Security audit

Docker官网镜像拉取能力

Security checks for vulnerabilities and agentic risk

Overview

The skill's Docker image sync purpose is coherent, but it asks OpenClaw to handle and persist powerful GitHub and CNB tokens in risky ways.

Review before installing. Prefer gh auth login and do not paste GitHub or CNB tokens into chat. If you use this skill, create short-lived, narrowly scoped tokens, avoid broad repo tokens, store secrets outside shared plaintext files when possible, rotate any token previously pasted into OpenClaw, and inspect the pushed GitHub Actions workflow before running it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:274
Finding: Insecure Collection and Broad Plaintext Storage of Access Tokens
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: cnb-pull.sh:180
Finding: GitHub Token Exposed Through Clone URLs and Temporary Git Metadata
Content: View full analysis
/dev/null mkdir -p "$TEMP_DIR/.github/workflows" cp "$WORKFLOW_DIR"/docker-image-sync.yml "$TEMP_DIR/.github/workflows/docker-image-sync.yml" cd "$TEMP_DIR" git config user.email "automation@openclaw" git config user.name "OpenClaw CNB Sync" git add . ``` `cnb-pull.sh:265-281`: ```bash GH_USER=$(gh api user --jq '.login' 2>&1) REPO_NAME="cnb-docker-sync" REPO_FULL="${GH_USER}/${REPO_NAME}" local GIT_TOKEN="${GITHUB_TOKEN}" TEMP_DIR=$(mktemp -d) info "克隆仓库（私有仓库）..." git clone --depth 1 --branch main "https://x-access-token:${GIT_TOKEN}@github.com/${REPO_FULL}.git" "$TEMP_DIR" 2>/dev/null echo "${REMOTE_IMAGE}:${REMOTE_TAG}" > "$TEMP_DIR/$IMAGES_FILE" info "更新 images.txt: ${REMOTE_IMAGE}:${REMOTE_TAG}" cd "$TEMP_DIR" git config user.email "automation@openclaw" git config user.name "OpenClaw CNB Sync" git add "$IMAGES_FILE" git commit -m "代理同步: ${REMOTE_IMAGE}:${REMOTE_TAG}" ``` ### Technical Analysis The script embeds `GITHUB_TOKEN` directly into an HTTPS Git remote URL. This causes the credential to cross two additional exposure boundaries: 1. The complete URL may be visible in local process inspection while `git clone` is running. 2. Git commonly records the authenticated origin URL in the cloned repository's `.git/config`, leaving a plaintext token in the temporary directory. Although the script ...[truncated 1866 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: workflow/docker-image-sync.yml:17
Finding: GitHub Actions Dependencies Use Mutable Version Tags
Content: View full analysis
Remediation: View remediation
``` 2. Preserve the human-readable release in a comment beside each pinned SHA. 3. Use Dependabot or an equivalent update mechanism to propose and review action SHA updates. 4. Remove `docker/setup-buildx-action` if Buildx is not required by the workflow, reducing the dependency surface. 5. Add an explicit least-privilege workflow permission declaration, such as: ```yaml permissions: contents: read ``` 6. Restrict the CNB token to the single destination registry repository and only the push operations required by this workflow. 7. Review action provenance and release attestations before updating pinned commits. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (35)

Credential Access

High

Category: Privilege Escalation
Confidence: 92% confidence
Finding: The skill tells the user they may provide a GitHub Personal Access Token to OpenClaw. Having the agent receive a token with repository, secrets, and workflow permissions creates significant credential-handling risk and broadens the blast radius if the token is exposed.
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
text
- **已登录** → 自动创建私有仓库 `cnb-docker-sync`（**默认私有，不会暴露镜像名**） - **未登录** → 运行 `gh auth login` 在终端登录，或提供 GitHub Personal Access Token 给 openclaw > Token 获取路径：GitHub → Settings → Developer settings → Personal access tokens → Generate new token >

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
- **已登录** → 自动创建私有仓库 `cnb-docker-sync`（**默认私有，不会暴露镜像名**） - **未登录** → 运行 `gh auth login` 在终端登录，或提供 GitHub Personal Access Token 给 openclaw > Token 获取路径：GitHub → Settings → Developer settings → Personal access tokens → Generate new token > > **推荐方式（不过用户手）：** > 运行 `gh auth login`，走设备码流程登录，token 自动由 `gh` 管理，无需用户复制粘贴

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 221)May include surrounding context.
md
- **已登录** → 自动创建私有仓库 `cnb-docker-sync`（**默认私有，不会暴露镜像名**） - **未登录** → 运行 `gh auth login` 在终端登录，或提供 GitHub Personal Access Token 给 openclaw > Token 获取路径：GitHub → Settings → Developer settings → Personal access tokens → Generate new token > > **推荐方式（不过用户手）：** > 运行 `gh auth login`，走设备码流程登录，token 自动由 `gh` 管理，无需用户复制粘贴

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Although framed as minimal scope, the skill still instructs users to create a fine-grained token that can read/write contents, secrets, and workflows for a repository. Those permissions are powerful, and if the agent handles the token directly, compromise could enable repository tampering, secret manipulation, and workflow abuse.
Content: Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.
md
> 运行 `gh auth login`，走设备码流程登录，token 自动由 `gh` 管理，无需用户复制粘贴 > > **如果必须提供 Token（细粒度最小权限）：** > 创建 Fine-grained Personal Access Token，限制到**仅 `cnb-docker-sync` 仓库**，权限： > - `Contents: read and write`（读写仓库，触发 workflow） > - `Secrets: read and write`（设置 Repository Secrets） > - `Workflows: read and write`（触发 Actions）

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.
md
#### 2.4 获取 CNB_TOKEN 在制品库页面，找到**访问令牌**或 **Access Token** 配置，创建一个访问令牌（用于拉取凭证）。 ### 第三步：提供参数给 openclaw

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.
md
#### 2.4 获取 CNB_TOKEN 在制品库页面，找到**访问令牌**或 **Access Token** 配置，创建一个访问令牌（用于拉取凭证）。 ### 第三步：提供参数给 openclaw

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill explicitly asks the user to send a CNB access token directly to the agent in chat. Sending secrets through chat increases the chance of credential exposure via logs, transcripts, model retention, plugins, or downstream tooling, and the skill also plans to persist that secret for reuse.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill instructs the user to paste CNB_TOKEN into chat and states that OpenClaw will write it to ~/.openclaw/.env and reuse it later. This creates both exposure risk during transmission and persistence risk after storage, making compromise of the chat system or local environment materially more damaging.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 92% confidence
Finding: The English section repeats the instruction to provide a GitHub Personal Access Token to the agent. Because the token enables repository operations and secret management, direct submission to the agent meaningfully increases credential exposure risk.
Content: Scanner excerpt · SKILL.md (reported line 219)May include surrounding context.
text
- **Logged in** → Automatically creates private repo `cnb-docker-sync` (**private by default, image names not exposed**) - **Not logged in** → Run `gh auth login` in terminal, or provide a GitHub Personal Access Token to openclaw > Token path: GitHub → Settings → Developer settings → Personal access tokens → Generate new token >

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The documentation again authorizes creation of a powerful fine-grained token for agent-driven automation. Even with limited repository scope, the permissions include workflows and secrets, so exposure could let an attacker alter CI behavior, tamper with images, or exfiltrate stored secrets.
Content: Scanner excerpt · SKILL.md (reported line 227)May include surrounding context.
md
> Run `gh auth login` — device flow, token managed by `gh`, no copy-paste needed > > **If you must provide a Token (fine-grained, minimal scope):** > Create a Fine-grained Personal Access Token limited to the **`cnb-docker-sync` repo only**, permissions: > - `Contents: read and write` (commit/push to trigger workflow) > - `Secrets: read and write` (set Repository Secrets) > - `Workflows: read and write` (trigger Actions)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.
md
#### 2.4 Get CNB_TOKEN In the CNB registry page, find **访问令牌** (Access Token) configuration, create an access token for pull authentication. ### Step 3 — Provide Parameters to openclaw

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 330)May include surrounding context.
md
#### 2.4 Get CNB_TOKEN In the CNB registry page, find **访问令牌** (Access Token) configuration, create an access token for pull authentication. ### Step 3 — Provide Parameters to openclaw

Credential Access

High

Category: Privilege Escalation
Confidence: 98% confidence
Finding: This section explicitly asks the user to reply with the CNB access token value, including an example token format. Soliciting secrets in normal chat is dangerous because it exposes credentials to transcript storage, logs, and any system that processes the conversation.
Content: Scanner excerpt · SKILL.md (reported line 278)May include surrounding context.
md
| Parameter | Description | Example | |-----------|-------------|---------| | `CNB_TOKEN` | CNB access token | `8B76Bopie1d966fVDMgJnhFRepZ` | | `CNB_REGISTRY` | CNB registry address (fixed value) | `docker.cnb.cool` | | `CNB_REPO_SLUG` | CNB namespace (lowercase) | `lufei123/lufei-docker` | | `CNB_GITHUB_REPO` | Private repo address (format: `your-github-username/cnb-docker-sync`) | `your-github-username/cnb-docker-sync` |

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · cnb-pull.sh (reported line 5)May include surrounding context.
sh
# Docker官网镜像拉取能力 # # 安全特性： # ✅ .env 加载：无 shell source，使用 IFS 逐行解析，避免注入 # ✅ workflow 内嵌：不在制品内的是用户自建私有仓库 # ✅ 默认私有仓库：不在制品内的是用户自建私有仓库，镜像名不暴露 #

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · cnb-pull.sh (reported line 29)May include surrounding context.
sh
# Docker官网镜像拉取能力 # # 安全特性： # ✅ .env 加载：无 shell source，使用 IFS 逐行解析，避免注入 # ✅ workflow 内嵌：不在制品内的是用户自建私有仓库 # ✅ 默认私有仓库：不在制品内的是用户自建私有仓库，镜像名不暴露 #

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · cnb-pull.sh (reported line 31)May include surrounding context.
sh
# ─── 加载环境变量（安全解析，无 shell source）──────────── # 解析 .env 文件，仅提取技能需要的变量，避免注入风险 load_env() { local env_file="$HOME/.openclaw/.env" if [[ ! -f "$env_file" ]]; then return 0 # 文件不存在，继续用默认值 fi

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The script explicitly tells the user to provide a GitHub Personal Access Token to the agent so it can configure GITHUB_TOKEN. In an agent-skill context, instructing users to hand over a broad-scope PAT materially increases credential theft and misuse risk, because the token can grant repository and workflow control far beyond the immediate task and may traverse or be stored in systems the user does not expect.
Content: Scanner excerpt · cnb-pull.sh (reported line 106)May include surrounding context.
sh
echo "" echo "请选择以下方式之一解决：" echo " 1. 运行 'gh auth login' 在终端登录（推荐）" echo " 2. 提供 GitHub Personal Access Token 给 openclaw，我会帮你配置 GITHUB_TOKEN" echo "" echo "获取 Token 路径：GitHub → Settings → Developer settings → Personal access tokens → Generate new token" echo "所需权限：repo (全部) + workflow"

Credential Access

High

Category: Privilege Escalation
Confidence: 95% confidence
Finding: This line reinforces the PAT collection flow and recommends generating access tokens with broad repo and workflow permissions. In this skill context, that is especially dangerous because the same script later uses the token for authenticated git clone/push and secret management, meaning compromise of the token can lead to repository takeover, workflow abuse, and exposure of synchronized image metadata or further secrets.
Content: Scanner excerpt · cnb-pull.sh (reported line 108)May include surrounding context.
sh
echo " 1. 运行 'gh auth login' 在终端登录（推荐）" echo " 2. 提供 GitHub Personal Access Token 给 openclaw，我会帮你配置 GITHUB_TOKEN" echo "" echo "获取 Token 路径：GitHub → Settings → Developer settings → Personal access tokens → Generate new token" echo "所需权限：repo (全部) + workflow" exit 1 fi

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 75% confidence
Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.
md
**openclaw 收到后会帮你完成以下操作：** 1. 写入 `~/.openclaw/.env`（注意：请保持该文件可信，`chmod 600 ~/.openclaw/.env`） 2. 自动创建私有仓库 `你的用户名/cnb-docker-sync`（如不存在） 3. 将 **内嵌的 GitHub Actions workflow** 推送到你的私有仓库（workflow 代码来自技能制品，透明可查） 4. 将 `CNB_REGISTRY`、`CNB_REPO_SLUG_LOWERCASE`、`CNB_TOKEN` 设置到私有仓库的 Repository Secrets

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.
md
**openclaw 收到后会帮你完成以下操作：** 1. 写入 `~/.openclaw/.env`（注意：请保持该文件可信，`chmod 600 ~/.openclaw/.env`） 2. 自动创建私有仓库 `你的用户名/cnb-docker-sync`（如不存在） 3. 将 **内嵌的 GitHub Actions workflow** 推送到你的私有仓库（workflow 代码来自技能制品，透明可查） 4. 将 `CNB_REGISTRY`、`CNB_REPO_SLUG_LOWERCASE`、`CNB_TOKEN` 设置到私有仓库的 Repository Secrets

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 285)May include surrounding context.
md
**openclaw 收到后会帮你完成以下操作：** 1. 写入 `~/.openclaw/.env`（注意：请保持该文件可信，`chmod 600 ~/.openclaw/.env`） 2. 自动创建私有仓库 `你的用户名/cnb-docker-sync`（如不存在） 3. 将 **内嵌的 GitHub Actions workflow** 推送到你的私有仓库（workflow 代码来自技能制品，透明可查） 4. 将 `CNB_REGISTRY`、`CNB_REPO_SLUG_LOWERCASE`、`CNB_TOKEN` 设置到私有仓库的 Repository Secrets

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 302)May include surrounding context.
md
**openclaw 收到后会帮你完成以下操作：** 1. 写入 `~/.openclaw/.env`（注意：请保持该文件可信，`chmod 600 ~/.openclaw/.env`） 2. 自动创建私有仓库 `你的用户名/cnb-docker-sync`（如不存在） 3. 将 **内嵌的 GitHub Actions workflow** 推送到你的私有仓库（workflow 代码来自技能制品，透明可查） 4. 将 `CNB_REGISTRY`、`CNB_REPO_SLUG_LOWERCASE`、`CNB_TOKEN` 设置到私有仓库的 Repository Secrets

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 205)May include surrounding context.
md
When `hub.docker.com` is unreachable, this skill proxies through GitHub Actions: 1. Modify `images.txt` in the GitHub repo — **clear all entries, write only the target image** 2. Push to trigger GitHub Actions sync to CNB 3. Wait for Actions completion 4. Pull the image from CNB to local