Security audit

openclaw-teleport

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent migration tool, but it handles plaintext credentials and restores scheduled jobs/services through mutable npm code, so users should review it carefully before installing.

Install only if you intentionally need full OpenClaw workspace migration. Treat .soul files as secret-bearing backups, encrypt them before transfer, keep them out of git/cloud sync, and prefer a pinned, verified package version in an isolated account or sandbox. Inspect archives before unpacking, and do not unpack archives from sources you do not fully trust because they can restore credentials, cron jobs, repositories, and services.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:10
Finding: Execution of an Unpinned Third-Party npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:34
Finding: Plaintext Credentials Included in Migration Archives
Content: View full analysis
_.soul` file (tar.gz) containing: - Full workspace (identity files, memory, skills, workflows, databases — excluding git repo subdirectories) - Agent config + channel credentials from `openclaw.json` - Cron job definitions - GitHub repo list (re-cloned on unpack) ``` ```markdown ## Security ⚠️ `.soul` files contain **plaintext credentials** (API tokens, bot tokens, app secrets). Treat them like password files: - Never commit to git or share publicly - Transfer via encrypted channels (SSH, encrypted USB) - Delete after unpacking - Optionally encrypt with `gpg -c agent.soul` ``` ### Technical Analysis The normal packing workflow places channel credentials, API tokens, bot tokens, and application secrets into a tar.gz archive without encryption. Compression does not provide confidentiality. Encryption is described only as an optional action performed after the plaintext archive has already been created. This design leaves several exposure points, including the generated archive, temporary files used during packing, filesystem snapshots, automated backups, cloud synchronization, shell workflows, and copies made before optional encryption. Deleting the archive after restoration also does not guarantee secure erasure on modern filesystems or remove copies retained by backup and synchronization systems. ### Attack Path 1. A user runs the documented `pack` command. 2. The utility creates a `.soul` archive containing plaintext credentials. 3. The archive is left on disk, copied to backup storage, synchronized to a remote service, accidentally committed to a repository, or transferred over an insecure channel. 4. An attacker obtains the archive and extracts it as a tar.gz file. 5. The attacker recovers the included credentials and us ...[truncated 611 chars]
Remediation: View remediation

T06 · System Persistence

Error

Location: SKILL.md:40
Finding: Archive Restoration Recreates Scheduled Tasks and Starts Services
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger description is broad and includes generic concepts like backup, restore, migration, pack, unpack, and even a common term in another language, which can cause the skill to be invoked in situations beyond the user's actual intent. In this context, unintended invocation is more dangerous because the skill operates on entire agent workspaces and explicitly handles plaintext credentials, configs, cron jobs, and repository restoration.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The skill instructs users to run npx @kagura-agent/openclaw-teleport without pinning an exact version, which causes execution of whatever package version is current at invocation time. Because this package handles highly sensitive material including plaintext credentials and workspace restoration, a compromised, typosquatted, or maliciously updated upstream package could lead to credential theft or arbitrary code execution during pack/unpack.
Content: No source excerpt is available for this finding.