ClawHub
Back to skill

Security audit

Lerwee Docker Lwops Deployer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real Docker deployment helper, but it can make privileged host changes and start a privileged remote container even when the request looks read-only.

Review this carefully before installing. Use only on an isolated host where privileged containers and Docker service changes are acceptable. Do not follow the NOPASSWD: ALL guidance, avoid exposing the published ports to untrusted networks, and require an explicit deploy action with a pinned and verified image before running it.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)

T03 · Remote Payload Retrieval and Execution

Error
Location
lib/docker-utils.sh:201
Finding

Unpinned Remote Container Image Executed with Host-Equivalent Privileges

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Warning
Location
lib/docker-utils.sh:181
Finding

Docker Service Is Persistently Enabled Without Explicit Consent

Content
View full analysis
/dev/null 2>&1 return 0 } ``` ### Technical Analysis The Skill enables Docker as a boot-time system service every time it ensures that Docker is running. Starting Docker for the current deployment does not inherently require modifying the host's persistent startup configuration. This operation is performed without a dedicated option or explicit confirmation. It also suppresses all output from `systemctl enable`, preventing users from seeing whether the persistence operation succeeded or failed. Docker is a privileged system daemon. Keeping it enabled after the Skill run permanently increases the host's attack surface, particularly when the deployment was intended only for temporary development or testing. ### Attack Path 1. A user invokes the Skill for a one-time deployment or status-related request. 2. Execution reaches `ensure_docker_running`. 3. The Skill runs `sudo systemctl enable docker`. 4. Docker is registered to start automatically on future boots. 5. The privileged daemon continues to exist across sessions and reboots even after the immediate task is complete. ### Impact Assessment The operation creates persistent system-level state and causes a privileged daemon to survive the Skill run. This may: - Increase long-term host attack surface. - Violate temporary or ephemeral deployment expectations. - Conflict with host administration policies. - Leave Docker active after the Skill itself is removed. - Permit Docker-managed containers configured with restart policies elsewhere to return after reboot. The persistence is related to the deployment function ...[truncated 128 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
execute.sh:43
Finding

Natural-Language Intent Is Ignored and Read-Only Requests Trigger Deployment

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
INSTALL.md:323
Finding

Documentation Recommends Permanent Root-Equivalent Account Access

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
lib/docker-utils.sh:252
Finding

Container Services Are Published on All Host Network Interfaces

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
lib/lock-utils.sh:8
Finding

Predictable Shared Temporary Lock Permits Local Deployment Denial of Service

Content
View full analysis
"$LOCK_FILE" ) 2>/dev/null; then return 0 else return 1 fi } ``` ```bash release_lock() { rm -f "$LOCK_FILE" 2>/dev/null return 0 } ``` ### Technical Analysis The lock uses a globally predictable path beneath `/tmp`. The code does not create the directory with restrictive permissions, verify directory ownership, reject symbolic links, or ensure that the lock being removed belongs to the current process. A local user can pre-create the directory or lock file. A live PID belonging to an unrelated process can cause the Skill to report that deployment is in progress. Directory ownership and permission manipulation can also prevent legitimate lock creation. The audit did not confirm a reliable privileged arbitrary-file overwrite through this code because the lock is created before privileged Docker operations and `noclobber` is used. The confirmed issue is local denial of service and unreliable lock ownership. ### Attack Path 1. A local attacker creates `/tmp/docker-lwops-deployer/deploy.lock`. 2. The attacker writes the PID of a long-running process into the file. 3. A victim invokes the Skill. 4. `get_lock_status` or `acquire_lock_with_timeout` sees the process as active. 5. The Skill refuses deployment or waits until timeout. 6. The attacker recreates the file as needed to maintain the denial of service. ### Impact Assessment The vulnerability can: - ...[truncated 374 chars]
Remediation
View remediation
"$XDG_RUNTIME_DIR/docker-lwops-deployer.lock" flock -n 9 || exit 1 ``` 5. Verify ownership and mode before using any existing lock directory. 6. Do not remove a lock merely because a PID appears inactive; PID reuse can make PID-file checks unreliable. 7. Ensure cleanup only releases the lock held by the current process. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (136)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 280)May include surrounding context.

手动卸载：

bash
rm -rf ~/.openclaw/skills/docker-lwops-deployer

3. 清理配置（可选）

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 280)May include surrounding context.

手动卸载：

bash
rm -rf ~/.openclaw/skills/docker-lwops-deployer

3. 清理配置（可选）

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The document explicitly recommends granting the current user NOPASSWD: ALL sudo access, which is a major privilege expansion unrelated to the narrow need of deploying a local Docker container. If followed, any process running as that user can execute arbitrary root commands without authentication, greatly increasing the blast radius of compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Recommending passwordless sudo without a strong warning normalizes a dangerous configuration that effectively removes an important privilege boundary. In the context of an automation skill, this makes accidental or malicious command execution as root significantly easier.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The pipeline writes an unrestricted sudoers rule directly into /etc/sudoers.d/$USER using elevated privileges, creating a powerful chained privilege-escalation setup. In this deployment-skill context, chaining shell output into privileged file creation is especially dangerous because it normalizes persistent root-equivalent access for convenience.

Content

Scanner excerpt · INSTALL.md (reported line 329)May include surrounding context.

  1. 配置 sudo 无密码（推荐用于自动化）：
bash
echo "$USER ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/$USER
sudo chmod 440 /etc/sudoers.d/$USER

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · INSTALL.md (reported line 406)May include surrounding context.

  1. 如果确认没有其他部署，手动删除锁：
bash
rm -f /tmp/docker-lwops-deployer/deploy.lock
  1. 检查是否有僵尸进程：

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The README documents running the container with --privileged and mounting /sys/fs/cgroup with read-write access under cgroup v2, but does not provide a strong security warning about the host-compromise risk. In this context, these settings materially reduce container isolation and can enable container escape or broad host manipulation if the image is compromised or misbehaves.

Content

No source excerpt is available for this finding.

Privileged Container / Container Escape

High
Category
Privilege Escalation
Confidence
99% confidence
Finding

The README explicitly documents running the service container with --privileged. In a deployment skill pulling remote images, this is especially dangerous because it grants the container near-host-level access and greatly increases the consequences of a malicious or compromised image.

Content

Scanner excerpt · README.md (reported line 273)May include surrounding context.

md
### 容器配置

- **容器名称**: `lwops_rocky8_image_8.1`
- **启动参数**: `--privileged`（特权模式）
- **cgroup 挂载**: `/sys/fs/cgroup:/sys/fs/cgroup:ro`（v1）或 `:rw`（v2）
- **启动命令**: `/usr/sbin/init`

Privileged Container / Container Escape

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The troubleshooting guidance tells users to ensure --privileged is used, reinforcing an insecure deployment pattern instead of minimizing privileges. This normalizes a high-risk configuration and can lead users to weaken isolation unnecessarily to make the container work.

Content

Scanner excerpt · README.md (reported line 304)May include surrounding context.

md
**解决方案**:
1. 检查 Docker 日志：`sudo docker logs lwops_rocky8_image_8.1`
2. 检查 cgroup 版本兼容性
3. 确保使用 `--privileged` 参数

### 问题 4：无法访问容器服务

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The piped command writes a NOPASSWD sudoers rule, combining shell piping with privileged file modification to establish durable elevated access. This is not just documentation of admin behavior; it is a direct instruction to weaken privilege boundaries in a way that could be abused by any later code execution under that user account.

Content

Scanner excerpt · README.md (reported line 322)May include surrounding context.

md
**解决方案**:
1. 使用 sudo 运行命令
2. 将用户添加到 sudo 组：`sudo usermod -aG sudo $USER`
3. 配置 sudo 无密码：`echo "$USER ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/$USER`

## 📚 相关文档

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill appears to act mainly as a wrapper around another script while presenting itself as a transparent one-click Docker deployment tool. That indirection reduces auditability and can conceal privileged or destructive operations from users, making trust decisions based on the README unsafe.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill appears to act mainly as a wrapper around another script while presenting itself as a transparent one-click Docker deployment tool. That indirection reduces auditability and can conceal privileged or destructive operations from users, making trust decisions based on the README unsafe.

Content

No source excerpt is available for this finding.

Privileged Container / Container Escape

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The skill specifies running the container with --privileged, which grants broad device and kernel-interface access and sharply reduces Docker isolation. Combined with cgroup mounting and an externally sourced image, this can expose the host to container escape, persistence, or full-system compromise if the container is malicious or exploited.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md
### 容器配置

- **容器名称**：`lwops_rocky8_image_8.1`
- **启动参数**：`--privileged`（特权模式）
- **cgroup 挂载**：`/sys/fs/cgroup:/sys/fs/cgroup:ro`（v1）或 `:rw`（v2）
- **启动命令**：`/usr/sbin/init`

Privileged Container / Container Escape

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The troubleshooting guidance tells users to ensure --privileged is used, normalizing an unsafe configuration as the default fix. This increases the chance that users deploy an overprivileged container even when a narrower, safer configuration might work, amplifying host-compromise risk.

Content

Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.

md
**解决方案**：
1. 检查 Docker 日志：`docker logs lwops_rocky8_image_8.1`
2. 检查 cgroup 版本兼容性
3. 确保使用 `--privileged` 参数

### 问题 4：无法访问容器服务

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · execute.sh (reported line 115)May include surrounding context.

sh
if ! acquire_lock_with_timeout 300; then
        local suggestions='[
            "检查是否有僵尸进程占用锁",
            "手动删除锁文件: rm -f /tmp/docker-lwops-deployer/deploy.lock",
            "等待几分钟后重试"
        ]'
        output_error "LockTimeout" "获取部署锁超时，可能存在死锁" "$suggestions"

Chaining Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

The script recommends piping a sudoers rule into 'sudo tee' to grant the current user passwordless root access for all commands. This is a classic privilege-expansion pattern that can permanently lower system security and greatly increase the blast radius of any later account compromise.

Content

Scanner excerpt · execute.sh (reported line 155)May include surrounding context.

sh
output_progress "检查权限..."

    if ! require_root; then
        local suggestions='["使用 sudo 运行此脚本", "将用户添加到 sudo 组: sudo usermod -aG sudo \$USER", "配置 sudo 无密码: echo \"\$USER ALL=(ALL) NOPASSWD: ALL\" | sudo tee /etc/sudoers.d/\$USER"]'
        output_error "PermissionDenied" "需要 sudo 权限来安装和管理 Docker" "$suggestions"
        exit 1
    fi

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/docker-utils.sh (reported line 38)May include surrounding context.

sh
}

    # 添加 Docker 官方 GPG 密钥
    sudo mkdir -p /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg || {
        echo "无法添加 Docker GPG 密钥"
        return 1

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/docker-utils.sh (reported line 39)May include surrounding context.

sh
}

    # 添加 Docker 官方 GPG 密钥
    sudo mkdir -p /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg || {
        echo "无法添加 Docker GPG 密钥"
        return 1

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · lib/docker-utils.sh (reported line 46)May include surrounding context.

sh
}

    # 添加 Docker 官方 GPG 密钥
    sudo mkdir -p /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg || {
        echo "无法添加 Docker GPG 密钥"
        return 1

Chaining Abuse

High
Category
Tool Misuse
Confidence
86% confidence
Finding

Piping network-fetched content directly into a privileged command bypasses an opportunity to validate the downloaded material before it affects system trust configuration. In this context the content becomes a repository signing key, so compromise of the source or transport could enable installation of attacker-controlled packages later.

Content

Scanner excerpt · lib/docker-utils.sh (reported line 39)May include surrounding context.

sh
# 添加 Docker 官方 GPG 密钥
    sudo mkdir -p /etc/apt/keyrings
    curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg || {
        echo "无法添加 Docker GPG 密钥"
        return 1
    }

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · lib/docker-utils.sh (reported line 47)May include surrounding context.

sh
# 设置 Docker 仓库
    echo \
      "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
      $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null || {
        echo "无法设置 Docker 仓库"
        return 1
    }

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · lib/docker-utils.sh (reported line 125)May include surrounding context.

sh
echo "正在为 Arch Linux 系统安装 Docker..."

    # 安装 Docker
    sudo pacman -S --noconfirm docker || {
        echo "无法安装 Docker"
        return 1
    }

Privileged Container / Container Escape

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The script launches the container with --privileged and additionally mounts /sys/fs/cgroup from the host, effectively collapsing many container isolation boundaries. In a deployment tool that may pull mutable remote images, this creates a realistic path to host compromise or container escape if the image is malicious or later becomes compromised.

Content

Scanner excerpt · lib/docker-utils.sh (reported line 254)May include surrounding context.

sh
# 启动容器
    if sudo docker run -d \
        --name "$container_name" \
        --privileged \
        -p "${host_port1}:80" \
        -p "${host_port2}:8081" \
        --hostname "$container_name" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation says the skill will automatically install Docker if absent, but does not clearly foreground that this performs privileged package installation and system-level changes. Users may invoke the skill without understanding it can modify repositories, packages, services, and daemon state on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The uninstall section includes forceful deletion commands such as docker rm -f, docker rmi, and rm -rf without an explicit warning about data loss or irreversible removal. Users may destroy containers, images, and local skill files without realizing recovery may be difficult or impossible.

Content

No source excerpt is available for this finding.