Security audit
Security checks for vulnerabilities and agentic risk
The skill is purpose-aligned but needs Review because its setup path can install persistent system services, route future model traffic through a P2P network, and contains unsafe argument handling that can enable code or service-file injection.
Review before installing. Use a temporary foreground proxy first, avoid the --service option unless you explicitly want a reboot-persistent background process, and do not route secrets or regulated data through the P2P provider network unless you trust the providers. Treat the setup script as unsafe with untrusted arguments, and prefer pinned package versions plus manual review of OpenClaw configuration changes.
scripts/setup.sh:137Reboot-Persistent System Service Installation
scripts/setup.sh:108Python Code Injection Through Unvalidated Setup Arguments
scripts/setup.sh:137Systemd Unit Injection Through the Unvalidated Port Argument
scripts/setup.sh:68Execution of Unpinned Third-Party npm Packages
The skill performs file-modifying actions, including overwriting the user's OpenClaw configuration and creating a systemd unit, but it declares no tool scope or permissions metadata. This increases the chance that an agent or user invokes it without clear disclosure that persistent local changes will occur, weakening least-privilege and informed-consent expectations.
The skill routes LLM prompts and responses through a peer-to-peer provider network but does not clearly warn that user data may be processed by unknown third-party nodes. In this context, prompts can contain sensitive business, personal, or credential-adjacent data, so omission of a privacy warning materially increases exposure risk.
The skill instructs the user to create and enable a root-managed systemd service without an upfront warning that this causes persistent system-level modification. Persistent services broaden the blast radius of mistakes, can survive reboots, and may unintentionally expose network functionality long-term.
This command writes a new unit file into /etc/systemd/system using sudo, which is a privileged system modification. While the purpose appears legitimate, using elevated privileges in a skill is dangerous because it can establish persistent execution and modify trusted system startup behavior.
To run the proxy as a background service that survives reboots:
sudo tee /etc/systemd/system/antseed-buyer.service > /dev/null <<'EOF'
[Unit]
Description=AntSeed Buyer Proxy
After=network-online.target
Reloading systemd with sudo changes the active service manager state and is part of installing a persistent service. Even when intended for convenience, privileged service-management steps can be abused or executed without sufficient user understanding of system-wide impact.
WantedBy=multi-user.target EOF
sudo systemctl daemon-reload sudo systemctl enable --now antseed-buyer
Enabling and starting the service with sudo causes the AntSeed proxy to run immediately and persist across reboots. Because the proxy joins a P2P network and exposes a local HTTP endpoint, persistence increases long-term attack surface and the chance of unnoticed operation.
EOF
sudo systemctl daemon-reload sudo systemctl enable --now antseed-buyer
Verify: `sudo systemctl is-active antseed-buyer`
The skill explicitly enables the AntSeed proxy as a startup service, creating session persistence. In this context, persistence is more sensitive because the service automatically reconnects to a P2P network and continues handling model traffic after reboot, potentially without ongoing user awareness.
EOF
sudo systemctl daemon-reload sudo systemctl enable --now antseed-buyer
Verify: `sudo systemctl is-active antseed-buyer`
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
sudo systemctl enable --now antseed-buyer
Verify: `sudo systemctl is-active antseed-buyer`
## Step 3: Configure OpenClaw model provider
Restarting the OpenClaw service with sudo is a privileged operational change that affects availability and immediately applies the new provider configuration. In this skill's context, that also activates routing through the P2P proxy, so the command has meaningful security and privacy consequences.
# Restart the gateway to pick up the new provider
sudo systemctl restart openclaw # or kill and restart the gateway process
# Test the connection
curl -s http://127.0.0.1:5005/v1/models
The script edits ~/.antseed/config.json directly to add bootstrap nodes without any confirmation, backup, or dry-run output. Even though this is part of its stated purpose, silent modification of persistent user configuration can unexpectedly change network trust and routing behavior, especially because the bootstrap node may be user-supplied or operationally sensitive.
The script rewrites the OpenClaw configuration file and sets the default model provider to AntSeed without prompting the user or preserving prior defaults. This is risky because it persistently changes how future LLM requests are routed, potentially redirecting sensitive prompts and responses through a peer-to-peer network endpoint.
The script invokes sudo to write a unit file into /etc/systemd/system, introducing a privileged write path based on runtime-expanded values. While intended for legitimate service installation, any unnecessary privileged operation increases risk and should be tightly scoped and clearly separated from unprivileged setup.
if [ "$INSTALL_SERVICE" = true ]; then
echo "==> Installing systemd service..."
ANTSEED_BIN=$(command -v antseed)
sudo tee /etc/systemd/system/antseed-buyer.service > /dev/null <<SERVICE
[Unit]
Description=AntSeed Buyer Proxy
After=network-online.target
When --service is used, the script installs and starts a persistent systemd service via sudo, but the user only gets an informational message at execution time rather than a strong upfront warning about privileged, persistent system changes. This can surprise users and leaves a long-running network-connected process enabled at boot.
Running sudo systemctl daemon-reload performs a privileged system-wide service manager action. In context this is expected for service installation, but it still represents elevated execution that can affect system service state and should not happen silently in a general setup script.
[Install]
WantedBy=multi-user.target
SERVICE
sudo systemctl daemon-reload
sudo systemctl enable --now antseed-buyer
echo " Service installed and started"
else
The script enables and starts the antseed-buyer service with sudo, causing privileged execution and persistent autorun at boot. In this skill's context, that makes the behavior more sensitive because it creates a long-lived network proxy that may process future model traffic without further user awareness.
WantedBy=multi-user.target
SERVICE
sudo systemctl daemon-reload
sudo systemctl enable --now antseed-buyer
echo " Service installed and started"
else
echo ""
systemctl enable --now creates persistence by starting the buyer proxy immediately and configuring it to launch on boot. For a component that routes AI traffic through a P2P network, persistence materially increases exposure because the proxy remains active beyond the initial setup session and may continue handling sensitive requests.
WantedBy=multi-user.target
SERVICE
sudo systemctl daemon-reload
sudo systemctl enable --now antseed-buyer
echo " Service installed and started"
else
echo ""
The skill rewrites the user's OpenClaw configuration file via a shell pipeline and move operation without recommending a backup or validating the resulting JSON. A malformed edit or unexpected environment state could break the user's configuration or silently replace existing provider settings.
No suspicious patterns detected.