Security audit
Security checks for vulnerabilities and agentic risk
This skill manages OpenClaw agents as advertised, but it broadly copies credentials into new agents and performs sensitive config changes with weak scoping and confirmation.
Install only if you are comfortable with this skill modifying OpenClaw agent configuration and copying existing API credentials into newly deployed agents. Prefer reviewing or changing it first so credentials are explicitly allowlisted, tokens are not passed on the command line, removal requires confirmation, and generated auth files are securely permissioned and cleaned up on failure or removal.
scripts/deploy_helper.py:115Broad Credential Replication Violates Agent Isolation and Least Privilege
scripts/deploy_helper.py:148Plaintext Credential Files Lack Enforced Permissions and Lifecycle Cleanup
scripts/deploy.sh:6Telegram Bot Token Is Exposed Through Process Arguments and Console Output
scripts/deploy.sh:6Missing Agent Identifier Validation Enables Unsafe Path and Configuration-Key Handling
The skill is presented as a deployment skill, yet it also includes a destructive removal operation that can delete agent bindings and account configuration. Hiding destructive functionality behind a create/deploy-oriented description makes accidental or unauthorized invocation more likely, especially in agentic systems that rely on manifest descriptions for routing and trust decisions.
The skill is presented as a deployment skill, yet it also includes a destructive removal operation that can delete agent bindings and account configuration. Hiding destructive functionality behind a create/deploy-oriented description makes accidental or unauthorized invocation more likely, especially in agentic systems that rely on manifest descriptions for routing and trust decisions.
The skill is presented as a deployment skill, yet it also includes a destructive removal operation that can delete agent bindings and account configuration. Hiding destructive functionality behind a create/deploy-oriented description makes accidental or unauthorized invocation more likely, especially in agentic systems that rely on manifest descriptions for routing and trust decisions.
The skill instructs direct execution of an agent removal script without any confirmation, preview, or warning despite the action being destructive. In an agentic environment, this creates a significant risk of accidental deletion from a mistaken request, ambiguous routing, or prompt-manipulated invocation.
The script prints that the deployed agent has sandbox restrictions such as non-main mode, agent scope, no workspace access, and denied gateway tools, but it never actually configures those controls. This creates a dangerous mismatch between operator expectations and real security posture, so users may deploy agents believing they are constrained when they are not.
The merge-auth action copies authentication profiles from global and main-agent stores into a newly created agent, effectively propagating credentials across trust boundaries. In a multi-agent system, this broadens access for the new agent and undermines isolation, so compromise or misuse of one agent can inherit secrets intended for other contexts.
The skill instructs execution of shell scripts and handling of secrets, but the manifest does not declare any tool scope or allowed-tools boundaries. This increases the risk that an agent platform may grant broader-than-necessary file or environment access, enabling unintended writes or exposure of sensitive configuration and bot tokens during deployment operations.
The trigger guidance uses broad language like 'or similar,' making activation boundaries ambiguous for an agent that may auto-select this skill. In a skill capable of modifying configuration, deploying bots, or removing agents, vague routing conditions raise the chance of unintended execution in response to loosely related user requests.
The script logs the first part of the bot token to stdout, which can expose credential material in shell history capture, CI logs, terminal recording, or centralized logging systems. Even partial secret disclosure increases the chance of token identification and mishandling, especially in operational environments where logs are widely accessible.
The script claims to create an isolated agent, yet it explicitly merges authentication profiles from global or main-agent state into the new agent. That breaks isolation boundaries and can grant the new agent access to API keys or credentials it should not inherit, increasing blast radius if the new agent is compromised or misconfigured.
The top-level docstring narrows the helper's purpose to 'pre-flight checks + config generation'. In reality, later branches perform unrelated operational tasks including listing agents, removing config entries, migrating existing bot configuration, and writing merged auth data to disk, which actively contradicts the stated scope of the module.
The helper loads openclaw.json, later compares botToken values and merges auth profiles from auth files, which involves access to credential-bearing data. There is no visible warning, comment, or user-facing log explaining that the script accesses sensitive tokens/auth profile information.
The list action enumerates configured Telegram accounts and prints a visible prefix of each bot token. Even though it truncates the value, exposing secret material and account inventory exceeds the helper's deployment role and creates unnecessary credential disclosure risk through logs, terminal history, screenshots, or delegated tool output.
This code performs a file write to an auth-related path containing merged credential/profile data, but there is no confirmation prompt, warning comment/docstring, or user-facing disclosure immediately describing that sensitive auth data will be written. For a code file, writing authentication material is a safety-relevant operation that should be clearly disclosed.
The manifest says the skill deploys new agents, but the body also documents listing and removing agents. This scope drift weakens transparency and can cause systems or users to invoke a skill expecting creation-only behavior while unknowingly granting access to reconnaissance and destructive operations.
No suspicious patterns detected.