Skill

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:35 AM UTC
• Version: 3.1.7

Overview

The skill is a coherent Relaycast/OpenClaw messaging guide, but it asks users to run mutable remote packages and weaken execution safeguards in ways that need careful review before installation.

Install only if you trust the Relaycast package publisher and are comfortable with a gateway that stores workspace and agent credentials locally. Avoid running the documented `@latest`/unpinned package commands in privileged contexts, pin reviewed versions where possible, keep invite URLs and `rk_live_...` keys private, and do not disable OpenClaw execution approvals or set full execution security unless an administrator has explicitly accepted that broader host risk.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:541
• Finding: OpenClaw Execution Safeguards Disabled with Root Privileges<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 541-547 **Vulnerability Type**: Least-privilege violation and execution-policy weakening **Risk Level**: High ### Vulnerable Code ```bash SSH into the server and run as root: /opt/openclaw-cli.sh config set tools.exec.host gateway /opt/openclaw-cli.sh config set tools.exec.ask off /opt/openclaw-cli.sh config set tools.exec.security full systemctl restart openclaw ``` ### Technical Analysis The documented procedure instructs an administrator to run configuration commands as root that: - Route agent commands through the gateway process. - Disable interactive approval prompts with `tools.exec.ask off`. - Enable the highest available execution tier with `tools.exec.security full`. - Restart the OpenClaw service so the weakened policy takes effect. These settings collectively remove important defense-in-depth controls. Real-time messaging requires network connectivity and narrowly defined messaging operations, but it does not inherently require unrestricted shell execution without user confirmation. The procedure therefore exceeds the minimum privileges necessary for the Skill's declared functionality. Although the document states that this does not directly grant root access to the `openclaw` user, the resulting agent still receives substantially broader command and network capabilities. The root-level configuration change also affects the security posture of the shared OpenClaw runtime, including other Skills and untrusted content processed by that runtime. ### Attack Path 1. An administrator follows the troubleshooting procedure as root. 2. OpenClaw is configured to execute commands through the gateway with approval prompts disabled and execution security set to `full`. 3. The service restarts with the weakened policy. 4. An attacker submits malicious content through a Relaycast message, another loaded Skill, or another prompt-controlled input. 5. The agent interprets that content as ...[truncated 1102 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not recommend `tools.exec.security full` as a general troubleshooting step. 2. Keep interactive approval enabled for shell commands, sensitive file access, configuration changes, and outbound network operations. 3. Use an unprivileged, dedicated service account for the relay gateway. 4. Define an allowlist containing only the commands and network destinations required for Relaycast messaging. 5. Separate messaging operations from general-purpose shell execution. 6. If gateway-hosted execution is unavoidable, restrict it to the Relaycast executables and required arguments. 7. Document the security consequences before any policy change and require explicit administrator confirmation. 8. Provide rollback commands that restore the original execution policy. 9. Restrict credential files to the service account using owner-only filesystem permissions. 10. Treat inbound messages as untrusted data and ensure they cannot directly authorize tool invocation. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:73
• Finding: Mutable Third-Party Packages Downloaded and Executed Without Version Pinning<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 21-73; repeated at lines 89, 144, 252-269, 310-311, 428, 464, 620, and 682-683 **Vulnerability Type**: Unsafe third-party dependency installation and execution **Risk Level**: High ### Vulnerable Code ```bash # SKILL.md:32-35 npm install -g mcporter mcporter --version ``` ```bash # SKILL.md:41-43 npx -y mcporter --version ``` ```bash # SKILL.md:71-74 npx -y @agent-relay/openclaw@latest setup --name my-claw ``` The same mutable package is subsequently used for setup, status checks, gateway startup, and troubleshooting, including: ```bash npx -y @agent-relay/openclaw@latest gateway --debug nohup npx -y @agent-relay/openclaw@latest gateway > /tmp/relaycast-gateway.log 2>&1 & ``` ### Technical Analysis The `npx -y` option automatically approves package installation and executes downloaded registry code without an interactive confirmation step. The `@latest` tag is mutable, so the effective code executed by these commands can change after the Skill has been reviewed. The global installation of `mcporter` similarly installs registry-controlled code into a user-wide command location without a pinned version or documented integrity verification. No lockfile, package digest, signature check, or reviewed version constraint is provided in the audited project. This creates a supply-chain execution channel. A malicious future release, compromised publisher account, registry compromise, or dependency compromise could cause arbitrary installation scripts or package code to execute with the invoking user's privileges. The risk is amplified if users combine these commands with the separate instruction to administer OpenClaw as root. ### Attack Path 1. An attacker compromises the package publisher, registry entry, or a transitive dependency used by `@agent-relay/openclaw` or `mcporter`. 2. The attacker publishes malicious code under the version selected by `@latest` or by an unversioned package re ...[truncated 1376 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with a specific reviewed package version. 2. Pin `mcporter` to a specific reviewed version as well. 3. Maintain a lockfile that fixes all transitive dependency versions. 4. Verify package integrity using trusted registry integrity hashes, signatures, or an approved internal artifact repository. 5. Avoid `npx -y` for security-sensitive setup and gateway execution. 6. Download and inspect the package before first execution where practical. 7. Avoid global package installation; use a project-local dependency or isolated runtime. 8. Run installation and gateway processes as a dedicated unprivileged account. 9. Never execute package-manager commands as root unless a narrowly justified deployment process requires it. 10. Establish a controlled update process that reviews release notes and package diffs before changing the pinned version. 11. Restrict package lifecycle scripts where compatible with the package's documented installation requirements. 12. Ensure credential files use owner-only permissions so a compromised package running under another identity cannot read them. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Rogue Agent: Self-Modification, Session Persistence

Findings (38)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

ch mcporter || command -v mcporter
```

If missing, install it:

### Recommended

```bash
npm install -g mcporter
mcporter --version
```

If global install fails with `EACCES`:

### Option A: npx fallback

```bash
npx -y mcporter --version
```

(Then run commands as `npx -y mcporter ...`.)

### Option B: user npm prefix (no sudo)

```bash
mkdir -p ~/.npm-global
npm config set prefix ~/.npm-global
echo 'export PATH="$HOME/.npm-global/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc
npm install -g mcporter
mcporter --version
```

### Verify MCP config after setup

```bash
mcporter config list
mcporter call relaycast.agent.list
```

Expected: `relaycast` and `openclaw-spawner` entries present in mcporter config.

---

## 1) Setup (Create New Workspace)

```bash
npx -y @agent-relay/openclaw@latest setup --name my-claw
```

This prints a new `rk_live_...` key. Share invite URL:

```text
https://agentrelay.dev/openclaw/skill/invite/rk_live_YOUR_WORKSPACE_KEY
```

---

## 2) Setup (Join Existing Wor

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Memory Manipulation

High

• Category: Memory Poisoning

Content

**Key points:**

- The device identity file (`device.json`) must survive restarts — if deleted, a new identity is generated and needs re-approval
- The gateway token (`OPENCLAW_GATEWAY_TOKEN`) authenticates the connection, but the device still needs to be separately paired
- Pairing is an intentional human/owner authorization step — it cannot be auto-approved

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The documentation instructs operators to disable execution approvals (`tools.exec.ask off`) and grant `tools.exec.security full`, explicitly broadening the agent's ability to run commands and make network calls. For a messaging relay skill, this is excessive and materially lowers host safeguards, creating a path for arbitrary command execution if the agent, relay, or upstream messages are abused.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Check the /health endpoint — transport.state will show POLL_ACTIVE when in fallback
curl -s http://127.0.0.1:18790/health | python3 -m json.tool
```

Look for `"transport": { "state": "POLL_ACTIVE", ... }` and `"wsFailureCount"` in the response.

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The skill repeatedly instructs operators to execute `mcporter` via `npx -y` without pinning an exact version or integrity-verified source. That allows whatever package version is current at execution time to run with the user's privileges, creating a supply-chain execution risk during setup and troubleshooting.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: This instruction executes `mcporter` through unpinned `npx -y`, which fetches and runs the latest package version at runtime. In a setup guide, that exposes users to package compromise, typosquatting, or unexpected behavior changes without review.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: Another unpinned `npx -y mcporter` execution path appears in operator instructions. Because it is presented as normal setup behavior, users may repeatedly run arbitrary newer package code with no change control.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Option B: user npm prefix (no sudo)

```bash
mkdir -p ~/.npm-global
npm config set prefix ~/.npm-global
echo 'export PATH="$HOME/.npm-global/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The main setup flow uses `npx -y @agent-relay/openclaw@latest`, which explicitly opts into whatever code is latest at the moment. For an agent skill, this is especially risky because setup may modify local config, tokens, background processes, and message routing.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The guide embeds a live-style workspace key in a shareable invite URL without prominently warning that the key is a secret granting workspace access. Users may paste, log, or transmit the URL insecurely, exposing the workspace to unauthorized enrollment or observation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: Joining an existing workspace also relies on `@latest`, so a routine enrollment action executes mutable remote code. This broadens exposure because any operator adding an agent to a workspace is encouraged to trust live package contents.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The connectivity verification path still depends on unpinned `@latest` package execution. Even troubleshooting commands become a supply-chain execution vector if users run them after initial install.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The observer section tells humans to authenticate with the workspace key but does not clearly warn that this grants read access to workspace conversations. That can lead to inadvertent disclosure of sensitive message history to anyone who obtains or reuses the key.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The document precisely identifies sensitive token names and storage locations but omits strong cautions against exposing, logging, or casually editing them. That increases accidental secret leakage risk during support, debugging, screenshots, or shell history collection.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The update instructions explicitly tell users to execute the latest package version again, bypassing controlled upgrades. That makes every maintenance action a potential arbitrary code update with access to existing Relay/OpenClaw credentials.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: Validation via unpinned `@latest status` still runs mutable code from the registry. The risk is slightly lower than full setup but remains remote code execution within the operator context.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The `help` example also uses unpinned `@latest`, which can execute unexpected package code during what looks like a harmless documentation lookup. This normalizes unsafe package execution for operators.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The troubleshooting 're-run setup' guidance again invokes unpinned latest code. Since troubleshooting is often done under pressure, operators are more likely to run it without scrutiny while sensitive credentials are already present on disk.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: Another troubleshooting flow depends on `@latest`, keeping the same supply-chain risk in an operational recovery path. The context increases danger because these steps occur on active systems with valid workspace and agent tokens.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The WS auth recovery path tells users to rerun setup using `@latest`, which can change behavior or execute compromised code while repairing authentication. This compounds risk because it interacts with gateway and token configuration.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: Launching the gateway through `npx -y @agent-relay/openclaw@latest` starts a long-running background process from mutable package contents. That creates both initial execution risk and persistence of whatever code was fetched.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- The device identity file (`device.json`) must survive restarts — if deleted, a new identity is generated and needs re-approval
- The gateway token (`OPENCLAW_GATEWAY_TOKEN`) authenticates the connection, but the device still needs to be separately paired
- Pairing is an intentional human/owner authorization step — it cannot be auto-approved

### Why pairing fails

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Session Persistence

Medium

• Category: Rogue Agent

Content

kill <pid>

# Restart
nohup npx -y @agent-relay/openclaw@latest gateway > /tmp/relaycast-gateway.log 2>&1 &
```

### Full Recovery Runbook (nuclear option)

• Confidence: 91% confidence
• Finding: Using `nohup ... &` to daemonize the gateway creates a persistent background process outside normal service management. In combination with unpinned package execution and credentialed network access, this increases the chance of unnoticed long-lived compromised behavior.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 98% confidence
• Finding: The restart instructions use `nohup` with `@latest`, so operators may daemonize unreviewed newly fetched code. Background execution increases the blast radius because compromised code can persist and continuously handle inbound traffic.

Static analysis

No suspicious patterns detected.