Security audit

openclaw-twoway deployment

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly does what it says, but it installs persistent root-run network services and opens remote access in ways users should review carefully before use.

Install only on a dedicated host after reading the scripts. Restrict firewall and cloud security-group rules to Tailscale or known source IPs, remove or justify --allow-unconfigured and insecure WebSocket settings, protect and rotate generated tokens, consider a non-root service account, avoid curl-to-shell installation where possible, and review diagnostic output before sharing it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (26)

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The script advertises an SSH-tunnel-based deployment, but actually configures OpenClaw to bind on the LAN and modifies host firewall rules to expose port 18789. This mismatch can cause operators to deploy a broader network exposure than intended, increasing the risk of unintended remote access to the gateway.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The script advertises a token-authenticated remote gateway, but the systemd service later launches OpenClaw with `--allow-unconfigured`, which can bypass or weaken the intended authentication posture. In a remotely reachable gateway context, this mismatch is dangerous because operators may believe the service is access-controlled when it may accept less-trusted or unauthenticated connections.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The generated configuration sets `dangerouslyAllowInsecurePrivateWs: true`, and the service also exports `OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1`, explicitly opting into insecure private WebSocket behavior. Even on a Tailscale network, normalizing insecure transport/auth assumptions increases exposure to interception, misconfiguration, or trust-boundary mistakes if the service becomes reachable beyond the intended overlay.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README explicitly advertises one-click deployment that performs environment checks, firewall changes, service deployment, and autostart configuration, and states that administrator/root privileges are required. Presenting system-modifying scripts as turnkey operations without a prominent warning to inspect them first increases the chance that users will run privileged changes they do not understand, which can weaken host security or availability if the scripts are flawed or tampered with.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The README instructs users to download and immediately execute remote shell scripts via curl followed by bash, which is a well-known unsafe pattern. If the remote source, repository, branch content, or transport chain is compromised, users could execute arbitrary code with elevated privileges, leading to full host compromise.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill instructs users to open firewall and cloud security-group ports, bind services to LAN, and enable persistent remote access, but does not clearly warn about the resulting exposure. In this context, the scripts also run services as root and expose management/gateway endpoints over network interfaces, increasing the chance of unauthorized access or attack-surface expansion.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The script collects system details, network status, local listening ports, firewall rules, service status, and recent logs, then explicitly instructs the user to send the output to technical support. That output can contain sensitive operational information useful for reconnaissance or troubleshooting abuse, and the script provides no warning, redaction, or consent guidance before encouraging disclosure.

Missing User Warnings

Medium

Confidence: 85% confidence
Finding: The script writes the generated authentication token to disk in `~/.openclaw/token.txt` without setting explicit permissions or clearly warning the user before persistence occurs. On a multi-user or backup-monitored system, this can leak the credential and enable unauthorized access to the remote gateway.

Session Persistence

Medium

Category: Rogue Agent
Content: echo " ✓ SSH 服务：运行中" else echo " ⚠ SSH 服务未运行，正在启动..." systemctl enable --now sshd 2>/dev/null || systemctl enable --now ssh 2>/dev/null || true fi # ============== 2. Tailscale 配置 ==============
Confidence: 88% confidence
Finding: This duplicate finding points to the same behavior: automatic persistence of SSH service. Persistently enabling SSH is risky when the same skill also encourages opening port 22 and using root-based remote access.

Session Persistence

Medium

Category: Rogue Agent
Content: echo " ✓ SSH 服务：运行中" else echo " ⚠ SSH 服务未运行，正在启动..." systemctl enable --now sshd 2>/dev/null || systemctl enable --now ssh 2>/dev/null || true fi # ============== 2. Tailscale 配置 ==============
Confidence: 88% confidence
Finding: This duplicate finding points to the same behavior: automatic persistence of SSH service. Persistently enabling SSH is risky when the same skill also encourages opening port 22 and using root-based remote access.

Session Persistence

Medium

Category: Rogue Agent
Content: fi fi systemctl enable --now tailscaled 2>/dev/null || tailscaled & sleep 3 if tailscale status 2>&1 | grep -q "connected"; then
Confidence: 82% confidence
Finding: Enabling tailscaled to start automatically is a persistence mechanism, but in this deployment context it is expected operational behavior rather than inherently malicious persistence. The risk comes indirectly from expanding network connectivity, not from the service persistence alone.

Session Persistence

Medium

Category: Rogue Agent
Content: echo -e "\n[8/8] 启动服务..." systemctl daemon-reload systemctl enable openclaw-gateway systemctl start openclaw-gateway echo " 等待服务启动..."
Confidence: 93% confidence
Finding: The script enables the OpenClaw gateway as a persistent system service, causing network-exposed functionality to survive reboots. Because the service is configured to bind to LAN and runs as root, this persistence materially increases the window for exploitation if the gateway is vulnerable or misconfigured.

Session Persistence

Medium

Category: Rogue Agent
Content: fi fi systemctl enable --now tailscaled 2>/dev/null || tailscaled & sleep 3 if tailscale status 2>&1 | grep -q "connected"; then
Confidence: 82% confidence
Finding: Auto-starting tailscaled is normal for a VPN client and not by itself evidence of harmful persistence. However, within this skill it contributes to sustained remote reachability and should be treated cautiously when combined with network-exposed services.

Session Persistence

Medium

Category: Rogue Agent
Content: EOF systemctl daemon-reload systemctl enable openclaw-gateway systemctl start openclaw-gateway sleep 5
Confidence: 94% confidence
Finding: Persistently enabling the remote-mode OpenClaw gateway increases exposure because it listens on a network interface, allows remote operation, and is configured with insecure WebSocket allowances elsewhere in the same script. The combination of persistence plus remote access makes compromise or misconfiguration longer-lived and more impactful.

Session Persistence

Medium

Category: Rogue Agent
Content: if ! command -v tailscale &> /dev/null; then curl -fsSL https://tailscale.com/install.sh | sh fi systemctl enable --now tailscaled 2>/dev/null || tailscaled & sleep 3 TAILSCALE_IP=$(tailscale ip | head -1) echo " ✓ Tailscale: $TAILSCALE_IP"
Confidence: 80% confidence
Finding: This is another case of enabling tailscaled on boot. While it is a persistence mechanism, it is expected for VPN functionality and is lower risk than the exposed gateway and SSH services discussed elsewhere.

Session Persistence

Medium

Category: Rogue Agent
Content: EOF systemctl daemon-reload systemctl enable openclaw-gateway systemctl start openclaw-gateway sleep 5
Confidence: 92% confidence
Finding: This enables the cloud gateway as a persistent service in the dual-deployment plan. Since the same plan also opens ports and binds the service to LAN, persistence extends the exposure window and makes accidental insecure deployment durable across reboots.

External Script Fetching

High

Category: Supply Chain
Content: if ! command -v tailscale &> /dev/null; then echo " 安装 Tailscale..." if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then curl -fsSL https://tailscale.com/install.sh | sh elif [ "$OS" = "centos" ] || [ "$OS" = "rhel" ] || [ "$OS" = "rocky" ]; then yum install -y yum-utils yum-config-manager --add-repo https://pkgs.tailscale.com/stable/centos/9/tailscale.repo
Confidence: 98% confidence
Finding: Piping a remotely fetched script directly into sh as root is dangerous because it grants immediate code execution to whatever is served at that URL or delivered via a compromised network path. In this skill, that risk is amplified because the command is presented as part of an automated deployment flow with root privileges.

External Script Fetching

Low

Category: Supply Chain
Content: else echo " 安装 Node.js 22..." if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then curl -fsSL https://deb.nodesource.com/setup_22.x | bash - apt-get install -y nodejs elif [ "$OS" = "centos" ] || [ "$OS" = "rhel" ] || [ "$OS" = "rocky" ]; then curl -fsSL https://rpm.nodesource.com/setup_22.x | bash -
Confidence: 83% confidence
Finding: Fetching and piping the NodeSource setup script to bash still creates remote-code-execution risk, although this is a common installation pattern. Because the script is run as root in a deployment guide, compromise of the source or delivery path could fully compromise the host.

External Script Fetching

Low

Category: Supply Chain
Content: curl -fsSL https://deb.nodesource.com/setup_22.x | bash - apt-get install -y nodejs elif [ "$OS" = "centos" ] || [ "$OS" = "rhel" ] || [ "$OS" = "rocky" ]; then curl -fsSL https://rpm.nodesource.com/setup_22.x | bash - yum install -y nodejs else echo " ✗ 不支持的系统，请手动安装 Node.js"
Confidence: 83% confidence
Finding: This is the RPM variant of the same risk: a remote script is executed directly as root. Any compromise of the script source or a man-in-the-middle condition would result in arbitrary command execution on the server.

External Script Fetching

High

Category: Supply Chain
Content: if ! command -v tailscale &> /dev/null; then echo " 安装 Tailscale..." if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then curl -fsSL https://tailscale.com/install.sh | sh else echo " ✗ 不支持的系统，请手动安装" exit 1
Confidence: 98% confidence
Finding: This repeats the direct curl|sh install pattern for Tailscale in another plan. Since it runs in an automated, privileged deployment context, it creates a strong supply-chain and remote-execution risk.

External Script Fetching

Low

Category: Supply Chain
Content: if ! command -v node &> /dev/null; then echo " 安装 Node.js 22..." if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then curl -fsSL https://deb.nodesource.com/setup_22.x | bash - apt-get install -y nodejs else echo " ✗ 不支持的系统"
Confidence: 83% confidence
Finding: Executing the Node.js setup script fetched from the internet via bash exposes the host to remote code execution if the source is compromised. The impact is significant because the script is intended to run with elevated privileges during provisioning.

External Script Fetching

High

Category: Supply Chain
Content: # 1. Tailscale echo -e "\n[1/7] 配置 Tailscale..." if ! command -v tailscale &> /dev/null; then curl -fsSL https://tailscale.com/install.sh | sh fi systemctl enable --now tailscaled 2>/dev/null || tailscaled & sleep 3
Confidence: 98% confidence
Finding: Another instance of curling and executing a remote Tailscale installer script as root. Repetition across multiple deployment plans increases the chance that users will adopt the unsafe pattern widely.

External Script Fetching

Low

Category: Supply Chain
Content: echo -e "\n[3/7] 配置 Node.js..." if ! command -v node &> /dev/null; then if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then curl -fsSL https://deb.nodesource.com/setup_22.x | bash - apt-get install -y nodejs fi fi
Confidence: 83% confidence
Finding: This repeats the NodeSource remote-script execution pattern. Even if widely used operationally, it remains an avoidable code-execution risk in a security-sensitive deployment guide.

Chaining Abuse

High

Category: Tool Misuse
Content: if ! command -v tailscale &> /dev/null; then echo " 安装 Tailscale..." if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then curl -fsSL https://tailscale.com/install.sh | sh elif [ "$OS" = "centos" ] || [ "$OS" = "rhel" ] || [ "$OS" = "rocky" ]; then yum install -y yum-utils yum-config-manager --add-repo https://pkgs.tailscale.com/stable/centos/9/tailscale.repo
Confidence: 97% confidence
Finding: The shell pipeline directly chains network retrieval into command execution, removing any opportunity for inspection or integrity validation. Because it is executed as root, exploitation would permit immediate full system compromise.

Chaining Abuse

High

Category: Tool Misuse
Content: if ! command -v tailscale &> /dev/null; then echo " 安装 Tailscale..." if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then curl -fsSL https://tailscale.com/install.sh | sh else echo " ✗ 不支持的系统，请手动安装" exit 1
Confidence: 97% confidence
Finding: This is the same dangerous chaining pattern in a second deployment path. Its presence in multiple paths increases operational risk by normalizing unsafe command execution.

Static analysis

No suspicious patterns detected.