Security audit

openclaw-twoway deployment

Security checks for vulnerabilities and agentic risk

Overview

This is a real OpenClaw deployment helper, but it uses root/admin automation, persistent services, broad network exposure, and unsafe install patterns that need review before use.

Review and harden the scripts before installing: replace curl-to-shell with verified package installs, pin npm package versions, restrict ports to Tailscale or trusted sources, remove insecure WebSocket and allow-unconfigured settings, run the gateway under a dedicated non-root account, protect tokens, and confirm every startup task/service is wanted and removable.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

Location: plan1-cloud-gateway.sh:41
Finding: Unverified Remote Installation Scripts Are Executed as Root
Content: View full analysis
/dev/null; then echo " 安装 Tailscale..." if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then curl -fsSL https://tailscale.com/install.sh | sh ``` `plan1-cloud-gateway.sh:136-143` does the same with NodeSource installers: ```bash else echo " 安装 Node.js 22..." if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then curl -fsSL https://deb.nodesource.com/setup_22.x | bash - apt-get install -y nodejs elif [ "$OS" = "centos" ] || [ "$OS" = "rhel" ] || [ "$OS" = "rocky" ]; then curl -fsSL https://rpm.nodesource.com/setup_22.x | bash - yum install -y nodejs ``` Equivalent remote execution occurs at: ```bash # plan2-cloud-remote-gateway.sh:33-37 if ! command -v tailscale &> /dev/null; then echo " 安装 Tailscale..." if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then curl -fsSL https://tailscale.com/install.sh | sh ``` ```bash # plan2-cloud-remote-gateway.sh:73-77 if ! command -v node &> /dev/null; then echo " 安装 Node.js 22..." if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then curl -fsSL https://deb.nodesource.com/setup_22.x | bash - apt-get install -y nodejs ``` ```bash # plan3-cloud-gateway.sh:26-30 if ! command -v tailscale &> /dev/null; then curl -fsSL https://tailscale.com/install.sh | sh fi ``` ```bash # plan3 ...[truncated 2123 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: plan3-cloud-gateway.sh:60
Finding: Unpinned Global npm Package Installation Runs Supply-Chain Code with Root Privileges
Content: View full analysis
/dev/null || true # ============== 5. OpenClaw 安装 ============== echo -e "\n[5/8] 安装 OpenClaw..." if command -v openclaw &> /dev/null; then echo " ✓ OpenClaw 已安装" openclaw --version else echo " 安装 OpenClaw..." npm install -g openclaw ``` `plan2-cloud-remote-gateway.sh:85-90` always installs the latest resolved package globally: ```bash npm config set registry https://registry.npmmirror.com 2>/dev/null || true # ============== 5. OpenClaw 安装 ============== echo -e "\n[5/7] 安装 OpenClaw..." npm install -g openclaw ``` `plan3-cloud-gateway.sh:60-62` explicitly installs through the third-party mirror: ```bash # 4. OpenClaw echo -e "\n[4/7] 安装 OpenClaw..." npm install -g openclaw --registry=https://registry.npmmirror.com ``` ### Technical Analysis The scripts do not pin `openclaw` to an audited exact version. Consequently, deployment behavior can change whenever the registry's selected version changes. The installation occurs during a root-only deployment and uses the global npm installation location. npm packages can contain lifecycle scripts such as `preinstall`, `install`, and `postinstall`. Unless explicitly disabled, those scripts execute during installation with the privileges of the invoking process. A compromised package, maintainer account, registry mirror, or newly published malicious version could therefore execute code as root. Changing npm's persistent registry configuration also affects later npm operations performed in the same account, extending ...[truncated 1002 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: plan1-cloud-gateway.sh:186
Finding: Network-Facing OpenClaw Gateway Is Persistently Executed as Root
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: plan2-cloud-remote-gateway.sh:56
Finding: Gateway Ports Are Broadly Opened While Insecure WebSocket Transport Is Explicitly Enabled
Content: View full analysis
/dev/null && ufw status | grep -q "Status: active"; then ufw allow 18789/tcp comment "OpenClaw Gateway" echo " ✓ UFW: 18789/tcp 已放行" elif command -v firewall-cmd &> /dev/null && systemctl is-active --quiet firewalld; then firewall-cmd --permanent --add-port=18789/tcp firewall-cmd --reload echo " ✓ Firewalld: 18789/tcp 已放行" fi echo " ⚠ 云服务器安全组需手动放行 18789 (Tailscale IP: $TAILSCALE_IP)" ``` `plan2-cloud-remote-gateway.sh:106-124` binds to LAN and explicitly allows insecure private WebSockets: ```bash cat > ~/.openclaw/openclaw.json << EOF { "gateway": { "port": 18789, "mode": "remote", "bind": "lan", "auth": { "mode": "token", "token": "$TOKEN" } }, "security": { "dangerouslyAllowInsecurePrivateWs": true } } EOF ``` The systemd service reinforces that insecure configuration: ```ini # plan2-cloud-remote-gateway.sh:136-145 User=root WorkingDirectory=/root/.openclaw ExecStart=/usr/bin/node /usr/lib/node_modules/openclaw/dist/index.js gateway --port 18789 --bind lan --allow-unconfigured Restart=on-failure RestartSec=10 StartLimitBurst=3 StartLimitIntervalSec=300 Environment=NODE_ENV=production Environment=OPENCLAW_ALLOW_INSECURE_PRIVATE_WS=1 ``` Plan 3 similarly opens both gateway and synchronization ports broadly: ```bash # plan3-cloud-gateway.sh:35-48 if command -v ufw &> /dev/null && ufw status | grep -q "active"; then ufw allow 18789/tcp comment "OpenClaw Gateway" ufw allow 18790/tcp comment "OpenClaw ...[truncated 2394 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: plan2-cloud-remote-gateway.sh:94
Finding: Gateway and Synchronization Tokens Are Printed and Stored Without Explicit Permission Hardening
Content: View full analysis
~/.openclaw/token.txt 2>/dev/null || true ``` The directory is only created afterward, and the token is also written into the main configuration without an explicit restrictive mode: ```bash # plan2-cloud-remote-gateway.sh:103-124 # ============== 7. 配置网关 + systemd ============== echo -e "\n[7/7] 配置网关 (Remote 模式)..." mkdir -p ~/.openclaw cat > ~/.openclaw/openclaw.json << EOF { "gateway": { "port": 18789, "mode": "remote", "bind": "lan", "auth": { "mode": "token", "token": "$TOKEN" } }, "security": { "dangerouslyAllowInsecurePrivateWs": true } } EOF ``` The token is printed again after deployment: ```bash # plan2-cloud-remote-gateway.sh:171-178 echo -e "\n【网络信息】" echo " Tailscale IP: $TAILSCALE_IP" echo " 网关地址：ws://${TAILSCALE_IP}:18789" echo " Token: $TOKEN" ``` Plan 3 also prints and embeds its synchronization token: ```bash # plan3-cloud-gateway.sh:65-89 mkdir -p ~/.openclaw # 生成同步 Token SYNC_TOKEN=$(openssl rand -hex 20) cat > ~/.openclaw/openclaw.json << EOF { "gateway": { "port": 18789, "mode": "local", "bind": "lan" }, "sync": { "enabled": true, "port": 18790, "token": "$SYNC_TOKEN", "direction": "bidirectional", "interval": 300 } } EOF echo " ✓ 配置文件：~/.openclaw/openclaw.json" echo " 同步 Token: $SYNC_TOKEN" ``` ### Technical Analysis The generated values are ...[truncated 1708 chars]
Remediation: View remediation
/var/lib/openclaw/token ``` 4. Do not print complete bearer tokens to standard output. Display a one-time enrollment URL or write the secret to a protected file and show only its path. 5. Avoid suppressing token-write failures. Abort deployment if secure storage cannot be created. 6. Store secrets separately from general configuration and reference them using systemd credentials or another supported secret store. 7. Ensure logs and diagnostics redact values matching token fields. 8. Implement token rotation and revocation procedures. 9. Use separate tokens for gateway access and synchronization, scoped to the minimum required functions. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (66)

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: Piping a remotely fetched script directly into sh as root allows arbitrary code execution if the remote endpoint, network path, or supply chain is compromised. In this skill, it occurs inside an automated deployment flow, making it likely users will run it without independently validating the script contents.
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
md
if ! command -v tailscale &> /dev/null; then echo " 安装 Tailscale..." if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then curl -fsSL https://tailscale.com/install.sh | sh elif [ "$OS" = "centos" ] || [ "$OS" = "rhel" ] || [ "$OS" = "rocky" ]; then yum install -y yum-utils yum-config-manager --add-repo https://pkgs.tailscale.com/stable/centos/9/tailscale.repo

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: This chains network retrieval directly into shell execution, eliminating any opportunity for validation between download and execution. In practice, that turns a documentation convenience into one-step arbitrary code execution with root privileges.
Content: Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.
md
if ! command -v tailscale &> /dev/null; then echo " 安装 Tailscale..." if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then curl -fsSL https://tailscale.com/install.sh | sh elif [ "$OS" = "centos" ] || [ "$OS" = "rhel" ] || [ "$OS" = "rocky" ]; then yum install -y yum-utils yum-config-manager --add-repo https://pkgs.tailscale.com/stable/centos/9/tailscale.repo

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 88% confidence
Finding: The script force-deletes and recreates a scheduled task, then creates a hidden PowerShell autorun entry, potentially under SYSTEM. In a skill context, this is a persistence mechanism that can silently overwrite an existing task name and establish durable background execution.
Content: Scanner excerpt · SKILL.md (reported line 435)May include surrounding context.
md
Write-Host "`n[6/6] 创建计划任务（开机自启）..." -ForegroundColor Yellow # 删除旧任务 schtasks /Delete /TN $TaskName /F 2>$null | Out-Null # 创建新任务（系统启动时 + 用户登录时） $argument = "-ExecutionPolicy Bypass -WindowStyle Hidden -File `"$scriptPath`""

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: This repeats the direct remote-script-to-shell pattern for Tailscale installation. Because the deployment script is meant to be run as root and also modifies networking, compromise of this step would fully compromise the host and its connectivity.
Content: Scanner excerpt · SKILL.md (reported line 586)May include surrounding context.
md
if ! command -v tailscale &> /dev/null; then echo " 安装 Tailscale..." if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then curl -fsSL https://tailscale.com/install.sh | sh else echo " ✗ 不支持的系统，请手动安装" exit 1

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: This is the same dangerous chaining pattern in another script section. The combination of remote content, shell execution, and administrative context makes it highly risky.
Content: Scanner excerpt · SKILL.md (reported line 586)May include surrounding context.
md
if ! command -v tailscale &> /dev/null; then echo " 安装 Tailscale..." if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then curl -fsSL https://tailscale.com/install.sh | sh else echo " ✗ 不支持的系统，请手动安装" exit 1

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The architecture and scripts describe real-time or periodic bidirectional synchronization of session state and message history between cloud and local systems. This is a user-data-impacting behavior, but the markdown does not provide a conspicuous warning that conversational data will be copied across environments and stored in multiple locations.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 86% confidence
Finding: This force-deletes a task and recreates an autorun scheduled task for the gateway, creating persistent background execution on user logon. While intended for convenience, it is security-relevant because it modifies OS task scheduling state and can hide long-lived execution from users.
Content: Scanner excerpt · SKILL.md (reported line 1021)May include surrounding context.
md
# 创建计划任务 $argument = "-ExecutionPolicy Bypass -WindowStyle Hidden -File `"$startScript`"" schtasks /Delete /TN $TaskName /F 2>$null | Out-Null schtasks /Create /TN $TaskName /TR "powershell.exe $argument" /SC ONLOGON /F 2>$null if ($LASTEXITCODE -eq 0) {

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The Plan 3 cloud script also pipes the Tailscale installer directly to sh. In a root-run automation context, this is a clear arbitrary-code-execution and supply-chain risk with full-host impact.
Content: Scanner excerpt · SKILL.md (reported line 1098)May include surrounding context.
md
# 1. Tailscale echo -e "\n[1/7] 配置 Tailscale..." if ! command -v tailscale &> /dev/null; then curl -fsSL https://tailscale.com/install.sh | sh fi systemctl enable --now tailscaled 2>/dev/null || tailscaled & sleep 3

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: Again, a fetched installer is piped straight into sh in a privileged automation script. This is especially dangerous because the skill encourages turnkey deployment, reducing the chance users will scrutinize the command.
Content: Scanner excerpt · SKILL.md (reported line 1098)May include surrounding context.
md
# 1. Tailscale echo -e "\n[1/7] 配置 Tailscale..." if ! command -v tailscale &> /dev/null; then curl -fsSL https://tailscale.com/install.sh | sh fi systemctl enable --now tailscaled 2>/dev/null || tailscaled & sleep 3

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The embedded usage example instructs users to download a script over the network and execute it immediately with bash, bypassing review, integrity verification, and provenance checks. If the hosting location, transport, or upstream content is compromised, users could execute arbitrary attacker-controlled code on their systems.
Content: Scanner excerpt · diagnostic.sh (reported line 3)May include surrounding context.
sh
#!/bin/bash # diagnostic.sh - OpenClaw 快速诊断脚本 # 用法：curl -O https://.../diagnostic.sh && bash diagnostic.sh echo "╔════════════════════════════════════════════════════════════════╗" echo "║ OpenClaw 诊断报告 ║"

External Script Fetching

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The usage instruction explicitly encourages downloading a script from the network and immediately executing it. This normalizes unsafe operator behavior and creates a straightforward path to full compromise if the hosted script is replaced or intercepted.
Content: Scanner excerpt · plan1-cloud-gateway.sh (reported line 3)May include surrounding context.
sh
#!/bin/bash # plan1-cloud-gateway.sh - 方案一：云端网关完整部署 # 用法：curl -O https://.../plan1-cloud-gateway.sh && bash plan1-cloud-gateway.sh set -e

External Script Fetching

High

Category: Supply Chain
Confidence: 99% confidence
Finding: The script downloads a remote installer and pipes it directly into sh as root, giving the remote server or any attacker who can tamper with that response immediate code execution. In this skill context the danger is elevated because the script is explicitly intended to be fetched and executed for infrastructure deployment, so an operator is likely to run it with full privileges.
Content: Scanner excerpt · plan1-cloud-gateway.sh (reported line 44)May include surrounding context.
sh
if ! command -v tailscale &> /dev/null; then echo " 安装 Tailscale..." if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then curl -fsSL https://tailscale.com/install.sh | sh elif [ "$OS" = "centos" ] || [ "$OS" = "rhel" ] || [ "$OS" = "rocky" ]; then yum install -y yum-utils yum-config-manager --add-repo https://pkgs.tailscale.com/stable/centos/9/tailscale.repo

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The '| sh' chain removes any inspection boundary between network input and command execution, turning a fetch into immediate execution with root privileges. This increases exploitability beyond simple downloading because compromise of the source instantly becomes host compromise.
Content: Scanner excerpt · plan1-cloud-gateway.sh (reported line 44)May include surrounding context.
sh
if ! command -v tailscale &> /dev/null; then echo " 安装 Tailscale..." if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then curl -fsSL https://tailscale.com/install.sh | sh elif [ "$OS" = "centos" ] || [ "$OS" = "rhel" ] || [ "$OS" = "rocky" ]; then yum install -y yum-utils yum-config-manager --add-repo https://pkgs.tailscale.com/stable/centos/9/tailscale.repo

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script claims to deploy a token-authenticated remote gateway, but it explicitly enables insecure behavior in two places: the config sets dangerouslyAllowInsecurePrivateWs to true and the systemd service launches the gateway with --allow-unconfigured. That combination can weaken or bypass the intended access controls, making the exposed remote gateway easier to connect to or misuse despite the script presenting it as protected by token auth.
Content: No source excerpt is available for this finding.

External Script Fetching

High

Category: Supply Chain
Confidence: 93% confidence
Finding: The usage instruction encourages operators to fetch a script from a URL and execute it immediately with bash, which normalizes unsafe execution of unreviewed remote code. This is particularly dangerous because the script requires root privileges and performs network installation and service configuration.
Content: Scanner excerpt · plan2-cloud-remote-gateway.sh (reported line 3)May include surrounding context.
sh
#!/bin/bash # plan2-cloud-remote-gateway.sh - 方案二：云端远程网关完整部署（Remote 模式 + Token 认证） # 用法：curl -O https://.../plan2-cloud-remote-gateway.sh && bash plan2-cloud-remote-gateway.sh set -e

External Script Fetching

High

Category: Supply Chain
Confidence: 97% confidence
Finding: The script downloads and immediately executes a remote installer with curl | sh as root. If the upstream source, DNS, TLS trust chain, or network path is compromised, arbitrary code will run with full privileges on the host.
Content: Scanner excerpt · plan2-cloud-remote-gateway.sh (reported line 36)May include surrounding context.
sh
if ! command -v tailscale &> /dev/null; then echo " 安装 Tailscale..." if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then curl -fsSL https://tailscale.com/install.sh | sh else echo " ✗ 不支持的系统，请手动安装" exit 1

Chaining Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: The explicit curl | sh chain removes any meaningful opportunity for inspection between retrieval and execution, amplifying supply-chain and man-in-the-middle risk. In a root-run deployment script, this pattern turns a network content compromise directly into full system compromise.
Content: Scanner excerpt · plan2-cloud-remote-gateway.sh (reported line 36)May include surrounding context.
sh
if ! command -v tailscale &> /dev/null; then echo " 安装 Tailscale..." if [ "$OS" = "ubuntu" ] || [ "$OS" = "debian" ]; then curl -fsSL https://tailscale.com/install.sh | sh else echo " ✗ 不支持的系统，请手动安装" exit 1

External Script Fetching

High

Category: Supply Chain
Confidence: 94% confidence
Finding: Although this appears in comments as usage guidance, it still materially encourages insecure execution of unauthenticated remote code. In the context of infrastructure deployment, such guidance is especially dangerous because the script is intended to run as root and modify services and firewall settings.
Content: Scanner excerpt · plan3-cloud-gateway.sh (reported line 3)May include surrounding context.
sh
#!/bin/bash # plan3-cloud-gateway.sh - 方案三：云端网关完整部署（含同步备份） # 用法：curl -O https://.../plan3-cloud-gateway.sh && bash plan3-cloud-gateway.sh set -e

External Script Fetching

High

Category: Supply Chain
Confidence: 94% confidence
Finding: Although this appears in comments as usage guidance, it still materially encourages insecure execution of unauthenticated remote code. In the context of infrastructure deployment, such guidance is especially dangerous because the script is intended to run as root and modify services and firewall settings.
Content: Scanner excerpt · plan3-cloud-gateway.sh (reported line 3)May include surrounding context.
sh
#!/bin/bash # plan3-cloud-gateway.sh - 方案三：云端网关完整部署（含同步备份） # 用法：curl -O https://.../plan3-cloud-gateway.sh && bash plan3-cloud-gateway.sh set -e

External Script Fetching

High

Category: Supply Chain
Confidence: 94% confidence
Finding: Although this appears in comments as usage guidance, it still materially encourages insecure execution of unauthenticated remote code. In the context of infrastructure deployment, such guidance is especially dangerous because the script is intended to run as root and modify services and firewall settings.
Content: Scanner excerpt · plan3-cloud-gateway.sh (reported line 3)May include surrounding context.
sh
#!/bin/bash # plan3-cloud-gateway.sh - 方案三:云端网关完整部署(含同步备份) # 用法:curl -O https://.../plan3-cloud-gateway.sh && bash plan3-cloud-gateway.sh set -e

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The script directly executes Tailscale's remote install script via a pipe to sh, which is a classic command-chaining anti-pattern. Because the script runs as root, any compromise of the fetched content or installation endpoint results in full system compromise and persistent unauthorized changes.
Content: Scanner excerpt · plan3-cloud-gateway.sh (reported line 29)May include surrounding context.
sh
# 1. Tailscale echo -e "\n[1/7] 配置 Tailscale..." if ! command -v tailscale &> /dev/null; then curl -fsSL https://tailscale.com/install.sh | sh fi systemctl enable --now tailscaled 2>/dev/null || tailscaled & sleep 3

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README explicitly promotes one-click deployment scripts that perform environment detection, firewall changes, service deployment, and boot persistence, but it does not provide a clear warning about the scope of privileged system modifications before users run the commands. This is dangerous because users are instructed to execute remote-downloaded scripts as root/administrator, increasing the risk of unintended exposure, persistence, or unsafe configuration if the scripts are flawed or tampered with.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description states that /openclaw-deploy will automatically perform firewall configuration and service deployment, which can affect system integrity and network exposure. In this markdown file there is no upfront warning that invoking the skill will modify firewall rules, create services, and require elevated privileges.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document explains that DingTalk/Feishu traffic is sent to a cloud gateway and then to an AI model API, but it does not explicitly warn users that message content and related system data may leave the local machine. For a deployment skill handling communications and external APIs, users should be clearly informed about this data transmission behavior.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 95% confidence
Finding: The script enables and starts SSH automatically with root privileges, creating persistent remote access on the host. In the context of an installation skill that also opens firewall ports, this expands the attack surface and may expose systems that previously had no active SSH service.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
md
echo " ✓ SSH 服务：运行中" else echo " ⚠ SSH 服务未运行，正在启动..." systemctl enable --now sshd 2>/dev/null || systemctl enable --now ssh 2>/dev/null || true fi # ============== 2. Tailscale 配置 ==============