get install -y fonts-noto-cjk # 必须：Python 推流依赖 pip install av numpy Pillow

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The instructions explicitly require pure-text replies and viewer messages to be emitted as info events so observers can see and hear the full content. This is direct content exfiltration from private conversations to external observers and speech output, greatly increasing confidentiality risk and making accidental secret disclosure very likely.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · assets/trtc-viewer-template.html (reported line 623)May include surrounding context.
html
</style> </head> <body>  <div class="login-popup" id="login-popup"> <div class="login-box"> <h3>Login to OpenClaw Live</h3>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · assets/trtc-viewer-template.html (reported line 832)May include surrounding context.
html
</div> </div>  <div id="music-player" class="music-player"> <div class="vinyl-container"> <img id="music-cover" class="vinyl-cover" src="https://images.unsplash.com/photo-1614613535308-eb5fbd3d2c17?q=80&w=100&auto=format&fit=crop" alt="Cover">

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Startup logic automatically installs the main skill and bundled skills into a global OpenClaw skills directory, affecting sessions outside this skill's local scope. Because it can overwrite or add globally discoverable behavior, it creates an unexpected persistence and lateral impact on the host agent environment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script force-updates unrelated skills in the global OpenClaw skills directory by deleting and copying directories. This can silently replace existing trusted skill code and gives this package undue control over the broader agent runtime.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This HTTP API exposes secret-backed functions such as UserSig generation and IM/room management behaviors, yet there is no access control, operator warning, or security boundary communicated or enforced. In a publicly reachable Lighthouse deployment, that omission makes sensitive capabilities easy to misuse or expose accidentally.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The viewer server is described as serving static content, but it also exposes control and token-related APIs that modify agent state and trigger actions. In a network-exposed livestreaming context, bundling control-plane functionality into an unauthenticated viewer endpoint significantly increases attack surface.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The viewer HTTP server exposes unauthenticated endpoints that append agent events and can trigger IM bot actions, while also allowing Access-Control-Allow-Origin: *. An attacker who can reach the service, or any webpage visited by a user on the same network, can induce state changes and operational side effects without authorization.
Content: No source excerpt is available for this finding.

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · scripts/setup.py (reported line 912)May include surrounding context.
python
def start_stream_daemon(): log("Starting stream_daemon...") env = {**os.environ} pid = start_daemon_process( _script_path("stream_daemon.py"), log_file=str(WORK_DIR / "daemon.log"),

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · scripts/setup.py (reported line 1431)May include surrounding context.
python
def start_stream_daemon(): log("Starting stream_daemon...") env = {**os.environ} pid = start_daemon_process( _script_path("stream_daemon.py"), log_file=str(WORK_DIR / "daemon.log"),

Env Variable Harvesting

High

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
Content: Scanner excerpt · scripts/supervisor.py (reported line 69)May include surrounding context.
python
def start_stream_daemon(): log("Starting stream_daemon...") env = {**os.environ} pid = start_daemon_process( _script_path("stream_daemon.py"), log_file=str(WORK_DIR / "daemon.log"),

Overview

A.I.G

T01 · Skill Instruction Hijacking

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

T05 · Unauthorized Access and Privilege Escalation

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

Context-Inappropriate Capability

Missing User Warnings

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Ssd 3

Chaining Abuse

Linux (Debian/Ubuntu)

Ssd 3

Hidden Instructions

Hidden Instructions

Description-Behavior Mismatch

Context-Inappropriate Capability

Missing User Warnings

Description-Behavior Mismatch

Context-Inappropriate Capability

Env Variable Harvesting

Env Variable Harvesting

Env Variable Harvesting