OpenClaw VPS Deploy

• Outcome: Review
• Latest audit: May 29, 2026 at 9:22 PM UTC
• Version:
  1.1.0

Overview

This skill appears to do what it claims, but it deploys a persistent, internet-reachable root service while handling API keys, SSH trust, and auth tokens in ways users should review carefully.

Install only if you are comfortable giving the skill root SSH access to the VPS and copying model-provider credentials to that server. Verify the VPS SSH fingerprint, avoid placing private keys in /tmp, use a dedicated low-blast-radius API key, use only trusted repo/package values, keep the gateway behind HTTPS, VPN, or a tunnel where possible, protect and rotate tokens, and close the public port or disable the service when it is no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The script silently reads credentials from a local OpenClaw secrets vault and later persists generated deployment tokens back into that vault. That exceeds the minimum scope of VPS deployment and creates implicit credential access and storage behavior that a user may not expect, increasing the chance of secret exposure or misuse on the operator machine.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The systemd service starts the gateway with --auth token but does not supply the token value, while also enabling --allow-unconfigured. In a deployment script whose purpose is to expose a service on a public VPS, this mismatch can leave the service reachable in an incompletely configured or unexpectedly permissive state, undermining intended authentication.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation says the deployment saves auth tokens to a local vault and later shows how to retrieve them, but it does not warn that these are sensitive credentials or restrict how they should be displayed. This increases the chance of accidental token exposure through terminal history, screenshots, logs, or overly broad local access.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs opening UFW ports and making the OpenClaw gateway reachable at a public URL, while also using LAN binding and allowed origins that include the public IP. Public exposure of an admin/control interface substantially increases attack surface, especially if users deploy with weak token hygiene or default networking assumptions.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly instructs copying an SSH private key to /tmp for authentication. Even with chmod 600, /tmp is a globally shared, temporary location that increases the risk of accidental exposure, race conditions, improper cleanup, or access by other privileged processes; in a VPS deployment skill handling real credentials, this is a meaningful operational security weakness.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The guidance recommends adding a public IP to allowedOrigins so the control UI can be accessed remotely, but it does not warn that this broadens remote browser access to an administrative interface. In the context of a cloud-hosted OpenClaw deployment, exposing the control UI over a public IP materially increases attack surface and can enable unauthorized interaction if authentication, TLS, or origin restrictions are misconfigured.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The guide prints the generated agent authentication token directly to the terminal without warning about handling, storage, shell history, logs, or operator exposure. In an administrative VPS setup, this can leak credentials through shared terminals, session recording, command transcripts, or screenshots, enabling unauthorized access to the remote OpenClaw gateway.

VirusTotal

66/66 vendors flagged this skill as clean.