OpenClaw Tailscale Remote Access

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:18 AM UTC
• Version: 1.0.1

Overview

The skill does what it says, but it handles gateway credentials and diagnostic data too openly for a remote-access setup tool.

Review before installing. Use this only on a host where you are comfortable changing OpenClaw and Tailscale state, keep an out-of-band admin path available, avoid sharing inspector output unless you have redacted tokens and pairing data, and check permissions on openclaw.json and any .bak files after running it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/inspect_remote_access.sh:35

Finding

Sensitive OpenClaw Configuration and Pairing Data Are Printed Without Redaction

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/apply_gateway_config.py:12

Finding

Gateway Authentication Token Is Exposed Through Process Arguments

Content

View full analysis

argparse.Namespace: parser = argparse.ArgumentParser( description="Apply the recommended OpenClaw gateway config for Tailscale Serve." ) parser.add_argument("--config", required=True, help="Path to openclaw.json") parser.add_argument("--ts-hostname", required=True, help="MagicDNS hostname") parser.add_argument("--token", required=True, help="Gateway token") parser.add_argument("--port", type=int, default=18789, help="Gateway port") return parser.parse_args() ``` The documented invocation passes the token as an argument: ```bash python3 "$SKILL_DIR/scripts/apply_gateway_config.py" \ --config "$OPENCLAW_CONFIG" \ --ts-hostname "$TS_HOSTNAME" \ --token "$GATEWAY_TOKEN" \ --port "$GATEWAY_PORT" ``` ### Technical Analysis The script requires the gateway authentication token through the `--token` command-line option. Although the documentation uses a shell variable rather than embedding the literal token directly in the command, the shell expands the variable before starting Python. The resulting token is therefore present in the child process argument vector. Depending on operating-system controls and deployment configuration, process arguments may be visible through process-monitoring tools, audit systems, endpoint telemetry, crash diagnostics, or `/proc` inspection. Privileged observers and processes running under the same account commonly have access to this information. Using a shell variable reduces accidental shell-history disclosure, but it does not protect the expanded process argument list. ### Attack Path 1. The operator exports `GATEWAY_TOKEN` and runs the documente ...[truncated 979 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/apply_gateway_config.py:46

Finding

Credential-Bearing Configuration File Is Created Without Enforcing Restrictive Permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill claims to provide a full remote-access repair workflow, but the implemented behavior appears narrower and may not actually perform several promised safety-critical checks and repairs. That mismatch can cause operators or autonomous agents to trust the skill to validate access, repair DNS/origin issues, or safely modify OpenClaw config when it may only partially reconfigure Tailscale Serve, leading to insecure exposure, incomplete remediation, or service disruption.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file documents actions that change openclaw.json, restart openclaw-gateway, and recreate Tailscale Serve, which can affect connectivity and system availability. Although the steps are operationally clear, the README does not provide a direct user warning that these actions modify live system/network configuration and may temporarily disrupt access.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill performs sensitive actions involving file reads/writes, network access, and service reconfiguration, but it does not declare any explicit tool scope or allowed-tools boundary. In an agent environment, that increases the chance the runtime grants broader capabilities than intended, making unintended system changes or data exposure more likely.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/troubleshooting.md (reported line 84)May include surrounding context.

Then:

bash

sudo systemctl restart systemd-resolved
journalctl -u tailscaled -n 50 --no-pager

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script persists the gateway token directly into the JSON config file on disk and also creates timestamped backups of that file, multiplying the number of copies of the secret. If the config or backup files are readable by other local users, included in support bundles, committed to source control, or exfiltrated from disk, the token can be reused to access the gateway.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script prints the contents of the OpenClaw config file and pending pairing requests directly to stdout, which can expose sensitive information such as device metadata, service configuration, internal URLs, tokens, or pairing state. In a remote-access troubleshooting skill, this output is likely to be shared with an operator, logged in terminal history, or copied into support channels, increasing the chance of unintended disclosure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The file prominently presents a locale-specific alternate document link labeled only in Chinese, which can create a language/locale bias in the skill's natural-language presentation. The README does not explicitly offer language choice or explain locale targeting, so this may conflict with the policy against forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.