Security audit

Openclaw Deploy

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its deployment purpose but gives broad access to local OpenClaw data and remote systems with weak safety controls and overstated security assurances.

Install only if you are comfortable auditing and operating shell deployment tooling. Before use, avoid packaging workspace memory or custom skills unless you intend to share them, inspect archives before deploying, prefer backup/update modes over cover, verify host keys and deployment packages independently, and do not run the included tests on a non-disposable system with privileges that can modify installed tools.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (6)

T03 · Remote Payload Retrieval and Execution

Error

Location: build/full/full_builder.sh:113
Finding: Unverified Remote Docker Installer Is Downloaded and Executed
Content: View full analysis
/dev/null; then if [ "$(uname)" = "Linux" ]; then log "🐳 安装 Docker..." curl -fsSL https://get.docker.com -o /tmp/get-docker.sh sh /tmp/get-docker.sh rm /tmp/get-docker.sh fi fi ``` ### Technical Analysis The deployment process downloads a mutable shell script from `https://get.docker.com` and immediately executes it. The script is not pinned to a specific version and is not verified using a trusted signature or hard-coded digest. Downloading the script to a temporary file before invoking `sh` is security-equivalent to piping `curl` directly into a shell. The effective code can change after this Skill has been reviewed. The temporary path is also predictable. Although exploitation through replacement depends on local permissions and timing, a securely created temporary file should be used for any downloaded artifact. ### Attack Path 1. A user invokes the full local deployment on a Linux system without Docker. 2. The script downloads the current content served by `get.docker.com`. 3. An attacker compromises the source, DNS resolution, the TLS trust chain, or another part of the delivery infrastructure. 4. The modified response is saved as `/tmp/get-docker.sh`. 5. The deployment process executes the response with the privileges of the invoking user. 6. If deployment is run as root or through privileged automation, the payload obtains system-wide control. ### Impact Assessment Successful exploitation permits arbitrary command execution. The payload receives the same privileges as the deployment process, which may include root privileges because Docker installation commonly requires administrative access. Potential consequences include credential theft, host compromise, persistent service installation, fil ...[truncated 74 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: deploy/remote/remote_deploy.sh:119
Finding: Deployment Executes Code Supplied by Arbitrary Archives
Content: View full analysis
Remediation: View remediation

other

Error

Location: build/base/base_builder.sh:106
Finding: Agent Memory, Identity, and Workspace Data Are Exported Without Sanitization
Content: View full analysis
/dev/null || true echo " ✓ custom skills" fi ``` The custom builder enables these exports by default: ```bash INCLUDE_CONFIG=true INCLUDE_WORKSPACE=true INCLUDE_SKILLS=true INCLUDE_DOCKER=true INCLUDE_SCRIPTS=true ``` ### Technical Analysis The builders sanitize only selected keys in `openclaw.json`. They do not sanitize the Agent's workspace, long-term memory, user profile, identity, tool documentation, or custom Skills. These files may contain: - Personal or organization-specific information. - Conversation-derived memory. - API credentials embedded in Markdown or scripts. - Internal hostnames, filesystem paths, and deployment details. - Agent instructions that affect behavior after import. - Arbitrary executable or instructional content in custom Skills. This behavior conflicts with the broad security claim that sensitive information is automatically removed. The default custom export includes workspace and Skills unless the user explicitly disables them. ### Attack Path 1. A user invokes the base builder or custom builder with default options. 2. The builder sanitizes selected JSON key names, creating the impression that the archive is safe to share. 3. Workspace identity, user profile, memory, tool files, and custom Skills are copie ...[truncated 685 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: deploy/local/handle_conflict.sh:28
Finding: Lexical Path Validation Can Be Bypassed Before Recursive Deletion
Content: View full analysis
/dev/null 2>&1; then rsync -aI --delete "$src/" "$dst/" else require_safe_path "$dst" rm -rf "$dst" mkdir -p "$dst" cp -R "$src/"* "$dst/" 2>/dev/null || true fi } ``` ```bash case "$MODE" in cover) log "${YELLOW}🧹 覆盖模式: 将覆盖旧版本${NC}" rm -rf "$TARGET" mv "$SOURCE" "$TARGET" ;; ``` ```bash rm -rf "$SOURCE" ``` ### Technical Analysis The validation compares unnormalized strings. It rejects the literal values `/`, `.`, and `..`, but it does not resolve equivalent paths or inspect symlinks. Examples that may resolve to dangerous locations while passing the check include: ```text /tmp/.. /var/../ /tmp/symlink-to-sensitive-directory ``` The script subsequently uses `rm -rf`, `mv`, and `rsync --delete`. These commands can delete or replace large directory trees. Quoting prevents shell word splitting but does not make a semantically dangerous path safe. ### Attack Path 1. An attacker or unsafe automation controls `--target`, `--source`, or the remotely forwarded installation directory. 2. A path such as `/tmp/..` is supplied instead of the literal `/`. 3. `safe_path` accepts it because the raw string is not equal to `/`, `.`, or `..`. 4. Cover or update mode reaches `rm -rf`, `mv`, or `rsync --delete`. 5. The operating system resolves the path to a parent or sym ...[truncated 470 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: deploy/batch/batch_deploy.sh:351
Finding: GNU Parallel Command Template Allows Inventory-Derived Shell Injection
Content: View full analysis
/dev/null && [ -n "$(command -v parallel)" ]; then # 使用 GNU parallel 并行 printf '%s\n' "${HOSTS[@]}" | parallel -j "$PARALLEL" --colsep '|' \ "bash -c 'source $PROJECT_DIR/deploy/batch/batch_deploy.sh --help >/dev/null 2>&1; entry={1}; deploy_one_host \"\$entry\"' _ {}" else ``` Inventory fields are parsed without strict character validation: ```bash host_entry="$(echo "$line" | sed 's/^[[:space:]]*//;s/[[:space:]]*$//')" host_alias="${host_entry%% *}" ... HOSTS+=("$host_alias|$host_addr|$host_user|$host_port|$host_key|$current_group") ``` ### Technical Analysis Inventory-derived text is substituted into a command string that is interpreted by `bash -c`. GNU Parallel performs placeholder replacement before the shell parses the resulting command. Because aliases and other inventory fields are not restricted to safe character sets, shell metacharacters, command substitutions, quotes, or separators can alter the generated command. Quoting inside a dynamically constructed shell command is fragile and does not provide a reliable data/code boundary. The vulnerable branch is selected only when GNU Parallel is available, which can make the behavior environment-dependent. ### Attack Path 1. An attacker provides or modifies an inventory file used by the operator. 2. A host alias or field contains shell syntax crafted to escape the generated assignment or quoting context. 3. The operator starts batch deployment on a system with GNU Parallel installed. 4. GNU Parallel substitutes the malicious record into the `bash -c` template. 5. Bash interprets the injected syntax as commands. 6. The payload runs locally on the deployment controller before or during remote deployment. ### Impact Assessment Successful exploitation p ...[truncated 315 chars]
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Warning

Location: tests/check_env/test_check_env.sh:159
Finding: Test Suite Renames the Real System sshpass Executable
Content: View full analysis
/dev/null 2>&1; then had_sshpass=1 # 临时移动 sshpass command -v sshpass | xargs -I{} mv {} {}.bak fi output=$("$CHECK_ENV" --host "192.168.1.1" --user "test" --password "test123" 2>&1 || true) if echo "$output" | grep -q "sshpass"; then assert_pass "缺少 sshpass 时报错" else assert_fail "未检测到 sshpass 缺失" fi # 恢复 sshpass if [ $had_sshpass -eq 1 ]; then command -v sshpass.bak | xargs -I{} mv {} {} fi } ``` ### Technical Analysis The test attempts to simulate a missing dependency by locating the actual installed `sshpass` binary and renaming it in place. It does not isolate execution with a temporary `PATH` and does not use a mock executable. If the test is interrupted, exits early, or fails to locate `sshpass.bak`, the original executable may not be restored. Running the test with privileges sufficient to alter a system binary directly modifies the host's tool installation. The restoration logic is also unreliable because `command -v sshpass.bak` searches command names through `PATH`; renamed files with a `.bak` suffix may not be found as expected in every environment. ### Attack Path 1. A user with sufficient filesystem permissions runs the test suite. 2. The test resolves the real `sshpass` installation path. 3. The binary is renamed to a `.bak` path. 4. The process is interrupted, crashes, or fails before successful restoration. 5. Other users or automation can no longer invoke `sshpass`. 6. Deployment and SSH workflows relying on that tool are disrupted. ### Impact Assessment The direct impact is modification and possible denial of service of a legitimate local ...[truncated 338 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (121)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CLAUDE.md (reported line 34)May include surrounding context.
Docker Deployment (Manual)

bash
cd docker cp .env.example .env # Edit .env with API Keys docker-compose up -d

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This variant indicates the skill may only provide logging while lacking the advertised deployment, sanitization, conflict handling, and checksum capabilities. Logging alone does not mitigate the risk created by false security assurances; users may still handle sensitive packages unsafely based on the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This variant indicates the skill may only provide logging while lacking the advertised deployment, sanitization, conflict handling, and checksum capabilities. Logging alone does not mitigate the risk created by false security assurances; users may still handle sensitive packages unsafely based on the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This variant indicates the skill may only provide logging while lacking the advertised deployment, sanitization, conflict handling, and checksum capabilities. Logging alone does not mitigate the risk created by false security assurances; users may still handle sensitive packages unsafely based on the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This variant indicates the skill may only provide logging while lacking the advertised deployment, sanitization, conflict handling, and checksum capabilities. Logging alone does not mitigate the risk created by false security assurances; users may still handle sensitive packages unsafely based on the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This variant indicates the skill may only provide logging while lacking the advertised deployment, sanitization, conflict handling, and checksum capabilities. Logging alone does not mitigate the risk created by false security assurances; users may still handle sensitive packages unsafely based on the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This variant indicates the skill may only provide logging while lacking the advertised deployment, sanitization, conflict handling, and checksum capabilities. Logging alone does not mitigate the risk created by false security assurances; users may still handle sensitive packages unsafely based on the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This variant indicates the skill may only provide logging while lacking the advertised deployment, sanitization, conflict handling, and checksum capabilities. Logging alone does not mitigate the risk created by false security assurances; users may still handle sensitive packages unsafely based on the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This variant indicates the skill may only provide logging while lacking the advertised deployment, sanitization, conflict handling, and checksum capabilities. Logging alone does not mitigate the risk created by false security assurances; users may still handle sensitive packages unsafely based on the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This variant indicates the skill may only provide logging while lacking the advertised deployment, sanitization, conflict handling, and checksum capabilities. Logging alone does not mitigate the risk created by false security assurances; users may still handle sensitive packages unsafely based on the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This variant indicates the skill may only provide logging while lacking the advertised deployment, sanitization, conflict handling, and checksum capabilities. Logging alone does not mitigate the risk created by false security assurances; users may still handle sensitive packages unsafely based on the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This variant indicates the skill may only provide logging while lacking the advertised deployment, sanitization, conflict handling, and checksum capabilities. Logging alone does not mitigate the risk created by false security assurances; users may still handle sensitive packages unsafely based on the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This variant indicates the skill may only provide logging while lacking the advertised deployment, sanitization, conflict handling, and checksum capabilities. Logging alone does not mitigate the risk created by false security assurances; users may still handle sensitive packages unsafely based on the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This variant indicates the skill may only provide logging while lacking the advertised deployment, sanitization, conflict handling, and checksum capabilities. Logging alone does not mitigate the risk created by false security assurances; users may still handle sensitive packages unsafely based on the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This variant indicates the skill may only provide logging while lacking the advertised deployment, sanitization, conflict handling, and checksum capabilities. Logging alone does not mitigate the risk created by false security assurances; users may still handle sensitive packages unsafely based on the description.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · build/full/full_builder.sh (reported line 118)May include surrounding context.
sh
log "🐳 安装 Docker..." curl -fsSL https://get.docker.com -o /tmp/get-docker.sh sh /tmp/get-docker.sh rm /tmp/get-docker.sh fi else log "${GREEN}✅ Docker 已安装${NC}"

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · build/base/base_builder.sh (reported line 260)May include surrounding context.
sh
configure() { log "⚙️ 配置服务..." if [ -f "$INSTALL_DIR/docker/.env.example" ] && [ ! -f "$INSTALL_DIR/docker/.env" ]; then cp "$INSTALL_DIR/docker/.env.example" "$INSTALL_DIR/docker/.env" log "${YELLOW}⚠️ 请编辑 $INSTALL_DIR/docker/.env 填入 API Keys${NC}" fi

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · build/full/full_builder.sh (reported line 166)May include surrounding context.
sh
configure() { log "⚙️ 配置服务..." if [ -f "$INSTALL_DIR/docker/.env.example" ] && [ ! -f "$INSTALL_DIR/docker/.env" ]; then cp "$INSTALL_DIR/docker/.env.example" "$INSTALL_DIR/docker/.env" log "${YELLOW}⚠️ 请编辑 $INSTALL_DIR/docker/.env 填入 API Keys${NC}" fi

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · build/full/full_builder.sh (reported line 167)May include surrounding context.
sh
configure() { log "⚙️ 配置服务..." if [ -f "$INSTALL_DIR/docker/.env.example" ] && [ ! -f "$INSTALL_DIR/docker/.env" ]; then cp "$INSTALL_DIR/docker/.env.example" "$INSTALL_DIR/docker/.env" log "${YELLOW}⚠️ 请编辑 $INSTALL_DIR/docker/.env 填入 API Keys${NC}" fi

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · deploy/remote/remote_deploy.sh (reported line 170)May include surrounding context.
sh
configure() { log "⚙️ 配置服务..." if [ -f "$INSTALL_DIR/docker/.env.example" ] && [ ! -f "$INSTALL_DIR/docker/.env" ]; then cp "$INSTALL_DIR/docker/.env.example" "$INSTALL_DIR/docker/.env" log "${YELLOW}⚠️ 请编辑 $INSTALL_DIR/docker/.env 填入 API Keys${NC}" fi

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · deploy/remote/remote_deploy.sh (reported line 171)May include surrounding context.
sh
configure() { log "⚙️ 配置服务..." if [ -f "$INSTALL_DIR/docker/.env.example" ] && [ ! -f "$INSTALL_DIR/docker/.env" ]; then cp "$INSTALL_DIR/docker/.env.example" "$INSTALL_DIR/docker/.env" log "${YELLOW}⚠️ 请编辑 $INSTALL_DIR/docker/.env 填入 API Keys${NC}" fi

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CLAUDE.md (reported line 28)May include surrounding context.
md
# ============================================ # ansible_user=root # ansible_port=22 # ansible_ssh_private_key_file=~/.ssh/id_rsa # ============================================ # 正式环境 (production)

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · config/inventory.example.ini (reported line 10)May include surrounding context.
text
# ============================================ # ansible_user=root # ansible_port=22 # ansible_ssh_private_key_file=~/.ssh/id_rsa # ============================================ # 正式环境 (production)

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · docs/README.md (reported line 55)May include surrounding context.
md
# ============================================ # ansible_user=root # ansible_port=22 # ansible_ssh_private_key_file=~/.ssh/id_rsa # ============================================ # 正式环境 (production)

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · docs/TROUBLESHOOTING.md (reported line 161)May include surrounding context.
md
# ============================================ # ansible_user=root # ansible_port=22 # ansible_ssh_private_key_file=~/.ssh/id_rsa # ============================================ # 正式环境 (production)

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

Code: suspicious.destructive_delete_command
Location: docs/TROUBLESHOOTING.md:116

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

T03 · Remote Payload Retrieval and Execution

other

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T07 · Tool Hijacking and Spoofing

SkillSpector

Credential Access

Docker Deployment (Manual)

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tool Parameter Abuse

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Static analysis

Documentation contains a destructive delete command without an explicit confirmation gate.