ClawHub
Back to skill

Security audit

External Receiver

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but its default network receiver can expose uploaded files and inject external messages into an OpenClaw session with weak access controls.

Install only if you are prepared to harden it first: bind it to localhost or a trusted interface, require a strong secret, protect or remove the status and download endpoints, add request size limits, and treat all received content as untrusted before it reaches an OpenClaw session.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
receiver_server.py:22
Finding

Unauthenticated Network Input Is Forwarded into the OpenClaw Agent Session

Content
View full analysis
bool: if not RECEIVER_SECRET: return True auth = self.headers.get("Authorization", "") return auth == f"Bearer {RECEIVER_SECRET}" ``` ```python payload = _json.dumps({ "jsonrpc": "2.0", "method": "sessions.send", "params": { "text": text, }, "id": 1 }).encode("utf-8") ``` ```python def do_POST(self): if not self._check_secret(): self._error("Unauthorized", 401) return if self.path == "/upload": self._handle_upload() elif self.path == "/message": self._handle_message() elif self.path == "/webhook": self._handle_webhook() else: self._error("Unknown path", 404) ``` ```bash PORT="${RECEIVER_PORT:-8080}" HOST="${RECEIVER_HOST:-0.0.0.0}" SECRET="${RECEIVER_SECRET:-}" ARGs=(--port "$PORT" --host "$HOST") if [ -n "$SECRET" ]; then ARGs+=(--secret "$SECRET") fi python3 receiver_server.py "${ARGs[@]}" ``` ### Technical Analysis The re ...[truncated 2338 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
receiver_server.py:145
Finding

Authentication Is Bypassed for File Listing and Download Endpoints

Content
View full analysis
External Receiver

External Receiver

Status: running

Time: {datetime.now().isoformat()}

File count: {len(files)}

Port: {RECEIVER_PORT}

Recent files

    {"".join(f'
  • {f.name} ({f.stat().st_size}B)
    • ' for f in files[:10])}
... """ ``` Authentication is applied only in the POST handler: ```python def do_POST(self): if not self._check_secret(): self._error("Unauthorized", 401) return if self.path == "/upload": self._handle_upload() elif self.path == "/message": self._handle_message() elif self.path == "/webhook": self._handle_webhook() else: self._error("Unknown path", 404) ``` ### Technical Analysis The authorization check is implemented exclusively in `do_POST()`. The `do_GET()` handler serves the status page and files without calling `_check_secret()`. This remains true ...[truncated 1521 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
receiver_server.py:167
Finding

Uploaded Filenames Cause Stored HTML Injection on the Status Page

Content
View full analysis
External Receiver

External Receiver

Status: running

Time: {datetime.now().isoformat()}

File count: {len(files)}

Port: {RECEIVER_PORT}

Recent files

    {"".join(f'
  • {f.name} ({f.stat().st_size}B)
    • ' for f in files[:10])}
... """ ``` ### Technical Analysis `os.path.basename()` only removes directory components. It does not make a filename safe for use in HTML text or an HTML attribute. Characters such as quotation marks, angle brackets, and ampersands remain attacker-controlled. The timestamp prefix does not neutralize the dangerous suffix. When the root status page is rendered, the uploaded name is inserted into both the anchor's `href` attribute and visible HTML without context-sensitive encoding. A crafted filename can terminate the attribute or element and insert new markup or script-capable content. The payload is stored on disk and remains active whenever the status page includes that file among the displayed entries. ### Attack Path 1. The attacker reaches the upload endpoint and, where req ...[truncated 1185 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
receiver_server.py:211
Finding

Unbounded Request Buffering Permits Memory and Disk Exhaustion

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill declares an HTTP receiver that reads environment variables, accepts network input, and writes uploaded files, but it does not declare any explicit tool scope or permissions. This weakens reviewability and consent because users cannot clearly see that the skill exposes network, file-write, and data-ingestion capabilities before installation or use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill is explicitly designed to expose an HTTP service that receives external files and messages and automatically forwards them into an OpenClaw session, yet the description does not prominently warn about privacy, prompt-injection, or untrusted-content risks. Because this creates a direct ingestion path from external actors into a user session, it can enable data poisoning, social engineering, or malicious content delivery.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

上传文件

bash
curl -X POST http://你的服务器:8080/upload \
  -F "file=@/path/to/file.txt"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md
import requests

# 发送消息
requests.post("http://服务器:8080/message", data={"text": "警报：价格突破"})

# 上传文件
with open("report.pdf", "rb") as f:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
import requests

# 发送消息
requests.post("http://服务器:8080/message", data={"text": "警报：价格突破"})

# 上传文件
with open("report.pdf", "rb") as f:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
import requests

# 发送消息
requests.post("http://服务器:8080/message", data={"text": "警报：价格突破"})

# 上传文件
with open("report.pdf", "rb") as f:

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
requests.post("http://服务器:8080/upload", files={"file": f})

# Webhook 方式
requests.post("http://服务器:8080/webhook", json={
    "event": "trade",
    "symbol": "BTC/USDT",
    "side": "buy",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This code performs a destructive file write by emptying the queue file after reading messages. Although the module docstring says it 'reads and clears' the queue, the function itself provides no runtime warning, confirmation, or visible logging when this irreversible action occurs, which can surprise callers and lead to data loss.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The code reads the local OpenClaw gateway configuration and authentication token, then uses that token to create its own push channel into local sessions. While likely intended for integration, it grants this HTTP-facing service the ability to inject content into local OpenClaw context, so any compromise or misuse of the receiver can pivot into the user's session.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill is described as a one-way external receiver, but it also exposes a browsable status page and a file download endpoint that expand it into a data-serving interface. This increases attack surface and can leak uploaded files and metadata to anyone who can reach the server, especially because GET routes are not protected by the shared secret.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The /download/ endpoint is reachable without authentication because secret checks are only applied in POST handlers. That allows any reachable client to retrieve uploaded files by name, and the status page helps enumerate recent filenames, turning this into a straightforward information disclosure issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

Incoming message and webhook contents are forwarded into OpenClaw via a queue file and attempted WebSocket push, but the code does not clearly disclose near these handlers that externally supplied data will be relayed onward. Since this is a network/data-transmission behavior affecting privacy and downstream handling, a user-facing warning or explicit comment/docstring should be present.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest description and the substantive instructions in the markdown are presented in Chinese, and the file does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate a language/locale policy when a specific language is imposed without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module docstring and user-visible CLI output are written only in Chinese, which imposes a specific language without any user opt-in or documented locale constraint. Under the policy, hard-coded language requirements should either provide a choice or clearly justify the locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The natural-language strings in the module docstring and operational messages are presented only in Chinese, with no indication that the user can select another language or locale. This can violate language/locale policy when a skill implicitly forces one language without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script's user-facing text is written in Chinese, including the title and runtime status/error messages. This imposes a specific language on all users without any opt-in, fallback, or documented region-specific justification, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.