Cloudflare Access VPS

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 9:20 AM UTC
• Version: 1.0.0

Overview

This documentation-only skill explains how to protect an OpenClaw VPS with Cloudflare Access, with disclosed credential-token risks but no hidden code or destructive behavior.

Before installing, treat this as operational security documentation: use service tokens only for clients that need programmatic access, avoid non-expiring tokens unless necessary, store secrets outside git, rotate and revoke tokens promptly, and be careful with rollback steps that bypass Cloudflare Access.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Credential Access

High

• Category: Privilege Escalation

Content

- Treat service tokens like API keys — store in vault, never commit to git
- Create one token per client/device (granular revocation)
- Revoke immediately if a device is lost: **Zero Trust → Service Auth → Revoke**
- For CLI tools, store in `~/.openclaw/secrets.json` and reference via SecretRef

---

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Creating a Service Token

1. **Zero Trust → Access → Service Auth → Service Tokens → Create Service Token**
2. Name it descriptively: `OpenClaw CLI - Charles laptop`, `iOS App - Koda`
3. Set **Token Duration**: `Non-expiring` for permanent apps, or a date for time-limited access
4. Copy **both** values immediately — the secret is only shown once

• Confidence: 89% confidence
• Finding: The documentation explicitly recommends that service tokens may be configured as non-expiring, and elsewhere states that such tokens are permanent until rotated. Long-lived bearer-style credentials materially increase risk because a leaked token can provide durable bypass access to the protected application without normal browser-based authentication, especially in this skill's context of guarding an agent-facing endpoint.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Symptom:** OpenClaw UI loads (GET requests pass), but the WebSocket fails to connect. Error in browser console: `WebSocket connection failed` or `401`.

**Cause:** Browser WebSocket upgrade requests don't automatically send the Cloudflare Access JWT cookie. Cloudflare Access uses a cookie (`CF_Authorization`) set at the browser level — this IS sent automatically on same-origin WebSocket connections from an authenticated browser session.

**If the WS still fails:**
1. Confirm you're using `wss://` not `ws://` — Cloudflare requires TLS

• Confidence: 80% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Intent-Code Divergence

Low

• Confidence: 81% confidence
• Finding: The troubleshooting step states that for email OTP, the login email must match the policy exactly and be case-sensitive. Email identity matching is generally normalized case-insensitively by identity systems, so this guidance likely contradicts actual Access behavior rather than merely omitting nuance.

Static analysis

No suspicious patterns detected.