ClawHub
Back to skill

Security audit

ClawOrchestrate

Security checks for vulnerabilities and agentic risk

Overview

ClawOrchestrate looks like a real remote agent orchestration skill, but it needs review because it creates a network-accessible agent dispatch surface with weak or inconsistent hardening guidance and optional persistence.

Install only if you intentionally want a remote service that can start OpenClaw agents on other machines. Bind it to localhost or a private Tailscale interface, set a strong API key, avoid the `changeme` fallback, do not expose port 9876 publicly, prefer SSH tunneling or HTTPS/Tailscale-only transport, and inspect or modify the systemd installer before enabling a persistent service.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill documentation describes network dispatching, remote command execution, file transfer, and service installation, but the manifest declares no permissions. This creates a trust and review gap: users and tooling are not warned that the skill can read files, write files, invoke shells, and communicate over the network, which increases the chance of unsafe deployment.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding
The documented behavior does not fully match the described purpose: it installs persistent services, exposes additional HTTP endpoints, and omits limitations such as lack of real progress monitoring. Behavior mismatches are dangerous because they hide operational and security-relevant capabilities from reviewers, especially when the skill can run continuously and receive remote instructions.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The script is labeled as 'Secure' while it transmits an authorization bearer token and message body over plain HTTP to remote hosts. That mismatch is dangerous because operators may trust the script's safety claims and use it on networks where traffic can be intercepted, monitored, or modified by an attacker with network access.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README promotes a design where remote machines run an HTTP dispatcher that accepts task messages and causes agents to execute them, but it provides no warning about authentication, authorization, transport security, or network exposure. In an orchestration skill, this omission is dangerous because operators may deploy a remotely reachable command channel that can be abused for unauthorized task injection and remote control of agents.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The quick-start instructions tell users to launch a background dispatcher and immediately send HTTP task payloads, but they omit any setup for auth, TLS, interface binding, or access restrictions. Because the documented purpose is cross-machine orchestration of agents, readers are likely to copy an insecure deployment pattern that exposes a remote command surface to anyone who can reach the port.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The script sends both the bearer token and dispatched message contents over plain HTTP, which exposes authentication material and task data to anyone able to observe or tamper with traffic on the path. In an orchestration tool, stolen tokens could allow unauthorized task dispatch across multiple agents, amplifying the impact beyond a single host.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The service exposes an authenticated remote endpoint that immediately starts local agent subprocesses from network-supplied input, with no approval gate, queue review, or policy enforcement. In this skill context, the whole purpose is remote orchestration across machines, so any API key compromise, misuse by an authorized caller, or SSRF-style access from a trusted network can turn the dispatcher into a remote code/task execution pivot across hosts.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script creates a user-level systemd service and immediately enables and starts it, causing persistent background execution without any interactive confirmation, dry-run mode, or warning about the persistence change. In an agent-orchestration skill, this is security-relevant because it establishes long-lived execution on remote machines and can surprise operators or be abused if the dispatched code later becomes unsafe.

External Transmission

Medium
Category
Data Exfiltration
Content
ssh user@remote "nohup python3 ~/.openclaw/dispatcher.py &"

# 2. Send tasks from gateway
curl -X POST http://remote-ip:9876/dispatch \
  -d '{"agent":"my-agent","message":"Start building."}'

# 3. Broadcast to all machines
Confidence
90% confidence
Finding
The documented curl command transmits agent names and task messages over plain HTTP to a remote dispatcher. If used across an untrusted network, those instructions encourage cleartext transmission and an easily tampered request path, enabling interception, modification, or replay of orchestration commands.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Dispatch to an agent
curl -X POST http://remote-ip:9876/dispatch \
  -H 'Content-Type: application/json' \
  -d '{"agent":"byondedu-ceo","message":"Read TASKS.md and start building."}'
Confidence
91% confidence
Finding
The skill sends task content over HTTP to a remote machine, which is an external transmission channel. Even if intended for private networks such as Tailscale, transmitting instructions and potentially sensitive task data to remote hosts expands the attack surface and can expose data if the network assumptions are wrong or the remote endpoint is compromised.

Session Persistence

Medium
Category
Rogue Agent
Content
EOF

systemctl --user daemon-reload
systemctl --user enable agent-dispatcher
systemctl --user start agent-dispatcher
```
Confidence
94% confidence
Finding
Enabling a user systemd service creates persistence, causing the dispatcher to restart automatically and remain available after logout or reboot. Persistence is security-relevant because a misconfigured or vulnerable dispatcher becomes a standing remote-control surface rather than a one-time tool.

Session Persistence

Medium
Category
Rogue Agent
Content
- `scripts/dispatcher.py` — The HTTP server (run on remote machines)
- `scripts/dispatch-all.sh` — Broadcast script (run on gateway)
- `scripts/setup-service.sh` — Systemd service installer
- `docs/ARCHITECTURE.md` — Full architecture details
- `docs/SECURITY.md` — Security hardening guide
Confidence
84% confidence
Finding
Referencing a systemd service installer in the file list confirms that the skill includes functionality for persistent installation. While persistence can be legitimate for an orchestrator, it materially increases risk because it encourages long-lived background services that may be forgotten and left exposed.

Session Persistence

Medium
Category
Rogue Agent
Content
scp scripts/dispatcher.py user@remote-host:~/.openclaw/dispatcher.py

# Start the dispatcher
ssh user@remote-host "nohup python3 ~/.openclaw/dispatcher.py &"
```

### 2. Send tasks from your gateway machine (PC1)
Confidence
90% confidence
Finding
Starting the dispatcher with nohup in the background creates ad hoc persistence outside normal session control and monitoring. This can leave a network service running without supervision, authentication review, or clear ownership, making accidental exposure or misuse more likely.

Static analysis

No suspicious patterns detected.