ClawHub
Back to skill

Security audit

Auto Drive

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but users should treat uploads and saved memories as public permanent data and protect the Auto-Drive API key.

Install only if you are comfortable with public permanent storage. Do not upload secrets, private keys, confidential files, personal data, or full conversation context unless it is intentionally public or encrypted first. Avoid passing the API key on the command line, rotate it if exposed, and consider using an environment variable or secret manager instead of the setup script's plaintext local files.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/setup-auto-drive.sh:43
Finding

API key is entered with terminal echo enabled

Content
View full analysis
&2 exit 1 fi ``` ### Technical Analysis Bash's `read` command displays entered characters unless the `-s` option is used. Consequently, the Auto-Drive API key remains visible on the terminal while the user enters or pastes it. The key can therefore be exposed through shoulder surfing, screen sharing, terminal session recording, screenshots, remote support software, or other processes that capture terminal output. Removing whitespace after input does not protect the credential from this disclosure. ### Attack Path 1. A user runs `scripts/setup-auto-drive.sh`. 2. The script prompts the user to paste an Auto-Drive API key. 3. Because `read -r` is used without `-s`, the complete key appears on the terminal. 4. An observer, screen-recording system, shared terminal session, or remote support participant captures the displayed key. 5. The attacker uses the captured bearer credential against the Auto-Drive API. ### Impact Assessment An attacker who obtains the API key can act within the authorization scope granted to that key. Based on the audited functionality, this may include consuming upload credits, uploading attacker-controlled content under the victim's account, and accessing authenticated Auto-Drive account or object operations. This does not directly grant local operating-system privileges, but it compromises the associated Auto-Drive account and may create financial, quota, privacy, or integrity consequences. ]]>
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/update-api-key.sh:14
Finding

API key update accepts credentials through command-line arguments

Content
View full analysis
Remediation
View remediation
&2 exit 1 fi ``` For automation: 1. Retrieve the key directly from a secret manager. 2. If environment variables must be supported, ensure the CI platform masks the value and restricts environment inspection. 3. Consider accepting the credential through a protected file descriptor or permission-restricted file. 4. Warn users not to include keys in shell commands. 5. Rotate any key previously supplied as a command-line argument. ]]>

T09 · Insecure Skill Coding Practices

Note
Location
scripts/_lib.sh:109
Finding

API key is duplicated across two plaintext configuration files

Content
View full analysis
"$newtmp" && mv "$newtmp" "$AD_CONFIG_FILE" chmod 600 "$AD_CONFIG_FILE" else local jsontmp jsontmp=$(mktemp) _AD_TMPS+=("$jsontmp") jq --arg key "$key" \ '.skills //= {} | .skills.entries //= {} | .skills.entries["auto-drive"] //= {} | .skills.entries["auto-drive"].apiKey = $key | .skills.entries["auto-drive"].enabled = true' \ "$AD_CONFIG_FILE" > "$jsontmp" && mv "$jsontmp" "$AD_CONFIG_FILE" chmod 600 "$AD_CONFIG_FILE" fi if [[ -f "$AD_ENV_FILE" ]]; then local sedtmp sedtmp=$(mktemp) _AD_TMPS+=("$sedtmp") sed '/^AUTO_DRIVE_API_KEY=/d' "$AD_ENV_FILE" > "$sedtmp" && mv "$sedtmp" "$AD_ENV_FILE" fi local safe_key="${key//\'/\'\\\'\'}" echo "AUTO_DRIVE_API_KEY='${safe_key}'" >> "$AD_ENV_FILE" chmod 600 "$AD_ENV_FILE" ``` ### Technical Analysis The same API key is stored in plaintext in both: - `~/.openclaw/openclaw.json` - `~/.openclaw/.env` The script correctly applies mode `0600` to both files and mode `0700` to the containing directory, which limits direct access by other local users under normal conditions. However, maintaining two plaintext copies unnecessarily increases the credential's exposure surface. Either file may be included in backups, copied for troubleshooting, exposed by another same-user process, or accidentally committed or transferred. The `.env` format is also commonly sourced or processed by general-purpose tooling, increasing the number of components that may encounter the secret. ### Attack Path 1. Setup or key update stores the same API key in two local plaintext files. 2. One file is copied into an insecur ...[truncated 791 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (27)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The declared description emphasizes storage operations on Autonomys Network and a memory resurrection mechanism based on linked CIDs. In contrast, this code chunk only provides helper functionality for platform checks plus credential validation and persistence. While API-key setup may support the broader skill, the actual behavior shown does not perform the core declared functions, and it adds an undeclared capability: writing credentials to local files. Therefore the description does not accurately represent this specific code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The description presents a broader skill with both upload and download support plus specialized memory-chain persistence and reconstruction features. The actual code chunk is a single download shell script: it validates a CID, optionally validates an output path, attempts to fetch content from an Auto-Drive download API, and falls back to a public gateway. It does not upload anything, does not create or traverse linked memory structures, and does not rebuild agent context from a CID. While the download portion aligns partially with the description, the declared purpose materially overstates the capabilities shown in this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The code accurately matches part of the description: it uploads files to Autonomys Network storage through the Auto-Drive API and returns a CID. However, the declared purpose also claims download functionality and a specialized memory system that saves memories as a linked-list chain and rebuilds full agent context from a single CID. None of that behavior appears in this code chunk. The script only performs upload initiation, single chunk upload, completion, and CID validation. Because important declared capabilities are absent and the actual code is substantially narrower than the description, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description focuses on storage operations and memory resurrection behavior over Auto-Drive, but the actual code does not upload, download, store files, manage CIDs, or rebuild context. Instead, it performs configuration management for authentication by updating the Auto-Drive API key. This is a materially different primary purpose and an undeclared capability relative to the description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description emphasizes storage operations and memory persistence/reconstruction features. This code chunk does not implement those behaviors. Instead, it performs prerequisite checks, validates API credentials, and reports account credit/quota status. While this is related to Auto-Drive setup, its primary purpose is materially different from the declared purpose, so this chunk is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md
scripts/autodrive-recall-chain.sh [cid] [--limit N] [--output-dir DIR]

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

md
scripts/autodrive-recall-chain.sh [cid] [--limit N] [--output-dir DIR]

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

The library is designed to persist an API key in predictable local files under ~/.openclaw, including a .env file and JSON config. Even with 600/700 permissions, storing long-lived credentials on disk increases the blast radius of local compromise, accidental backup/sync leakage, or later insecure sourcing of the .env file by other components.

Content

Scanner excerpt · scripts/_lib.sh (reported line 10)May include surrounding context.

sh
AD_API_BASE="https://mainnet.auto-drive.autonomys.xyz/api"
AD_DOWNLOAD_API="https://public.auto-drive.autonomys.xyz/api"
AD_OPENCLAW_DIR="${OPENCLAW_DIR:-$HOME/.openclaw}"
AD_ENV_FILE="$AD_OPENCLAW_DIR/.env"
AD_CONFIG_FILE="$AD_OPENCLAW_DIR/openclaw.json"

GREEN='\033[0;32m'

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/_lib.sh (reported line 128)May include surrounding context.

sh
fi
  echo -e "${GREEN}✓ Saved to $AD_CONFIG_FILE${NC}"

  # --- .env ------------------------------------------------------------------
  # Remove any existing AUTO_DRIVE_API_KEY lines first to prevent duplicates,
  # then append exactly one entry.
  if [[ -f "$AD_ENV_FILE" ]]; then

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The script appends the API key directly into a .env file, creating a plaintext secret at rest that may be read by local malware, leaked through backups, or consumed unsafely if later sourced by shell scripts. While single-quoting reduces command injection risk, it does not mitigate the core exposure from storing a reusable credential in a predictable file.

Content

Scanner excerpt · scripts/_lib.sh (reported line 138)May include surrounding context.

sh
sed '/^AUTO_DRIVE_API_KEY=/d' "$AD_ENV_FILE" > "$sedtmp" && mv "$sedtmp" "$AD_ENV_FILE"
  fi
  # Single-quote the value so characters like #, $, and backticks are
  # preserved literally when the .env file is later sourced by bash.
  local safe_key="${key//\'/\'\\\'\'}"
  echo "AUTO_DRIVE_API_KEY='${safe_key}'" >> "$AD_ENV_FILE"
  chmod 600 "$AD_ENV_FILE"

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/autodrive-recall-chain.sh (reported line 152)May include surrounding context.

sh
if [[ -n "$EXPERIENCE" ]] && echo "$EXPERIENCE" | jq empty 2>/dev/null; then
      echo "[$COUNT] Fetched $CID via gateway" >&2
    else
      # ZLIB compressed — pipe curl directly into decompressor (no intermediate variable)
      EXPERIENCE=""
      if command -v python3 &>/dev/null; then
        EXPERIENCE=$(curl -sS --fail "$GATEWAY_URL" 2>/dev/null \

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/autodrive-recall-chain.sh (reported line 159)May include surrounding context.

sh
| python3 -c "import sys,zlib;sys.stdout.buffer.write(zlib.decompress(sys.stdin.buffer.read()))" 2>/dev/null || true)
      fi
      if [[ -z "$EXPERIENCE" ]] && command -v perl &>/dev/null; then
        EXPERIENCE=$(curl -sS --fail "$GATEWAY_URL" 2>/dev/null \
          | perl -MCompress::Zlib -e 'undef $/;my $d=uncompress(<STDIN>);print $d if defined $d' 2>/dev/null || true)
      fi
      if [[ -n "$EXPERIENCE" ]]; then

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill documents shell-script execution (scripts/*.sh) but does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where an agent framework may permit broader shell access than users expect, increasing the chance of unintended command execution, network access, and local file modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger condition 'Any time the user wants data stored permanently and immutably on a decentralized network' is broad enough to match many ambiguous requests. In practice, this can cause accidental invocation for sensitive content, leading to irreversible public storage of data that the user did not fully intend to publish permanently.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation states that uploaded data is permanent and cannot be deleted, while nearby object operations include delete, restore, and publish actions without an immediate, explicit warning that 'delete' is only soft-delete and that publication/permanent storage may expose data irreversibly. In an agent skill that automates uploads and memory persistence, this can cause users or downstream agents to store sensitive data under the false assumption that it can later be removed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation promotes uploading files to permanent decentralized storage and emphasizes that data does not expire, but it does not warn users about the irreversibility of publication, privacy exposure, or the risks of storing secrets, personal data, or regulated content. In an agent skill context, this is more dangerous because agents may automatically persist conversation history, memories, or files, causing accidental permanent disclosure of sensitive information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The document explicitly states that any system with HTTP access can walk the chain and that a single head CID can reconstruct the agent's full history, but it does not warn that these memories may contain sensitive data and become broadly retrievable by anyone who knows or obtains the CID. In a memory/resurrection context, this omission is security-relevant because users may incorrectly assume the storage is private or only locally recoverable, leading to exposure of agent context, secrets, or personal data.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/_lib.sh (reported line 24)May include surrounding context.

sh
# Usage: ad_install_hint <pkg> [pkg ...]
ad_install_hint() {
  case "$(uname -s 2>/dev/null)" in
    Linux*)               echo "  Install: sudo apt install $*" >&2 ;;
    Darwin*)              echo "  Install: brew install $*" >&2 ;;
    MINGW*|MSYS*|CYGWIN*) echo "  Install: winget install $* OR choco install $*" >&2 ;;
    *)                    echo "  Install: $*" >&2 ;;

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/_lib.sh (reported line 98)May include surrounding context.

sh
local key="$1"

  mkdir -p "$AD_OPENCLAW_DIR"
  chmod 700 "$AD_OPENCLAW_DIR"

  # Collect temp files for cleanup
  _AD_TMPS=()

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/_lib.sh (reported line 116)May include surrounding context.

sh
jq -n --arg key "$key" \
      '{"skills": {"entries": {"auto-drive": {"enabled": true, "apiKey": $key}}}}' \
      > "$newtmp" && mv "$newtmp" "$AD_CONFIG_FILE"
    chmod 600 "$AD_CONFIG_FILE"
  else
    local jsontmp
    jsontmp=$(mktemp)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/_lib.sh (reported line 124)May include surrounding context.

sh
jq -n --arg key "$key" \
      '{"skills": {"entries": {"auto-drive": {"enabled": true, "apiKey": $key}}}}' \
      > "$newtmp" && mv "$newtmp" "$AD_CONFIG_FILE"
    chmod 600 "$AD_CONFIG_FILE"
  else
    local jsontmp
    jsontmp=$(mktemp)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/_lib.sh (reported line 141)May include surrounding context.

sh
jq -n --arg key "$key" \
      '{"skills": {"entries": {"auto-drive": {"enabled": true, "apiKey": $key}}}}' \
      > "$newtmp" && mv "$newtmp" "$AD_CONFIG_FILE"
    chmod 600 "$AD_CONFIG_FILE"
  else
    local jsontmp
    jsontmp=$(mktemp)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/autodrive-save-memory.sh (reported line 144)May include surrounding context.

sh
jq -n --arg key "$key" \
      '{"skills": {"entries": {"auto-drive": {"enabled": true, "apiKey": $key}}}}' \
      > "$newtmp" && mv "$newtmp" "$AD_CONFIG_FILE"
    chmod 600 "$AD_CONFIG_FILE"
  else
    local jsontmp
    jsontmp=$(mktemp)

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This script packages arbitrary input content and uploads it to an external decentralized storage service via a helper upload script, gated only by the presence of an API key. In the context of an agent memory skill, this can exfiltrate sensitive prompts, context, secrets, or local file contents to permanent third-party storage, and the permanence of decentralized storage makes accidental disclosure harder to remediate.

Content

Scanner excerpt · scripts/autodrive-save-memory.sh (reported line 17)May include surrounding context.

sh
# shellcheck source=./_lib.sh
source "$SCRIPT_DIR/_lib.sh"
ad_warn_git_bash
ad_require_tools curl jq
INPUT="${1:?Usage: autodrive-save-memory.sh <data_file_or_string> [--agent-name NAME] [--state-file PATH]}"
AGENT_NAME="${AGENT_NAME:-openclaw-agent}"
STATE_FILE="${OPENCLAW_WORKSPACE:-$HOME/.openclaw/workspace}/memory/autodrive-state.json"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest describes uploading/downloading files and saving memory chains to decentralized storage. This block also edits a local workspace markdown file to pin the latest CID, which is a separate local file-modification capability not clearly justified by the stated Auto-Drive storage purpose.

Content

No source excerpt is available for this finding.