Allstar Link node control ASL3 (ASL3 Node Control)

ReviewAudited by ClawScan on May 10, 2026.

Overview

The main skill purpose is coherent, but an included shell helper can send the API key and control commands to a hard-coded fallback IP if the node address is not set.

Before installing, make sure ASL_PI_IP or ASL_API_BASE is explicitly set to your own trusted ASL agent host, avoid using the shell helper until the hard-coded fallback is removed, and review any cron job or saved favorite before relying on automated control.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI03: Identity and Privilege Abuse

What this means

If this helper is run without ASL_PI_IP set, the user's API key and control commands could go to an unexpected host or node.

Why it was flagged

The shell helper uses a hard-coded fallback IP even though the skill requires ASL_PI_IP, and it sends the API key to whichever ASL_BASE results.

Skill content

ASL_PI_IP="${ASL_PI_IP:-100.116.156.98}" ... curl -s -X "$method" -H "X-API-Key: $ASL_API_KEY" ... "${ASL_BASE}${endpoint}"

Recommendation

Remove the hard-coded fallback, require ASL_PI_IP or ASL_API_BASE before any request, and clearly display the target host before sending the API key.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

The agent can perform real node connection changes when the user asks it to, so accidental or misunderstood commands may affect radio-node connectivity.

Why it was flagged

The skill intentionally exposes state-changing connect and disconnect operations for the radio node.

Skill content

python3 {baseDir}/scripts/asl-tool.py connect 55553 --out text ... python3 {baseDir}/scripts/asl-tool.py disconnect 55553 --out text

Recommendation

Use explicit node numbers or reviewed favorites, and consider asking the agent to confirm before connect, disconnect, or timed-net operations.

Low

#ASI10: Rogue Agents

What this means

If the user installs the cron job, the skill can continue making scheduled API calls after the current session until the cron entry is removed.

Why it was flagged

The documentation suggests an optional cron job that keeps invoking the tool every minute for auto-disconnect enforcement.

Skill content

* * * * * /bin/bash -c 'source ~/.config/secrets/api-keys.env && python3 /path/to/asl-tool.py net tick --out text >> ~/.openclaw/state/asl-control/tick.log 2>&1'

Recommendation

Only add the cron entry if needed, keep a record of it, and remove or disable it when automatic net enforcement is no longer desired.

Low

#ASI06: Memory and Context Poisoning

What this means

If these local state files are stale or edited incorrectly, future commands such as connect-fav or net start could target the wrong node.

Why it was flagged

The skill stores favorites and net-session state locally and reuses those values for later connect/net commands.

Skill content

~/.openclaw/state/asl-control/favorites.json ... net-profiles.json ... net-session.json

Recommendation

Review and protect the state directory, especially before using saved favorites or automated net sessions.