OpenClaw Agent Control Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:59 AM UTC
• Version: 1.0.0

Overview

This skill appears intended to deploy an agent-control service, but it runs mutable remote code and npm scripts with broad host and network impact that users should review before installing.

Review scripts/deploy_project.sh and the target repository before running it. Prefer a pinned, trusted commit; run it as an unprivileged user outside /root; restrict MONITOR_PORT and PORT to trusted interfaces; and avoid using a custom REPO_URL unless you fully trust that repository and its npm dependencies.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/deploy_project.sh:4
• Finding: Mutable Remote Repository Is Retrieved and Executed Without Verification<![CDATA[ ## Vulnerability Details **File Location**: `scripts/deploy_project.sh`, lines 4-25 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash REPO_URL="${REPO_URL:-https://github.com/JiangAgentLabs/OpenClaw-Agent-Control.git}" PROJECT_DIR="${PROJECT_DIR:-/root/OpenClaw-Agent-Control}" MONITOR_PORT="${MONITOR_PORT:-8787}" PORT="${PORT:-3000}" echo "[skill] repo: $REPO_URL" echo "[skill] project: $PROJECT_DIR" if [[ -d "$PROJECT_DIR/.git" ]]; then echo "[skill] updating existing project" git -C "$PROJECT_DIR" fetch --all --prune git -C "$PROJECT_DIR" checkout main git -C "$PROJECT_DIR" pull --ff-only origin main else echo "[skill] cloning project" git clone "$REPO_URL" "$PROJECT_DIR" git -C "$PROJECT_DIR" checkout main || true fi echo "[skill] starting backend" nohup uv run --with fastapi --with uvicorn \ python -m uvicorn app:app --app-dir "$PROJECT_DIR" --host 0.0.0.0 --port "$MONITOR_PORT" \ > /tmp/openclaw-agent-control-backend.log 2>&1 & ``` ### Technical Analysis The deployment script clones or updates the mutable `main` branch of a remote Git repository and immediately starts a Python application from that checkout. It does not pin an audited commit, validate a cryptographic checksum, verify a signed commit or tag, or inspect the retrieved files before importing the remote `app` module. The `REPO_URL` environment variable also allows the caller or execution environment to substitute an arbitrary repository. When Uvicorn loads `app:app`, Python executes module-level code in the remotely retrieved `app` module. Consequently, the effective executable payload can change after this skill package has been reviewed. ### Attack Path 1. An attacker compromises the configured upstream repository or gains the ability to influence `REPO_URL`. 2. The attacker places malicious module-level Python code in the remote application's `app` module or one of its imports. 3. An operator e ...[truncated 1002 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin deployment to a reviewed immutable commit SHA instead of the mutable `main` branch. - Maintain an allowlist of approved repository URLs and reject arbitrary `REPO_URL` values in production deployments. - Verify signed commits or tags against trusted maintainer keys before execution. - Validate the retrieved source against an expected cryptographic digest or approved manifest. - Separate retrieval, review, and execution into distinct steps rather than immediately starting downloaded code. - Run the application under a dedicated unprivileged service account with narrowly scoped filesystem and network permissions. - Avoid using `/root` as the default deployment directory. - Execute the application in a container or sandbox with a read-only filesystem, restricted capabilities, and controlled outbound network access. ]]>

T08 · Insecure Dependencies

Error

• Location: scripts/deploy_project.sh:28
• Finding: Unverified npm Lifecycle and Project Scripts Are Executed<![CDATA[ ## Vulnerability Details **File Location**: `scripts/deploy_project.sh`, lines 28-32 **Vulnerability Type**: Insecure dependency and build-script execution **Risk Level**: High ### Vulnerable Code ```bash echo "[skill] deploying frontend" cd "$PROJECT_DIR/agent-monitor-ui" npm install npm run prod:build PORT="$PORT" npm run prod:restart ``` ### Technical Analysis The frontend dependency manifests and package scripts are obtained from the mutable remote checkout. Running `npm install` can execute `preinstall`, `install`, and `postinstall` lifecycle scripts supplied by direct or transitive packages. The subsequent `npm run prod:build` and `npm run prod:restart` commands explicitly execute project-defined scripts from the remotely retrieved `package.json`. The deployment does not enforce an audited lockfile with `npm ci`, disable unnecessary lifecycle scripts, validate package integrity independently, or isolate npm execution. A malicious repository update or compromised dependency can therefore turn package installation or build/restart processing into arbitrary command execution. ### Attack Path 1. An attacker modifies the remote repository's `package.json`, its lockfile, a referenced package, or a transitive dependency. 2. The operator runs the deployment script. 3. The script retrieves the modified frontend project. 4. `npm install` downloads dependencies and executes any enabled lifecycle scripts. 5. Alternatively, attacker-controlled commands execute through the `prod:build` or `prod:restart` package script. 6. The commands inherit the deployment user's privileges, environment, filesystem access, and network access. ### Impact Assessment Exploitation allows arbitrary command execution as the user running the deployment. An attacker could read accessible secrets, modify application or system files, alter build output, install additional software, or launch persistent application processes. If the script is run as root, npm and project script ...[truncated 164 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Require a reviewed and committed lockfile, and use `npm ci` rather than `npm install` for reproducible installation. - Pin the source repository to an immutable, verified revision before reading its dependency manifests. - Use `npm ci --ignore-scripts` when lifecycle scripts are not strictly required. - If lifecycle scripts are required, explicitly audit and allow only the necessary scripts and packages. - Review the exact definitions of `prod:build` and `prod:restart` before executing them. - Configure an approved npm registry and prevent dependency resolution from untrusted registries or arbitrary URLs. - Use package integrity verification, dependency scanning, and lockfile-change review in the release process. - Run installation and builds in an isolated, unprivileged environment without production credentials. - Deploy only reviewed build artifacts to the runtime environment instead of building mutable remote source directly on the target host. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/deploy_project.sh:23
• Finding: Backend Service Is Exposed on All Network Interfaces<![CDATA[ ## Vulnerability Details **File Location**: `scripts/deploy_project.sh`, lines 23-25 **Vulnerability Type**: Unsafe network binding **Risk Level**: Medium ### Vulnerable Code ```bash echo "[skill] starting backend" nohup uv run --with fastapi --with uvicorn \ python -m uvicorn app:app --app-dir "$PROJECT_DIR" --host 0.0.0.0 --port "$MONITOR_PORT" \ > /tmp/openclaw-agent-control-backend.log 2>&1 & ``` ### Technical Analysis The Uvicorn server binds to `0.0.0.0`, making the backend listen on every available IPv4 network interface. However, the skill documentation presents the validation endpoint as `http://127.0.0.1:8787/api/status`, which can lead operators to believe that the service is restricted to local access. The audited package does not add firewall restrictions, transport encryption, a reverse proxy, or an authentication boundary around the exposed listener. The authentication behavior of the remotely retrieved backend cannot be established from this package, so lack of application authentication is not asserted; nevertheless, the all-interface binding unnecessarily expands the reachable attack surface. ### Attack Path 1. An operator executes the deployment script on a host reachable from another network system. 2. Uvicorn binds the backend port to all network interfaces. 3. A remote client discovers or otherwise learns the host and configured monitor port. 4. The client connects directly to the backend rather than through the documented loopback address. 5. Any endpoint-level weaknesses in the downloaded backend become remotely reachable from networks permitted by host or perimeter firewall rules. ### Impact Assessment The immediate impact is unintended network exposure of the backend and all routes it serves. The reachable scope depends on the host's network topology and firewall configuration and may include a local subnet, container network, cloud virtual network, or the public Internet. The final privileges obtainable depend o ...[truncated 272 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Bind to `127.0.0.1` by default: ```bash --host 127.0.0.1 ``` - Add an explicit, separately named configuration option for external binding and require operators to opt in knowingly. - Document the actual listener scope and associated security requirements. - If remote access is necessary, place the backend behind an authenticated TLS reverse proxy. - Enforce application-level authentication and authorization for every sensitive endpoint. - Restrict the monitor port with host and network firewalls to explicitly trusted source addresses. - Do not expose development-oriented API documentation or debugging endpoints in production. - Add a deployment validation step that confirms the service is listening only on the intended interface. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation instructs users to execute a deployment shell script directly, but provides no warning about what the script changes, what privileges it may require, or the operational impact on the host. In a skill intended to deploy backend and frontend services, this raises supply-chain and system-modification risk because users may run the script blindly in a privileged environment.

Session Persistence

Medium

• Category: Rogue Agent

Content

fi

echo "[skill] starting backend"
nohup uv run --with fastapi --with uvicorn \
  python -m uvicorn app:app --app-dir "$PROJECT_DIR" --host 0.0.0.0 --port "$MONITOR_PORT" \
  > /tmp/openclaw-agent-control-backend.log 2>&1 &

• Confidence: 65% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The document is explicitly titled and presented as Chinese-only usage instructions, with no indication that users may choose another language or that the locale restriction is required. The policy requires flagging language or locale constraints when they are imposed without user opt-in or clear justification.

Static analysis

No suspicious patterns detected.