OpenClaw Tailscale Remote Access

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:18 AM UTC
• Version: 1.0.1

Overview

The skill does what it says, but it handles gateway credentials and diagnostic data too openly for a remote-access setup tool.

Review before installing. Use this only on a host where you are comfortable changing OpenClaw and Tailscale state, keep an out-of-band admin path available, avoid sharing inspector output unless you have redacted tokens and pairing data, and check permissions on openclaw.json and any .bak files after running it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/inspect_remote_access.sh:35
• Finding: Sensitive OpenClaw Configuration and Pairing Data Are Printed Without Redaction<![CDATA[ ## Vulnerability Details **File Location**: `scripts/inspect_remote_access.sh:35-47` **Vulnerability Type**: Sensitive information exposure through diagnostic output **Risk Level**: Medium ### Vulnerable Code ```bash if [ -f "$CONFIG_PATH" ]; then echo "== OpenClaw config: $CONFIG_PATH ==" sed -n '1,220p' "$CONFIG_PATH" echo else echo "Config file not found: $CONFIG_PATH" echo fi if [ -f "$HOME/.openclaw/devices/pending.json" ]; then echo "== Pending pairing requests ==" cat "$HOME/.openclaw/devices/pending.json" echo fi ``` ### Technical Analysis The diagnostic script prints up to the first 220 lines of the complete OpenClaw configuration and emits the complete pending-device pairing file without filtering or redaction. The configuration writer stores the gateway authentication token under `gateway.auth.token`, so executing this inspector can expose that token. The configuration may also contain unrelated credentials or sensitive operational settings. Pending pairing records may reveal device metadata, request identifiers, or other information useful for targeting or approving remote clients. This is particularly risky when the script is invoked by an AI agent, CI system, remote support session, or automated diagnostic collector because standard output may be retained in conversation transcripts, job logs, terminal scrollback, or telemetry. No external exfiltration is implemented by the repository itself. Exploitation requires access to the generated output or a logging system that records it. ### Attack Path 1. A user or agent follows the documented workflow and runs `inspect_remote_access.sh`. 2. The script reads the OpenClaw configuration and pending pairing file. 3. It writes their contents to standard output without redacting tokens or other sensitive fields. 4. An AI transcript, CI log, support record, terminal logger, or another local observer captures the output. 5. An attacker with access to that output recovers the ...[truncated 755 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace raw `sed` output with structured JSON parsing that selects only fields necessary for diagnostics. - Recursively redact keys such as `token`, `secret`, `password`, `credential`, `apiKey`, `privateKey`, and similar variants. - Report pairing-request counts and non-sensitive status information instead of printing the entire file. - Require an explicit option such as `--show-sensitive` before displaying unredacted data, and present a clear warning. - Ensure normal diagnostic output is safe to retain in AI transcripts and CI logs. - Add tests using fixture configurations containing secrets to verify that no secret value appears in standard output. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/apply_gateway_config.py:12
• Finding: Gateway Authentication Token Is Exposed Through Process Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/apply_gateway_config.py:12-18`; documented invocations in `SKILL.md:98-104`, `README.md:52-57`, and `references/remote-setup.md:55-61` **Vulnerability Type**: Credential exposure through command-line arguments **Risk Level**: Low ### Vulnerable Code ```python def parse_args() -> argparse.Namespace: parser = argparse.ArgumentParser( description="Apply the recommended OpenClaw gateway config for Tailscale Serve." ) parser.add_argument("--config", required=True, help="Path to openclaw.json") parser.add_argument("--ts-hostname", required=True, help="MagicDNS hostname") parser.add_argument("--token", required=True, help="Gateway token") parser.add_argument("--port", type=int, default=18789, help="Gateway port") return parser.parse_args() ``` The documented invocation passes the token as an argument: ```bash python3 "$SKILL_DIR/scripts/apply_gateway_config.py" \ --config "$OPENCLAW_CONFIG" \ --ts-hostname "$TS_HOSTNAME" \ --token "$GATEWAY_TOKEN" \ --port "$GATEWAY_PORT" ``` ### Technical Analysis The script requires the gateway authentication token through the `--token` command-line option. Although the documentation uses a shell variable rather than embedding the literal token directly in the command, the shell expands the variable before starting Python. The resulting token is therefore present in the child process argument vector. Depending on operating-system controls and deployment configuration, process arguments may be visible through process-monitoring tools, audit systems, endpoint telemetry, crash diagnostics, or `/proc` inspection. Privileged observers and processes running under the same account commonly have access to this information. Using a shell variable reduces accidental shell-history disclosure, but it does not protect the expanded process argument list. ### Attack Path 1. The operator exports `GATEWAY_TOKEN` and runs the documente ...[truncated 979 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Prefer reading the token from protected standard input, for example through a `--token-stdin` option. - Alternatively, accept a path to an owner-readable credential file and validate that its mode is no broader than `0600`. - If environment-based input is retained for compatibility, document that environment values may also be visible to same-user or privileged processes on some platforms. - Avoid echoing, logging, or including the token in exception messages. - Update every documented invocation to use the safer input mechanism. - Add tests confirming that the token does not appear in the process command line or normal program output. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/apply_gateway_config.py:46
• Finding: Credential-Bearing Configuration File Is Created Without Enforcing Restrictive Permissions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/apply_gateway_config.py:46-47,81-82,94-100` **Vulnerability Type**: Insecure permissions on a file containing authentication credentials **Risk Level**: Medium ### Vulnerable Code ```python config_path = Path(args.config).expanduser() config_path.parent.mkdir(parents=True, exist_ok=True) ``` ```python auth["mode"] = "token" auth["token"] = args.token ``` ```python backup_path = None if config_path.exists(): stamp = datetime.now().strftime("%Y%m%d_%H%M%S") backup_path = config_path.with_suffix(config_path.suffix + f".bak.{stamp}") shutil.copy2(config_path, backup_path) config_path.write_text(json.dumps(data, indent=2) + "\n") ``` ### Technical Analysis The script stores the plaintext gateway token in the OpenClaw JSON configuration and writes the file using `Path.write_text()` without explicitly setting an owner-only mode. When the file is newly created, its final permissions are determined by the process's ambient `umask`. Under a common `022` umask, a regular file is typically created as `0644`, making it readable by other local users. If the file already exists with overly broad permissions, the script does not correct them. The backup uses `shutil.copy2()`, which normally preserves the source mode. This means an insecure source mode can also be propagated to timestamped backups, increasing the number of readable copies containing the credential. The write is also performed directly against the target rather than through a restrictive, atomic temporary file followed by replacement. A failure during writing could therefore leave a truncated configuration, although the primary security concern is credential confidentiality. ### Attack Path 1. The Skill is executed on a multi-user host with a permissive `umask`, or an existing config already has broad permissions. 2. The script writes the gateway token into `openclaw.json`. 3. The resulting file is readable by group members or ...[truncated 789 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Create new configuration files with mode `0600`, independent of the ambient `umask`. - After writing or replacing an existing file, explicitly enforce `chmod(0o600)`. - Verify that the target is owned by the invoking user and reject unexpected ownership or unsafe symbolic links. - Write JSON to a temporary file created securely in the same directory, flush and `fsync` it, set mode `0600`, and atomically replace the destination. - Ensure timestamped backups are also owner-readable only. - Consider warning before correcting broadly readable existing files, while defaulting to secure permissions. - Add automated tests under permissive `umask` values to confirm that both the active configuration and backups are created with mode `0600`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The skill claims to provide a full remote-access repair workflow, but the implemented behavior appears narrower and may not actually perform several promised safety-critical checks and repairs. That mismatch can cause operators or autonomous agents to trust the skill to validate access, repair DNS/origin issues, or safely modify OpenClaw config when it may only partially reconfigure Tailscale Serve, leading to insecure exposure, incomplete remediation, or service disruption.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This markdown file documents actions that change `openclaw.json`, restart `openclaw-gateway`, and recreate Tailscale Serve, which can affect connectivity and system availability. Although the steps are operationally clear, the README does not provide a direct user warning that these actions modify live system/network configuration and may temporarily disrupt access.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill performs sensitive actions involving file reads/writes, network access, and service reconfiguration, but it does not declare any explicit tool scope or allowed-tools boundary. In an agent environment, that increases the chance the runtime grants broader capabilities than intended, making unintended system changes or data exposure more likely.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

Then:

```bash
sudo systemctl restart systemd-resolved
journalctl -u tailscaled -n 50 --no-pager
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script persists the gateway token directly into the JSON config file on disk and also creates timestamped backups of that file, multiplying the number of copies of the secret. If the config or backup files are readable by other local users, included in support bundles, committed to source control, or exfiltrated from disk, the token can be reused to access the gateway.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script prints the contents of the OpenClaw config file and pending pairing requests directly to stdout, which can expose sensitive information such as device metadata, service configuration, internal URLs, tokens, or pairing state. In a remote-access troubleshooting skill, this output is likely to be shared with an operator, logged in terminal history, or copied into support channels, increasing the chance of unintended disclosure.

Natural-Language Policy Violations

Low

• Confidence: 80% confidence
• Finding: The file prominently presents a locale-specific alternate document link labeled only in Chinese, which can create a language/locale bias in the skill's natural-language presentation. The README does not explicitly offer language choice or explain locale targeting, so this may conflict with the policy against forcing a specific language without opt-in.

Static analysis

No suspicious patterns detected.