Security audit

OpenClaw n8n Orchestrator

Security checks for vulnerabilities and agentic risk

Overview

The skill is broadly aligned with OpenClaw and n8n orchestration, but it includes risky deployment and agent-expansion guidance that deserves careful review before installation.

Review this skill before installing in a production agent. Remove pipe-to-shell installers, pin package and container versions, keep the OpenClaw Gateway bound to localhost or a private network only, use least-privilege gateway tokens, disable direct /tools/invoke unless strictly needed, and avoid the self-expanding MCP Builder, persistent memory, and vault-loading patterns unless you add explicit human approval, provenance, audit logs, and deletion controls.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: references/deployment.md:22
Finding: Unverified OpenClaw installer is piped directly into a shell
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: references/deployment.md:232
Finding: Unverified Tailscale installer is piped directly into a shell
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: references/n8n-claw-architecture.md:185
Finding: Untrusted conversation data can poison persistent agent memory
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/gateway-api.md:195
Finding: Gateway integration guidance recommends overprivileged roles and direct tool invocation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/validate_integration.py:110
Finding: Validator can transmit a webhook secret to an attacker-controlled URL
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: templates/docker-compose.yml:15
Finding: Deployment templates use mutable container tags and unpinned third-party components
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (43)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents an integration-building/deployment skill focused on creating and operating OpenClaw↔n8n workflows and proxy patterns. The supplied code instead performs validation and compliance checks: connectivity tests, webhook auth checks, OpenClaw skill packaging/frontmatter validation, and basic security linting of scripts. While this is related to the same ecosystem, its primary purpose is materially different from the declared one. The code also introduces a substantial undeclared capability—auditing local skill files and scanning scripts for policy/security issues—rather than implementing the described integration behavior.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
l directory** — not a loose file. OpenClaw skills are directories containing a `SKILL.md` with YAML frontmatter.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.
md
→ Security deep-dive, ClawHavoc analysis, safeguard nodes: [references/security.md](references/security.md)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 430)May include surrounding context.
md
→ Security deep-dive, ClawHavoc analysis, safeguard nodes: [references/security.md](references/security.md)

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: curl ... | bash executes remote code directly from the network without prior verification, pinning, or integrity checks. If the source server, DNS, TLS trust chain, or distribution path is compromised, operators could execute attacker-controlled code during installation.
Content: Scanner excerpt · references/deployment.md (reported line 22)May include surrounding context.
md
- **Node.js 22+** — required for all OpenClaw installations - **Docker** — recommended for production deployment - OpenClaw installed via `npm install -g openclaw@latest` or `curl -fsSL https://openclaw.ai/install.sh | bash` - Windows users: use WSL (native PowerShell is unstable per core maintainers) ## Co-located Docker Stack

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The example openclaw.json binds the Gateway to 0.0.0.0, which listens on all interfaces, while surrounding guidance says it should be localhost-only. In real deployments this can accidentally expose the agent API to the local network or wider internet depending on container/network configuration, undermining the intended credential-isolation model.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The Tailscale install command also uses a remote script piped directly to a shell, creating the same supply-chain and arbitrary code execution risk. In infrastructure documentation, such patterns are especially dangerous because they are likely to be copied verbatim into production environments.
Content: Scanner excerpt · references/deployment.md (reported line 234)May include surrounding context.
bash
# Install Tailscale on both OpenClaw host and n8n host curl -fsSL https://tailscale.com/install.sh | sh tailscale up # OpenClaw Gateway stays bound to localhost

Chaining Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The | sh construct turns fetched remote content into immediate command execution, which is a classic chaining pattern for supply-chain compromise. In a skill focused on agent orchestration and credential isolation, encouraging operators to run unaudited shell pipelines weakens the overall security posture and can lead to host takeover.
Content: Scanner excerpt · references/deployment.md (reported line 234)May include surrounding context.
bash
# Install Tailscale on both OpenClaw host and n8n host curl -fsSL https://tailscale.com/install.sh | sh tailscale up # OpenClaw Gateway stays bound to localhost

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This section describes autonomous web research plus LLM-generated integration code and programmatic workflow deployment, creating a self-expanding supply-chain and code-generation pathway. Even with a stated human credential-binding step, generating and registering new capabilities from researched documentation can introduce malicious or unsafe workflows, privilege expansion, and persistence in a system users may assume is only an orchestration proxy.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · references/publishing.md (reported line 141)May include surrounding context.
md
**Common rejection**: Script reaches `api.slack.com` but the table only lists the n8n webhook URL. ### 3. Install Mechanisms Flags any script containing secondary payload downloaders (`curl | bash` patterns, `wget` to unknown URLs). **Common rejection**: Post-install script downloads additional binaries.

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · references/security.md (reported line 46)May include surrounding context.
bash
# VULNERABLE — raw interpolation curl "https://api.com/${USER_INPUT}" # An attacker submits: $(rm -rf /) # The shell expands this to: curl "https://api.com/$(rm -rf /)"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/security.md (reported line 48)May include surrounding context.
VULNERABLE — raw interpolation

curl "https://api.com/${USER_INPUT}"

An attacker submits: $(rm -rf /)

The shell expands this to: curl "https://api.com/$(rm -rf /)"

Result: catastrophic filesystem deletion

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/security.md (reported line 49)May include surrounding context.
VULNERABLE — raw interpolation

curl "https://api.com/${USER_INPUT}"

An attacker submits: $(rm -rf /)

The shell expands this to: curl "https://api.com/$(rm -rf /)"

Result: catastrophic filesystem deletion

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/security.md (reported line 48)May include surrounding context.
VULNERABLE — raw interpolation

curl "https://api.com/${USER_INPUT}"

An attacker submits: $(rm -rf /)

The shell expands this to: curl "https://api.com/$(rm -rf /)"

Result: catastrophic filesystem deletion

text

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/security.md (reported line 49)May include surrounding context.
curl "https://api.com/${USER_INPUT}"

An attacker submits: $(rm -rf /)

The shell expands this to: curl "https://api.com/$(rm -rf /)"

Result: catastrophic filesystem deletion

text

External Script Fetching

High

Category: Supply Chain
Confidence: 90% confidence
Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
Content: Scanner excerpt · references/security.md (reported line 80)May include surrounding context.
md
| Pattern | Risk | Replacement | |---------|------|-------------| | `curl "url/${VAR}"` | Shell injection | URL-encode `VAR` first | | `echo ${DATA} \| jq` | Shell expansion | Use `printf '%s'` or `jq --arg` | | `eval "$USER_CMD"` | Arbitrary execution | Never use `eval` with external input | | Inline `$(...)` with user data | Command substitution | Sanitize before interpolation |

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/security.md (reported line 104)May include surrounding context.
md
### Why n8n Integration Mitigates ClawHavoc Even if a malicious skill executes on the OpenClaw host: - It cannot access credentials stored in n8n's encrypted vault - All external API calls route through n8n's inspectable pipeline — anomalous behavior is visible - Workflow locking prevents a compromised agent from redirecting data flows

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/validate_integration.py (reported line 341)May include surrounding context.
python
section("Dangerous File Check") results = [] dangerous = [".env", ".git"] for name in dangerous: if (skill_path / name).exists(): fail(f"'{name}' found — must be excluded from .skill package")

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · templates/docker-compose.yml (reported line 8)May include surrounding context.
yaml
# No ports exposed to public internet by default. # # Usage: # 1. Copy .env.example to .env and fill in values # 2. docker compose up -d # 3. Access n8n at http://localhost:5678 # 4. Gateway available at http://localhost:18789

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs the agent to use shell execution, environment variables, filesystem reads, and network access, but it does not declare any explicit tool scope such as allowed-tools or permissions. That omission weakens least-privilege controls and can let the skill be activated with broader capabilities than reviewers or runtime policy expect.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The top-level description contains very broad trigger phrases such as generic workflow automation, credential isolation, and gateway ingress. In systems where description text is the activation mechanism, broad phrasing can cause the skill to auto-activate in unrelated conversations, exposing shell/network-enabled instructions more often than intended.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 326)May include surrounding context.
Hard Constraints

NEVER store, log, or output API keys or webhook secrets in conversation

NEVER attempt to access n8n management API — only use webhook endpoints

NEVER execute shell commands that modify system files outside workspace/

If a webhook fails 3 consecutive times, STOP and alert the user

NEVER enter infinite retry loops on failed API calls

text

Session Persistence

Medium

Category: Rogue Agent
Confidence: 83% confidence
Finding: The SkillPointer pattern directs the agent to dynamically discover and load skills from a persistent vault path in the user's home directory. That creates a session-persistent expansion mechanism where unreviewed or stale skills outside the normal active scan path may influence future behavior, increasing the chance of unauthorized capability loading or prompt-surface growth.
Content: Scanner excerpt · SKILL.md (reported line 356)May include surrounding context.

Move individual webhook skills to a vault directory outside the agent's scan path: ~/.openclaw/vault/n8n-webhooks/

Create a single lightweight pointer skill in the active directory:

yaml
---

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The pointer skill example uses an extremely broad activation phrase, effectively matching nearly any request involving n8n workflows or webhooks. Because it then instructs the agent to browse a vault directory and dynamically load other skills, unintended activation can expand the reachable instruction set and increase exposure to risky capabilities.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document explicitly states the Gateway must never be exposed to the public internet, then suggests publishing it via a Cloudflare Tunnel URL. Even if Cloudflare provides some access controls, this still creates an internet-reachable path to a sensitive agent API and contradicts the stated trust boundary, increasing the chance of unauthorized access, scanning, or token abuse.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T03 · Remote Payload Retrieval and Execution

T02 · Agent Memory Poisoning

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

SkillSpector

Tp4

Ae1

Ae1

Ae1

External Script Fetching

Intent-Code Divergence

External Script Fetching

Chaining Abuse

Context-Inappropriate Capability

External Script Fetching

External Script Fetching

Tool Parameter Abuse

VULNERABLE — raw interpolation

An attacker submits: $(rm -rf /)

The shell expands this to: curl "https://api.com/$(rm -rf /)"

Result: catastrophic filesystem deletion

Tool Parameter Abuse

VULNERABLE — raw interpolation

An attacker submits: $(rm -rf /)

The shell expands this to: curl "https://api.com/$(rm -rf /)"

Result: catastrophic filesystem deletion

Tool Parameter Abuse

VULNERABLE — raw interpolation

An attacker submits: $(rm -rf /)

The shell expands this to: curl "https://api.com/$(rm -rf /)"

Result: catastrophic filesystem deletion

Tool Parameter Abuse

An attacker submits: $(rm -rf /)

The shell expands this to: curl "https://api.com/$(rm -rf /)"

Result: catastrophic filesystem deletion

External Script Fetching

Credential Access

Credential Access

Credential Access

Undeclared Tool Scope

Vague Triggers

Sudo/Root Execution

Hard Constraints

Session Persistence

Vague Triggers

Intent-Code Divergence

Static analysis