Security audit

macOS Bridge

Security checks for vulnerabilities and agentic risk

Overview

The skill’s purpose is coherent, but its installer can persist an unvalidated SSH destination into executable wrappers, creating a real local command-execution risk if that host value is influenced.

Install only if you control the OpenClaw config and all host mappings. Review every --map, --default-host, and remoteHost value before installation, reject any value that starts with '-' or contains SSH options, and prefer waiting for a version that validates SSH destinations before writing wrappers.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/install-wrapper.sh:83
Finding: SSH Option Injection Through an Unvalidated Remote Host
Content: View full analysis
&2 echo "Provide --map $tool=user@host, --default-host user@host, or configure a matching remoteHost in $OPENCLAW_CONFIG." >&2 exit 1 } ``` ```bash cmd=( "$INSTALL_WRAPPER" --name "$tool" --host "$host" --remote-bin "$remote_bin" --target-dir "$TARGET_DIR" ) ``` ### Technical Analysis The host value is accepted from `--host`, `--map`, `--default-host`, or an OpenClaw `remoteHost` setting without enforcing valid `host` or `user@host` syntax. In particular, values beginning with a hyphen are not rejected. Although `printf '%q'` safely serializes the value into the generated Bash script and prevents direct shell metacharacter expansion ...[truncated 2291 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.
md
- `scripts/install-wrapper.sh`: create one SSH wrapper for a remote binary

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill instructs the agent to read local configuration files and run shell scripts, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens the security boundary because an agent may execute file and shell actions without clear least-privilege constraints, making unintended command execution or sensitive file access more likely if the skill is invoked in the wrong context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The default prompt encourages broad use of the skill via a generic invocation phrase without specifying clear preconditions, user confirmation requirements, or narrow trigger boundaries. Because this skill bridges network-capable Mac-owned tools onto a Linux gateway and includes SSH wrapper installation, auto-discovery, and optional Wake-on-LAN, overly broad activation increases the chance the agent invokes sensitive network and system-integration behavior in contexts the user did not explicitly intend.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/install-wrapper.sh (reported line 144)May include surrounding context.
sh
EOF } > "$wrapper" chmod 755 "$wrapper" echo "Installed wrapper: $wrapper"

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This code creates the target directory, writes a new wrapper script, and changes its permissions, which are file-modifying operations. Although it prints a completion message after installation, there is no advance disclosure, confirmation prompt, or explanatory comment/docstring warning the user that running the script will create executable files at the specified path.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 75% confidence
Finding: The emitted wrapper uses SSH to contact a remote host and can send a Wake-on-LAN broadcast packet, both of which are network actions that may affect user systems or reveal connection metadata. The file includes runtime error/status output, but it does not clearly document beforehand that the installed wrapper will initiate these network operations when invoked.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.