ClawHub
Back to skill

Security audit

WebClaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed web-dashboard installer, but it pulls unreviewed remote code and installs persistent system services with broad host privileges.

Review this carefully before installing on a real server. It is not clearly malicious, but installation gives it sudo-backed control over nginx, certbot, systemd services, package installation, and dashboard accounts. Prefer installing only on a dedicated host or VM, verify the upstream GitHub tag yourself, back up nginx configuration first, and avoid passing or sharing passwords through chat or command-line arguments.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/install.sh:35
Finding

Unverified Remote Application Retrieval and Dependency Execution

Content
View full analysis
/dev/null || npm install npm run build ``` The downloaded Python implementation is subsequently imported and executed: ```bash "$INSTALL_DIR/.venv/bin/python3" -c " import sys, os, sqlite3 sys.path.insert(0, '$INSTALL_DIR/api') os.environ['WEBCLAW_DB_PATH'] = '$DB_PATH' from db import get_connection conn = get_connection('$DB_PATH') tables = conn.execute(\"SELECT COUNT(*) FROM sqlite_master WHERE type='table'\").fetchone()[0] if tables < 5: print(f'ERROR: Only {tables} tables created, expected 9+', file=sys.stderr) sys.exit(1) conn.close() print(f'Database initialized at $DB_PATH ({tables} tables)') " ``` Downloaded service templates are also installed persistently: ```bash TEMP_SVC=$(mktemp) sed -e "s|{{INSTALL_DIR}}|$INSTALL_DIR|g" \ -e "s|{{USER}}|$CURRENT_USE ...[truncated 3403 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/db_query.py:369
Finding

Plaintext Passwords Exposed Through Process Arguments and Action Output

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/install.sh:131
Finding

Installer Deletes the Host’s Existing Default Nginx Site

Content
View full analysis
"$TEMP_CONF" sudo cp "$TEMP_CONF" /etc/nginx/sites-enabled/webclaw rm -f "$TEMP_CONF" sudo rm -f /etc/nginx/sites-enabled/default 2>/dev/null || true if sudo nginx -t 2>/dev/null; then sudo systemctl reload nginx log "Nginx configured (HTTPS on port 443, self-signed cert)." else err "Nginx config test failed. Check /etc/nginx/sites-enabled/webclaw" fi ``` ### Technical Analysis Configuring an nginx virtual host is consistent with the declared dashboard functionality. However, deleting `/etc/nginx/sites-enabled/default` is a global, privileged operation that is not inherently required to add a new Webclaw virtual host. The installer removes the existing site without: - Verifying whether it belongs to Webclaw. - Checking whether another application depends on it. - Requesting explicit administrator approval. - Creating a backup. - Recording enough state for rollback. - Restoring the deleted site if the new configuration causes operational problems. Although `nginx -t` checks configuration syntax, it does not verify that unrelated applications remain reachable or that virtual-host routing still behaves as intended. ### Attack Path 1. A user installs Webclaw on a server that already uses nginx. 2. Another application or the host’s default routing depends on `/etc/nginx/sites-enabled/default`. 3. The installer copies the Webclaw configuration and deletes the existing default site using `sudo`. 4. The installer validates syntax and reloads nginx. 5. Requests formerly handled by the deleted site fail or are routed to a different server block. 6. Existing applica ...[truncated 901 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (40)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · CONTRIBUTING.md (reported line 50)May include surrounding context.

The database is auto-created on first API request at ~/.openclaw/webclaw/webclaw.sqlite. To reset it:

bash
rm -f ~/.openclaw/webclaw/webclaw.sqlite
# Restart the API server — tables will be recreated

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
## Security Model

- **HTTPS enforced** via Let's Encrypt (setup-ssl action)
- **JWT authentication** — access tokens (15 min) + refresh tokens (7 days, httpOnly cookies)
- **RBAC** — role-based permission checks before every skill action
- **Rate limiting** — 5/min auth, 30/min writes, 100/min general (nginx)
- **Audit logging** — all mutating actions logged to audit_log table

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script can obtain certificates, overwrite nginx configuration, reload nginx, renew certs, and restart system services via sudo. Even without classic injection flaws, this creates a powerful remote host-management capability that can disrupt services, alter network exposure, or be abused for privilege escalation depending on sudo policy and how the script is invoked.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/install.sh (reported line 111)May include surrounding context.

sh
EXISTING_CONF="/etc/nginx/sites-enabled/webclaw"
fi

if [ -n "$EXISTING_CONF" ] && sudo nginx -t 2>/dev/null; then
    sudo systemctl reload nginx
    log "Nginx: reusing existing config at $EXISTING_CONF"
else

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The installer deletes the default nginx site file unconditionally using sudo. This can break unrelated web hosting on the machine and alters existing system configuration in a destructive way that is disproportionate for a skill installer.

Content

Scanner excerpt · scripts/install.sh (reported line 141)May include surrounding context.

sh
"$NGINX_CONF" > "$TEMP_CONF"
    sudo cp "$TEMP_CONF" /etc/nginx/sites-enabled/webclaw
    rm -f "$TEMP_CONF"
    sudo rm -f /etc/nginx/sites-enabled/default 2>/dev/null || true

    if sudo nginx -t 2>/dev/null; then
        sudo systemctl reload nginx

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises executable installation hooks, shell scripts, package installation, network access, and sudo-required system changes, but it does not declare an explicit tool scope such as permissions or allowed-tools. That creates a confused-deputy risk where an agent may invoke powerful capabilities without clear least-privilege boundaries or user-visible approval expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation triggers include broad phrases like login page, users, roles, browser access, and setup web, which are likely to overlap with ordinary admin conversations. In an agentic environment this can cause unintended routing into a high-privilege infrastructure skill, increasing the chance of accidental user management, SSL, or service operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The password reset workflow allows setting a specific password and mentions sharing temporary passwords, but it does not require a warning about sensitive credential handling, identity verification, or account disruption. This can normalize insecure transmission of secrets through chat logs and enable accidental or unauthorized account takeover if invoked on the wrong user.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This script exposes administrative actions through a Telegram-invoked management interface, including user lifecycle and service operations, which materially exceeds the stated browser-dashboard scope. Expanding a skill's control plane into a chat-triggered script increases attack surface and raises the risk of unauthorized remote administration if the surrounding invocation path is weakly authenticated or audited.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
76% confidence
Finding

The script manages user accounts and sessions, including listing active sessions and clearing them, which indicates persistent authentication state and account administration accessible from this management channel. In this context, the danger comes from exposing identity and session-management operations through an auxiliary interface that may bypass the dashboard's normal controls.

Content

Scanner excerpt · scripts/db_query.py (reported line 11)May include surrounding context.

python
setup-ssl        — Configure HTTPS with Let's Encrypt (--domain required)
  renew-ssl        — Check and renew SSL certificate
  list-users       — List web dashboard user accounts
  create-user      — Create a user (--email, --full-name, --role)
  reset-password   — Generate new password for a user (--email)
  disable-user     — Disable a user account (--email)
  list-sessions    — Show active sessions

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/db_query.py (reported line 131)May include surrounding context.

python
"""Run a command and return (stdout, returncode). cmd is a list of args."""
    if isinstance(cmd, str):
        cmd = cmd.split()
    result = subprocess.run(cmd, capture_output=True, text=True)
    if check and result.returncode != 0:
        _fail(f"Command failed: {' '.join(cmd)}\n{result.stderr[:500]}")
    return result.stdout.strip(), result.returncode

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
93% confidence
Finding

This code path relies on sudo-enabled execution for certificate issuance and related system management tasks. In the context of a remotely invokable skill, root-adjacent capabilities are highly dangerous because compromise of the caller path or business-logic abuse can translate into host-level control or service disruption.

Content

Scanner excerpt · scripts/db_query.py (reported line 208)May include surrounding context.

python
# Check certbot is available
    if not shutil.which("certbot"):
        _fail("certbot not found. Install with: sudo apt install certbot python3-certbot-nginx")

    # Obtain certificate
    email_addr = args.email or f"admin@{domain}"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/check_deps.sh (reported line 67)May include surrounding context.

sh
# Webclaw post-install script.
# Sets up backend (venv), frontend (npm build), database, nginx, and systemd.
#
# Privileges required: sudo (for nginx config, systemd services, certbot)
# What this script does:
#   1. Clones full source from GitHub if api/web dirs are missing
#   2. Creates Python venv + installs pip dependencies

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 5)May include surrounding context.

sh
# Webclaw post-install script.
# Sets up backend (venv), frontend (npm build), database, nginx, and systemd.
#
# Privileges required: sudo (for nginx config, systemd services, certbot)
# What this script does:
#   1. Clones full source from GitHub if api/web dirs are missing
#   2. Creates Python venv + installs pip dependencies

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 111)May include surrounding context.

sh
# Webclaw post-install script.
# Sets up backend (venv), frontend (npm build), database, nginx, and systemd.
#
# Privileges required: sudo (for nginx config, systemd services, certbot)
# What this script does:
#   1. Clones full source from GitHub if api/web dirs are missing
#   2. Creates Python venv + installs pip dependencies

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 112)May include surrounding context.

sh
# Webclaw post-install script.
# Sets up backend (venv), frontend (npm build), database, nginx, and systemd.
#
# Privileges required: sudo (for nginx config, systemd services, certbot)
# What this script does:
#   1. Clones full source from GitHub if api/web dirs are missing
#   2. Creates Python venv + installs pip dependencies

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 119)May include surrounding context.

sh
# Webclaw post-install script.
# Sets up backend (venv), frontend (npm build), database, nginx, and systemd.
#
# Privileges required: sudo (for nginx config, systemd services, certbot)
# What this script does:
#   1. Clones full source from GitHub if api/web dirs are missing
#   2. Creates Python venv + installs pip dependencies

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 120)May include surrounding context.

sh
# Webclaw post-install script.
# Sets up backend (venv), frontend (npm build), database, nginx, and systemd.
#
# Privileges required: sudo (for nginx config, systemd services, certbot)
# What this script does:
#   1. Clones full source from GitHub if api/web dirs are missing
#   2. Creates Python venv + installs pip dependencies

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 123)May include surrounding context.

sh
# Webclaw post-install script.
# Sets up backend (venv), frontend (npm build), database, nginx, and systemd.
#
# Privileges required: sudo (for nginx config, systemd services, certbot)
# What this script does:
#   1. Clones full source from GitHub if api/web dirs are missing
#   2. Creates Python venv + installs pip dependencies

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install.sh (reported line 139)May include surrounding context.

sh
# Webclaw post-install script.
# Sets up backend (venv), frontend (npm build), database, nginx, and systemd.
#
# Privileges required: sudo (for nginx config, systemd services, certbot)
# What this script does:
#   1. Clones full source from GitHub if api/web dirs are missing
#   2. Creates Python venv + installs pip dependencies

Static analysis

No suspicious patterns detected.