Linux to Mac Bridge (Legacy)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:47 AM UTC
• Version: 1.2.1

Overview

The skill mostly does what it says, but its wrapper installer accepts unsafe SSH host values that could let a poisoned config or argument trigger unintended local command execution.

Review before installing. Use only trusted OpenClaw config files and explicit trusted host mappings, avoid shared or attacker-writable target directories, and do not run the installer as root. The bridge behavior itself is disclosed, but the host validation and wrapper-write issues should be fixed or mitigated before use in higher-trust automation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/install-wrapper.sh:19

Finding

SSH Option Injection Through an Unvalidated Host Value

Content

View full analysis

/dev/null 2>&1; then local discovered discovered="$(python3 - "$OPENCLAW_CONFIG" "$tool" <<'PY' import json import sys from pathlib import Path config_path = Path(sys.argv[1]) tool = sys.argv[2] cfg = json.loads(config_path.read_text()) channels = cfg.get("channels") or {} channel_by_tool = { "imsg": "imessage", "remindctl": "reminders", "memo": "notes", "things": "things", "peekaboo": "peekaboo", } channel_name = channel_by_tool.get(tool) if channel_name: channel = channels.get(channel_name) or {} remote_host = channel.get("remoteHost") if isinstance(remote_host, str) and remote_host.strip(): print(remote_host.strip()) raise SystemExit(0) hosts = [] for channel in ch ...[truncated 2564 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/install-wrapper.sh:58

Finding

Symlink-Following Wrapper Creation Allows File Overwrite

Content

View full analysis

"$wrapper" chmod 755 "$wrapper" echo "Installed wrapper: $wrapper" ``` ### Technical Analysis The wrapper path is predictable because it is formed directly from the selected target directory and sanitized tool name. The installer writes to that path using ordinary truncating redirection. Shell redirection follows an existing symbolic link. The script does not verify that the destination is a regular file, reject symbolic links, check ownership or directory permissions, use exclusive creation, or write to a securely created temporary file before an atomic rename. If an attacker can create or replace entries in the target directory, the attacker can pre-position a symbolic link at the expected wrapper path. When another user runs the installer, the redirection truncates and replaces the contents of the symlink target. The subsequent `chmod 755` can also alter the target file's permissions on platforms where `chmod` follows symbolic links. ### Attack Path 1. The attacker has write access to the selected target directory or can replace an existing wrapper entry. 2. The attacker predicts the wrapper name, such as `imsg`, `brew`, or `gh`. 3. The attacker creates `$TARGET_DIR/` as a symbolic link to a file writable by the user who will run the installer. 4. A victim or privileged automation process runs `install-wrapper.sh` or `install-macos-pack.sh`. 5. The redirection `> "$wrapper"` follows the symbolic link and truncates the linked file. 6. The script writes generated wrapper content into the target and applies executable permissions. 7. The linked file is corrupted or replaced, potentially altering another script or executable that will later be trus ...[truncated 614 chars]

Remediation

View remediation

&2 exit 1 fi ``` 3. Do not rely only on a pre-write symlink check, because it can introduce a time-of-check/time-of-use race. 4. Create the wrapper through `mktemp` in the same target directory, write and validate the complete content, set its permissions, and atomically rename it into place. 5. Ensure the temporary file is created with restrictive permissions, such as mode `0600`, before changing the final wrapper to `0755`. 6. Refuse to overwrite destinations that are not regular files or are owned by another user. 7. Avoid running the installer as root. If elevated installation is necessary, create and verify the target directory before dropping privileges for file generation. 8. Add tests using pre-existing symlinks, dangling symlinks, non-regular files, and concurrent destination replacement attempts. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 81% confidence

Finding

The declared description presents the skill as a legacy Linux-to-Mac wrapper install bridge, implying installation/bridging behavior. The supplied code does not perform installs or bridging logic; instead, it renders a configuration/tool ownership map by reading a local config file and outputting host assignments for tools like imsg, brew, and gh. This is a materially different primary purpose from wrapper installation. While the output relates to Mac-owned tools, the code’s actual behavior is configuration discovery/rendering rather than a bridge installer, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description says this skill is a legacy combined bridge for Linux-to-Mac wrapper installs, implying installation/bridge setup behavior. The supplied code does not install, create, or bridge anything. It only validates whether expected wrapper files exist in a target directory, checks if they are executable, parses a WAKE_MAC line from each file, and prints a status table. That is a materially different primary purpose from installation/bridging, so this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

- `scripts/install-wrapper.sh`: create one SSH wrapper for a remote binary

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill advertises shell and file-read-capable behavior but does not declare any explicit tool scope such as allowed-tools or permissions. In a bridge skill that installs wrappers, reads local config, and interacts with remote hosts, missing scope increases the chance of overbroad execution or unintended command/file access by downstream agents.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a legacy bridge skill for Linux-to-Mac wrapper installs, which clearly justifies generating an SSH-based wrapper script. However, this code also embeds active Wake-on-LAN functionality that sends UDP broadcast packets to power on a remote machine, which is a broader operational behavior than a simple wrapper installer implies.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

After SSH failure, the generated wrapper automatically sends a Wake-on-LAN magic packet and retries execution. Broadcasting packets to wake remote hardware is a distinct network-control capability, and the manifest description does not mention remote power-management or broadcast networking as part of this skill's purpose.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/install-wrapper.sh (reported line 144)May include surrounding context.

sh

EOF
} > "$wrapper"

chmod 755 "$wrapper"
echo "Installed wrapper: $wrapper"

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This shell script creates a target directory, generates a new wrapper script, and makes it executable. Although it prints the installed path at the end, there is no advance disclosure, confirmation prompt, or comment/docstring warning that running the script will modify the local filesystem by writing an executable file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The emitted wrapper uses SSH to execute a remote binary and may send a Wake-on-LAN UDP broadcast packet. While some runtime status is printed only after an SSH failure, the file lacks upfront comments or warnings explaining that using the wrapper will transmit data over the network and execute commands on a remote host.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.