Declaw

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:13 AM UTC
• Version: 0.3.2

Overview

The skill matches its P2P messaging purpose, but installation and discovery instructions expose users to high-impact system and network risks that need review before use.

Review this skill before installing. Prefer the documented package-manager or manually inspected installation path over the curl-to-sudo command, verify any installer source yourself, and understand that enabling discovery may contact bootstrap nodes, announce your agent address, gossip with peers, and expose test messages to bootstrap-operated AI services. Use Docker NET_ADMIN/TUN only in an environment where host networking changes are acceptable.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/install.md:17

Finding

Mutable Remote Installation Script Executed with Root Privileges

Content

View full analysis

Vulnerability Details

File Location: references/install.md:17-19
Vulnerability Type: Remote payload retrieval and privileged execution
Risk Level: Critical

Vulnerable code:

bash

Or run directly:
```bash
curl -fsSL https://raw.githubusercontent.com/ReScienceLab/DeClaw/main/scripts/setup-yggdrasil.sh | sudo bash

Technical Analysis

The installation guide instructs users to download a shell script from the mutable main branch of an external GitHub repository and pipe the response directly into sudo bash. The fetched content is neither pinned to an immutable commit nor verified using a cryptographic signature or checksum. It is also executed without first being saved for inspection.

As a result, the code that runs can change after this Skill has been reviewed. The script receives unrestricted root privileges even though the declared functionality only requires installing and configuring Yggdrasil and starting its daemon. Some installation operations may legitimately require elevation, but executing the entire unseen remote response as root exceeds least privilege.

The remotely hosted setup script is not included in the audited artifact. Its exact file modifications, service installation, configuration changes, and persistence behavior therefore could not be independently verified.

Attack Path

1. An attacker compromises the external repository, its maintainer account, or another component capable of changing the script returned by the URL.
2. The attacker modifies scripts/setup-yggdrasil.sh on the mutable main branch to include arbitrary commands.
3. A user follows the recommended installation command.
4. curl retrieves the altered response and streams it directly to sudo bash.
5. The attacker-controlled commands execute as root without integrity verification or prior inspection.
6. The payload can modify the operating system, steal accessible data, weaken security controls ...[truncated 636 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | sudo bash installation path.
2. Publish versioned releases and reference an immutable release artifact or commit rather than the mutable main branch.
3. Download the installer to a local file without executing it immediately.
4. Publish and require verification of a cryptographic signature and a SHA-256 checksum before execution.
5. Allow the user or administrator to inspect the downloaded script before running it.
6. Separate unprivileged download and validation from privileged installation. Elevate only the specific commands that must modify protected paths, capabilities, or service configuration.
7. Prefer signed packages distributed through trusted native package repositories where feasible.
8. Document every privileged action, including installed files, configuration changes, capabilities, services, startup behavior, listening endpoints, and uninstall procedures.
9. Pin the related Node package to a reviewed version and use a lockfile or integrity metadata so dependency installation is reproducible.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Piping curl output directly into sudo bash is a dangerous command chain because it removes any inspection barrier between network-delivered content and privileged execution. This pattern amplifies the risk of account takeover, content tampering, CDN compromise, or accidental script changes.

Content

Scanner excerpt · references/install.md (reported line 19)May include surrounding context.

Or run directly:

bash

curl -fsSL https://raw.githubusercontent.com/ReScienceLab/DeClaw/main/scripts/setup-yggdrasil.sh | sudo bash

This works on macOS (arm64/amd64) and Linux (Debian/Ubuntu/Arch/tarball).

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/install.md (reported line 45)May include surrounding context.

bash

sudo mkdir -p /usr/local/apt-keys
gpg --fetch-keys https://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/key.txt
gpg --export 1C5162E133015D81A811239D1840CDAC6011C5EA | sudo tee /usr/local/apt-keys/yggdrasil-keyring.gpg > /dev/null
echo 'deb [signed-by=/usr/local/apt-keys/yggdrasil-keyring.gpg] http://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/ debian yggdrasil' \
  | sudo tee /etc/apt/sources.list.d/yggdrasil.list
sudo apt-get update && sudo apt-get install yggdrasil

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/install.md (reported line 46)May include surrounding context.

bash

sudo mkdir -p /usr/local/apt-keys
gpg --fetch-keys https://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/key.txt
gpg --export 1C5162E133015D81A811239D1840CDAC6011C5EA | sudo tee /usr/local/apt-keys/yggdrasil-keyring.gpg > /dev/null
echo 'deb [signed-by=/usr/local/apt-keys/yggdrasil-keyring.gpg] http://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/ debian yggdrasil' \
  | sudo tee /etc/apt/sources.list.d/yggdrasil.list
sudo apt-get update && sudo apt-get install yggdrasil

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/install.md (reported line 45)May include surrounding context.

bash

sudo mkdir -p /usr/local/apt-keys
gpg --fetch-keys https://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/key.txt
gpg --export 1C5162E133015D81A811239D1840CDAC6011C5EA | sudo tee /usr/local/apt-keys/yggdrasil-keyring.gpg > /dev/null
echo 'deb [signed-by=/usr/local/apt-keys/yggdrasil-keyring.gpg] http://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/ debian yggdrasil' \
  | sudo tee /etc/apt/sources.list.d/yggdrasil.list
sudo apt-get update && sudo apt-get install yggdrasil

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/install.md (reported line 47)May include surrounding context.

bash

sudo mkdir -p /usr/local/apt-keys
gpg --fetch-keys https://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/key.txt
gpg --export 1C5162E133015D81A811239D1840CDAC6011C5EA | sudo tee /usr/local/apt-keys/yggdrasil-keyring.gpg > /dev/null
echo 'deb [signed-by=/usr/local/apt-keys/yggdrasil-keyring.gpg] http://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/ debian yggdrasil' \
  | sudo tee /etc/apt/sources.list.d/yggdrasil.list
sudo apt-get update && sudo apt-get install yggdrasil

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · references/install.md (reported line 48)May include surrounding context.

gpg --export 1C5162E133015D81A811239D1840CDAC6011C5EA | sudo tee /usr/local/apt-keys/yggdrasil-keyring.gpg > /dev/null echo 'deb [signed-by=/usr/local/apt-keys/yggdrasil-keyring.gpg] http://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/ debian yggdrasil'
| sudo tee /etc/apt/sources.list.d/yggdrasil.list sudo apt-get update && sudo apt-get install yggdrasil

text

### Linux — Arch

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The Docker example instructs users to run a container with NET_ADMIN and direct access to /dev/net/tun, granting substantial control over host networking from inside the container. For a networking overlay daemon this may be functionally required, but it materially increases the blast radius if the container image is compromised or misconfigured.

Content

Scanner excerpt · references/install.md (reported line 68)May include surrounding context.

Docker

dockerfile

docker run --cap-add=NET_ADMIN --device=/dev/net/tun ...

---

Privileged Container / Container Escape

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The troubleshooting guidance normalizes adding NET_ADMIN and TUN device access to containers, which meaningfully weakens container isolation. In the context of a network-overlay product this may be expected, but it still creates a high-impact pathway if an attacker gains code execution in the container.

Content

Scanner excerpt · references/install.md (reported line 90)May include surrounding context.

md

| Binary found but daemon not detected | Admin socket permission denied. Run `openclaw p2p setup` to switch to TCP admin. |
| Binary found, daemon running, still not detected | Restart the gateway: `launchctl kickstart -k gui/$(id -u)/ai.openclaw.gateway` |
| Linux: permission denied on TUN | Needs `CAP_NET_ADMIN`. Run as root or `sudo setcap cap_net_admin+ep $(which yggdrasil)`. |
| Docker: no TUN device | Add `--cap-add=NET_ADMIN --device=/dev/net/tun` to container. |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documents automatic peer discovery, bootstrap fetches, peer announcements, and periodic gossip without a prominent warning that enabling the plugin causes outbound network connections and shares the agent's address and signed metadata with third-party peers. In a security-sensitive agent environment, undisclosed autonomous communications can violate operator expectations, leak topology or usage information, and increase exposure to untrusted remote systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The bootstrap AI agent section states that chat messages sent to bootstrap nodes are processed remotely to generate AI replies, but it does not clearly warn users that their message contents leave the local system and are handled by a remote service endpoint. This can expose sensitive prompts, operational data, or user content to external infrastructure, especially because the feature is integrated into peer messaging and may be mistaken for ordinary network control traffic.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

This command grants root execution to a script obtained from the network without prior verification. The dangerous aspect is not merely the use of sudo, but the combination of privilege escalation with opaque remote code execution.

Content

Scanner excerpt · references/install.md (reported line 19)May include surrounding context.

Or run directly:

bash

curl -fsSL https://raw.githubusercontent.com/ReScienceLab/DeClaw/main/scripts/setup-yggdrasil.sh | sudo bash

This works on macOS (arm64/amd64) and Linux (Debian/Ubuntu/Arch/tarball).

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The guide recommends piping a remotely fetched script directly into sudo bash, which executes unreviewed network content as root. If the remote source, repository, transport path, or account is compromised, this becomes immediate arbitrary privileged code execution on the host.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 43)May include surrounding context.

Linux — Debian / Ubuntu

bash

sudo mkdir -p /usr/local/apt-keys
gpg --fetch-keys https://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/key.txt
gpg --export 1C5162E133015D81A811239D1840CDAC6011C5EA | sudo tee /usr/local/apt-keys/yggdrasil-keyring.gpg > /dev/null
echo 'deb [signed-by=/usr/local/apt-keys/yggdrasil-keyring.gpg] http://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/ debian yggdrasil' \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 45)May include surrounding context.

Linux — Debian / Ubuntu

bash

sudo mkdir -p /usr/local/apt-keys
gpg --fetch-keys https://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/key.txt
gpg --export 1C5162E133015D81A811239D1840CDAC6011C5EA | sudo tee /usr/local/apt-keys/yggdrasil-keyring.gpg > /dev/null
echo 'deb [signed-by=/usr/local/apt-keys/yggdrasil-keyring.gpg] http://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/ debian yggdrasil' \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 47)May include surrounding context.

Linux — Debian / Ubuntu

bash

sudo mkdir -p /usr/local/apt-keys
gpg --fetch-keys https://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/key.txt
gpg --export 1C5162E133015D81A811239D1840CDAC6011C5EA | sudo tee /usr/local/apt-keys/yggdrasil-keyring.gpg > /dev/null
echo 'deb [signed-by=/usr/local/apt-keys/yggdrasil-keyring.gpg] http://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/ debian yggdrasil' \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 48)May include surrounding context.

Linux — Debian / Ubuntu

bash

sudo mkdir -p /usr/local/apt-keys
gpg --fetch-keys https://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/key.txt
gpg --export 1C5162E133015D81A811239D1840CDAC6011C5EA | sudo tee /usr/local/apt-keys/yggdrasil-keyring.gpg > /dev/null
echo 'deb [signed-by=/usr/local/apt-keys/yggdrasil-keyring.gpg] http://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/ debian yggdrasil' \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 62)May include surrounding context.

Linux — Debian / Ubuntu

bash

sudo mkdir -p /usr/local/apt-keys
gpg --fetch-keys https://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/key.txt
gpg --export 1C5162E133015D81A811239D1840CDAC6011C5EA | sudo tee /usr/local/apt-keys/yggdrasil-keyring.gpg > /dev/null
echo 'deb [signed-by=/usr/local/apt-keys/yggdrasil-keyring.gpg] http://neilalexander.s3.dualstack.eu-west-2.amazonaws.com/deb/ debian yggdrasil' \

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The Docker example omits an explicit image name/tag or digest while also demonstrating elevated networking privileges. Running an unpinned container can lead users to execute an unexpected or outdated image, increasing supply-chain risk when combined with NET_ADMIN and TUN access.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 89)May include surrounding context.

md

| `which yggdrasil` returns nothing | Gatekeeper blocked it (macOS). Run `openclaw p2p setup`. |
| Binary found but daemon not detected | Admin socket permission denied. Run `openclaw p2p setup` to switch to TCP admin. |
| Binary found, daemon running, still not detected | Restart the gateway: `launchctl kickstart -k gui/$(id -u)/ai.openclaw.gateway` |
| Linux: permission denied on TUN | Needs `CAP_NET_ADMIN`. Run as root or `sudo setcap cap_net_admin+ep $(which yggdrasil)`. |
| Docker: no TUN device | Add `--cap-add=NET_ADMIN --device=/dev/net/tun` to container. |

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/install.md (reported line 89)May include surrounding context.

md

| `which yggdrasil` returns nothing | Gatekeeper blocked it (macOS). Run `openclaw p2p setup`. |
| Binary found but daemon not detected | Admin socket permission denied. Run `openclaw p2p setup` to switch to TCP admin. |
| Binary found, daemon running, still not detected | Restart the gateway: `launchctl kickstart -k gui/$(id -u)/ai.openclaw.gateway` |
| Linux: permission denied on TUN | Needs `CAP_NET_ADMIN`. Run as root or `sudo setcap cap_net_admin+ep $(which yggdrasil)`. |
| Docker: no TUN device | Add `--cap-add=NET_ADMIN --device=/dev/net/tun` to container. |

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The flow encourages peer discovery on the network without warning the user that discovery may probe the local/overlay network and reveal the agent's presence to other peers. While this is expected behavior for a P2P feature, omitting a disclosure/consent notice can lead users to perform network-scanning or presence-advertising actions they did not anticipate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill tells users to share their P2P address without explaining that the address is a stable network identifier that can be used by others to contact, track, or correlate the agent across interactions. In a P2P context this is not inherently unsafe, but the missing privacy guidance can cause unintentional exposure of reachability and identity.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The guide fetches an external script from GitHub at runtime and executes it immediately with root privileges. This creates a classic supply-chain risk because the code can change after publication, and users are not instructed to verify integrity or inspect the script first.

Content

Scanner excerpt · references/install.md (reported line 19)May include surrounding context.

Or run directly:

bash

curl -fsSL https://raw.githubusercontent.com/ReScienceLab/DeClaw/main/scripts/setup-yggdrasil.sh | sudo bash

This works on macOS (arm64/amd64) and Linux (Debian/Ubuntu/Arch/tarball).

Static analysis

No suspicious patterns detected.