OpenClaw Cloudflare Secure

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:52 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but it can make persistent system and DNS changes with limited safeguards or confirmation.

Review this carefully before installing. Use a narrowly scoped Cloudflare token, verify which DNS records will be changed, avoid running it against production hostnames without a rollback plan, and prefer a pinned verified cloudflared install. Be aware that the tunnel service is installed with root privileges and enabled to persist after reboot.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: scripts/tunnel_service_install.sh:4

Finding

Persistent System-Wide Cloudflare Tunnel Service

Content

View full analysis

'" >&2 exit 2 fi TOKEN="$1" sudo cloudflared service install "$TOKEN" # Ensure it's running sudo systemctl enable --now cloudflared sudo systemctl is-active cloudflared ``` ### Technical Analysis The script invokes `cloudflared service install` through `sudo`, creating a system-wide service using the supplied tunnel token. It then explicitly executes `systemctl enable --now cloudflared`, which starts the service immediately and configures it to start automatically after future reboots. An always-on service is consistent with the declared goal of operating a persistent Cloudflare Tunnel. However, cross-session persistence is not required for a temporary tunnel session, and the script offers no foreground or non-persistent alternative. It also performs the privileged registration without an explicit confirmation describing the persistence and credential-storage effects. Because tunnel routing is managed through the corresponding Cloudflare configuration, installing a token supplied by an untrusted party could connect the host persistently to an externally controlled tunnel. The service would continue operating after the initiating shell or agent session ends. ### Attack Path 1. An attacker supplies a tunnel token associated with a tunnel or Cloudflare configuration under the attacker’s control, or convinces the operator to use such a token. 2. The operator runs the documented installer with root privileges. 3. `cloudflared service install` stores the tunnel configuration or credential and registers a system service. 4. `systemctl enable --now cloudflared` immediately starts the connector and enables it across reboots. 5. The attacker configures the associated t ...[truncated 1020 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Warning

• Location: scripts/install_cloudflared.sh:15

Finding

Unverified Mutable Package Download Installed as Root

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/tunnel_service_install.sh:4

Finding

Cloudflare Tunnel Token Exposed Through Command-Line Arguments

Content

View full analysis

'" >&2 exit 2 fi TOKEN="$1" sudo cloudflared service install "$TOKEN" ``` The documented invocation in `SKILL.md:45` is: ```bash sudo ./scripts/tunnel_service_install.sh '' ``` ### Technical Analysis The tunnel token is accepted as the script’s first positional command-line argument and is then forwarded as another command-line argument to `cloudflared`. This creates multiple possible credential exposures: - The original invocation may be retained in the user’s shell history. - Process-monitoring and process-accounting systems may record command arguments. - Other sufficiently privileged local users may observe arguments while the process is running. - Audit logs or automation logs may capture the complete command. - The token is duplicated into the argument list of the child `cloudflared` process. The script does not print the token directly, but avoiding standard output is insufficient when the secret remains present in process arguments and shell history. A Cloudflare Tunnel token authorizes a connector to run for its associated tunnel. Its exact impact depends on Cloudflare’s token semantics and the account-side tunnel configuration, but disclosure can permit unauthorized connector use and interfere with or impersonate legitimate tunnel connectivity. ### Attack Path 1. The operator follows the documentation and supplies the tunnel token directly on the command line. 2. The command is stored in shell history, automation logs, process accounting, or another command-recording mechanism. 3. Alternatively, a local observer captures the argument from process metadata while the script or `cloudflared` installation command is running. 4. The obse ...[truncated 846 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs use of shell commands, network-facing configuration, and an environment-stored Cloudflare API token, but declares no explicit tool scope or permission boundaries. In an agent setting, that omission can enable broader-than-expected execution and secret access, increasing the chance of unauthorized DNS changes or service exposure if the skill is invoked automatically.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

If you used Tailscale Serve earlier and want to remove it:

bash

sudo tailscale serve reset

1) Install and start cloudflared tunnel service (token-based)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

If you used Tailscale Serve earlier and want to remove it:

bash

sudo tailscale serve reset

1) Install and start cloudflared tunnel service (token-based)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

If you used Tailscale Serve earlier and want to remove it:

bash

sudo tailscale serve reset

1) Install and start cloudflared tunnel service (token-based)

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

If you used Tailscale Serve earlier and want to remove it:

bash

sudo tailscale serve reset

1) Install and start cloudflared tunnel service (token-based)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill states that it will find and delete any existing A/AAAA/CNAME records for the hostname before creating the tunnel CNAME, but does not prominently warn that this can immediately break live traffic, mail/web dependencies, or other hostname-based services. In operational use, an agent following these steps could cause avoidable outage or misrouting.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/cf_dns.py (reported line 27)May include surrounding context.

python

import urllib.parse
import urllib.request

API = "https://api.cloudflare.com/client/v4"


def _token() -> str:

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md

TOKEN="$1"

sudo cloudflared service install "$TOKEN"

# Ensure it's running
sudo systemctl enable --now cloudflared

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install_cloudflared.sh (reported line 17)May include surrounding context.

sh

TOKEN="$1"

sudo cloudflared service install "$TOKEN"

# Ensure it's running
sudo systemctl enable --now cloudflared

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/tunnel_service_install.sh (reported line 11)May include surrounding context.

sh

TOKEN="$1"

sudo cloudflared service install "$TOKEN"

# Ensure it's running
sudo systemctl enable --now cloudflared

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/tunnel_service_install.sh (reported line 14)May include surrounding context.

sh

TOKEN="$1"

sudo cloudflared service install "$TOKEN"

# Ensure it's running
sudo systemctl enable --now cloudflared

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/tunnel_service_install.sh (reported line 15)May include surrounding context.

sh

TOKEN="$1"

sudo cloudflared service install "$TOKEN"

# Ensure it's running
sudo systemctl enable --now cloudflared

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script uses sudo to install a cloudflared service and then enables and starts it via systemctl, which changes system state persistently. There is no confirmation prompt, warning message, or explanatory comment disclosing these privileged and persistent operations to the user.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/tunnel_service_install.sh (reported line 14)May include surrounding context.

sh

sudo cloudflared service install "$TOKEN"

# Ensure it's running
sudo systemctl enable --now cloudflared
sudo systemctl is-active cloudflared

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Resetting Tailscale Serve is a destructive change that can remove currently published services, yet the guidance presents it as an optional cleanup step without clearly warning about the impact. If an operator or agent runs it casually, existing remote access paths may be disabled unexpectedly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.