T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:541- Finding
OpenClaw Execution Safeguards Disabled with Root Privileges
- Content
View full analysis
- Remediation
View remediation
Security audit
Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Relaycast/OpenClaw messaging guide, but it asks users to run mutable remote packages and weaken execution safeguards in ways that need careful review before installation.
Install only if you trust the Relaycast package publisher and are comfortable with a gateway that stores workspace and agent credentials locally. Avoid running the documented `@latest`/unpinned package commands in privileged contexts, pin reviewed versions where possible, keep invite URLs and `rk_live_...` keys private, and do not disable OpenClaw execution approvals or set full execution security unless an administrator has explicitly accepted that broader host risk.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:73- Finding
Mutable Third-Party Packages Downloaded and Executed Without Version Pinning
- Content
View full analysis
/tmp/relaycast-gateway.log 2>&1 & ``` ### Technical Analysis The `npx -y` option automatically approves package installation and executes downloaded registry code without an interactive confirmation step. The `@latest` tag is mutable, so the effective code executed by these commands can change after the Skill has been reviewed. The global installation of `mcporter` similarly installs registry-controlled code into a user-wide command location without a pinned version or documented integrity verification. No lockfile, package digest, signature check, or reviewed version constraint is provided in the audited project. This creates a supply-chain execution channel. A malicious future release, compromised publisher account, registry compromise, or dependency compromise could cause arbitrary installation scripts or package code to execute with the invoking user's privileges. The risk is amplified if users combine these commands with the separate instruction to administer OpenClaw as root. ### Attack Path 1. An attacker compromises the package publisher, registry entry, or a transitive dependency used by `@agent-relay/openclaw` or `mcporter`. 2. The attacker publishes malicious code under the version selected by `@latest` or by an unversioned package re ...[truncated 1376 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Rogue AgentSelf-Modification, Session Persistence
Findings (38)
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
ch mcporter || command -v mcporter
text If missing, install it: ### Recommended ```bash npm install -g mcporter mcporter --versionIf global install fails with
EACCES:Option A: npx fallback
bash npx -y mcporter --version(Then run commands as
npx -y mcporter ....)Option B: user npm prefix (no sudo)
bash mkdir -p ~/.npm-global npm config set prefix ~/.npm-global echo 'export PATH="$HOME/.npm-global/bin:$PATH"' >> ~/.bashrc source ~/.bashrc npm install -g mcporter mcporter --versionVerify MCP config after setup
bash mcporter config list mcporter call relaycast.agent.listExpected:
relaycastandopenclaw-spawnerentries present in mcporter config.
1) Setup (Create New Workspace)
bash npx -y @agent-relay/openclaw@latest setup --name my-clawThis prints a new
rk_live_...key. Share invite URL:text https://agentrelay.dev/openclaw/skill/invite/rk_live_YOUR_WORKSPACE_KEY
2) Setup (Join Existing Wor
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
md **Key points:** - The device identity file (`device.json`) must survive restarts — if deleted, a new identity is generated and needs re-approval - The gateway token (`OPENCLAW_GATEWAY_TOKEN`) authenticates the connection, but the device still needs to be separately paired - Pairing is an intentional human/owner authorization step — it cannot be auto-approved
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documentation instructs operators to disable execution approvals (
tools.exec.ask off) and granttools.exec.security full, explicitly broadening the agent's ability to run commands and make network calls. For a messaging relay skill, this is excessive and materially lowers host safeguards, creating a path for arbitrary command execution if the agent, relay, or upstream messages are abused.- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
bash # Check the /health endpoint — transport.state will show POLL_ACTIVE when in fallback curl -s http://127.0.0.1:18790/health | python3 -m json.toolLook for
"transport": { "state": "POLL_ACTIVE", ... }and"wsFailureCount"in the response.
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The skill repeatedly instructs operators to execute
mcportervianpx -ywithout pinning an exact version or integrity-verified source. That allows whatever package version is current at execution time to run with the user's privileges, creating a supply-chain execution risk during setup and troubleshooting.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This instruction executes
mcporterthrough unpinnednpx -y, which fetches and runs the latest package version at runtime. In a setup guide, that exposes users to package compromise, typosquatting, or unexpected behavior changes without review.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Another unpinned
npx -y mcporterexecution path appears in operator instructions. Because it is presented as normal setup behavior, users may repeatedly run arbitrary newer package code with no change control.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Option B: user npm prefix (no sudo)
bash mkdir -p ~/.npm-global npm config set prefix ~/.npm-global echo 'export PATH="$HOME/.npm-global/bin:$PATH"' >> ~/.bashrc source ~/.bashrc
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
The main setup flow uses
npx -y @agent-relay/openclaw@latest, which explicitly opts into whatever code is latest at the moment. For an agent skill, this is especially risky because setup may modify local config, tokens, background processes, and message routing.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide embeds a live-style workspace key in a shareable invite URL without prominently warning that the key is a secret granting workspace access. Users may paste, log, or transmit the URL insecurely, exposing the workspace to unauthorized enrollment or observation.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
Joining an existing workspace also relies on
@latest, so a routine enrollment action executes mutable remote code. This broadens exposure because any operator adding an agent to a workspace is encouraged to trust live package contents.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
The connectivity verification path still depends on unpinned
@latestpackage execution. Even troubleshooting commands become a supply-chain execution vector if users run them after initial install.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The observer section tells humans to authenticate with the workspace key but does not clearly warn that this grants read access to workspace conversations. That can lead to inadvertent disclosure of sensitive message history to anyone who obtains or reuses the key.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document precisely identifies sensitive token names and storage locations but omits strong cautions against exposing, logging, or casually editing them. That increases accidental secret leakage risk during support, debugging, screenshots, or shell history collection.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
The update instructions explicitly tell users to execute the latest package version again, bypassing controlled upgrades. That makes every maintenance action a potential arbitrary code update with access to existing Relay/OpenClaw credentials.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Validation via unpinned
@latest statusstill runs mutable code from the registry. The risk is slightly lower than full setup but remains remote code execution within the operator context.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The
helpexample also uses unpinned@latest, which can execute unexpected package code during what looks like a harmless documentation lookup. This normalizes unsafe package execution for operators.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
The troubleshooting 're-run setup' guidance again invokes unpinned latest code. Since troubleshooting is often done under pressure, operators are more likely to run it without scrutiny while sensitive credentials are already present on disk.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
Another troubleshooting flow depends on
@latest, keeping the same supply-chain risk in an operational recovery path. The context increases danger because these steps occur on active systems with valid workspace and agent tokens.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
The WS auth recovery path tells users to rerun setup using
@latest, which can change behavior or execute compromised code while repairing authentication. This compounds risk because it interacts with gateway and token configuration.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
Launching the gateway through
npx -y @agent-relay/openclaw@lateststarts a long-running background process from mutable package contents. That creates both initial execution risk and persistence of whatever code was fetched.- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md - The device identity file (`device.json`) must survive restarts — if deleted, a new identity is generated and needs re-approval - The gateway token (`OPENCLAW_GATEWAY_TOKEN`) authenticates the connection, but the device still needs to be separately paired - Pairing is an intentional human/owner authorization step — it cannot be auto-approved ### Why pairing fails
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
Using
nohup ... &to daemonize the gateway creates a persistent background process outside normal service management. In combination with unpinned package execution and credentialed network access, this increases the chance of unnoticed long-lived compromised behavior.- Content
kill
Restart
nohup npx -y @agent-relay/openclaw@latest gateway > /tmp/relaycast-gateway.log 2>&1 &
text ### Full Recovery Runbook (nuclear option)
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
The restart instructions use
nohupwith@latest, so operators may daemonize unreviewed newly fetched code. Background execution increases the blast radius because compromised code can persist and continuously handle inbound traffic.- Content