OpenClaw VPS Deploy

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:36 AM UTC
• Version: 1.1.0

Overview

This VPS deployment skill matches its stated purpose but needs Review because it runs a persistent root service, handles secrets, exposes a public HTTP gateway, and contains serious unsafe deployment code.

Review and harden this before use. Use a dedicated VPS and deployment key, verify SSH host keys, pin trusted package and repository versions, avoid copying private keys to /tmp, do not expose the raw gateway over public HTTP, place it behind TLS or a tunnel, run the service as an unprivileged account, and rotate any tokens or API keys exposed during setup.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (7)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/deploy.py:76

Finding

Unverified Remote NodeSource Script Executed as Root

Content

View full analysis

None: step("Installing Node.js 22") run(client, "apt-get update -qq", timeout=120) run(client, "apt-get install -y curl git ufw 2>&1 | tail -3", timeout=120) run(client, "curl -fsSL https://deb.nodesource.com/setup_22.x | bash - 2>&1 | tail -3", timeout=60) run(client, "apt-get install -y nodejs 2>&1 | tail -3", timeout=120) ``` ### Technical Analysis The deployment downloads a mutable shell script from `deb.nodesource.com` and immediately pipes it into `bash`. No checksum, signature, pinned artifact version, or content review is performed before execution. The script connects as `root` by default, meaning the downloaded content executes with unrestricted administrative privileges. HTTPS authenticates the current server endpoint but does not protect against upstream compromise, malicious changes to the mutable setup script, certificate-authority compromise, or a compromised delivery infrastructure. Although installing Node.js is necessary for the declared deployment function, executing an unverified remote script as root is not the minimum-risk installation method. ### Attack Path 1. An attacker compromises the NodeSource distribution endpoint, account, DNS path, or content-delivery infrastructure. 2. The attacker replaces or modifies `setup_22.x`. 3. An administrator runs the deployment script against a VPS. 4. The deployment downloads the modified script and sends it directly to `bash`. 5. The payload executes as root and can alter the operating system before package installation continues. ### Impact Assessment Successful exploitation provides arbitrary root code execution on the target VPS. An attacker could install persistent services, steal API keys and gateway tokens, modify SSH c ...[truncated 104 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/deploy.py:89

Finding

Remote Root Command Injection Through the Repository Argument

Content

View full analysis

&1 | tail -2", timeout=60) run(client, "npm install -g pnpm 2>&1 | tail -3", timeout=120) run(client, f"rm -rf /opt/openclaw && git clone --depth 1 {repo} /opt/openclaw", timeout=120) run(client, "cd /opt/openclaw && pnpm install --frozen-lockfile 2>&1 | tail -5", timeout=300) run(client, "cd /opt/openclaw && pnpm build 2>&1 | tail -5", timeout=300) # Link binary run(client, "ln -sf /opt/openclaw/dist/index.js /usr/local/bin/openclaw && chmod +x /usr/local/bin/openclaw", timeout=10) binary = "/usr/local/bin/openclaw" else: # npm install from registry run(client, f"npm install -g {repo} 2>&1 | tail -8", timeout=300) ``` ### Technical Analysis The user-controlled `--repo` argument is interpolated directly into remote shell command strings. It is neither safely quoted nor validated against a strict npm-package or Git-URL grammar. The `run()` function passes the complete string to Paramiko's `exec_command()`, which invokes the remote command through a shell. Shell metacharacters in `repo`, including command separators, substitutions, redirections, and pipelines, can therefore alter the intended command. The default SSH user is root, so injected commands ordinarily execute with full administrative privileges. ### Attack Path 1. An attacker convinces an operator or automation system to use a crafted `--repo` value. 2. The value begins with a recognized URL prefix or is treated as an npm package expression. 3. Shell syntax embedded in the value is inserted into the `git clone` or `npm install` command. 4. The remote shell interprets the injected syntax. 5. The attacke ...[truncated 486 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/deploy.py:157

Finding

Root Command Injection While Writing the OpenClaw Configuration

Content

View full analysis

/root/.openclaw/openclaw.json', timeout=10) run(client, "chmod 600 /root/.openclaw/openclaw.json && chmod 700 /root/.openclaw", timeout=10) ``` ### Technical Analysis JSON containing the agent name, IP address, token, and API keys is embedded directly inside a double-quoted shell argument. Escaping double quotes and dollar signs does not constitute complete shell escaping. Backticks remain command-substitution syntax inside double quotes. Backslash combinations and other shell parsing edge cases can also change how the command is interpreted. At least the agent name and several other values can originate from command-line arguments or the environment. The resulting command is executed through the remote shell, typically under the root account. This creates both a command-injection risk and a reliability risk in which valid secret characters may be transformed or the generated JSON may become invalid. ### Attack Path 1. A crafted configuration value, such as `--name`, includes shell command-substitution syntax. 2. `json.dumps()` serializes the value, but the subsequent replacements do not neutralize every shell construct. 3. The JSON is inserted into the double-quoted `echo` command. 4. The remote shell evaluates the remaining substitution syntax. 5. The injected command executes as root while the configuration is being written. ### Impact Assessment An attacker able to influence a configuration value can obtain arbitrary root command execution on the VPS. Exploitation may expose all server data, API credentials, gateway tokens, SSH configurat ...[truncated 141 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/deploy.py:67

Finding

SSH Server Identity Verification Is Disabled

Content

View full analysis

paramiko.SSHClient: client = paramiko.SSHClient() client.set_missing_host_key_policy(paramiko.AutoAddPolicy()) print(f"🔌 Connecting to {user}@{ip}:{port} …") client.connect(ip, port=port, username=user, key_filename=key_path, timeout=30) print("✅ Connected") return client ``` ### Technical Analysis `AutoAddPolicy()` automatically trusts any previously unknown SSH host key. The deployment does not load trusted known-host records or compare the presented key with an operator-supplied fingerprint. SSH private-key authentication proves the client identity to the server; it does not compensate for failure to authenticate the server. On a first connection, an active network attacker can impersonate the VPS and receive every subsequently transmitted deployment command and secret. Use of an SSH key is necessary and appropriate for the declared remote-deployment functionality. Automatically accepting the server identity is not necessary. ### Attack Path 1. An attacker gains a man-in-the-middle position during the first SSH connection or redirects traffic for the target IP. 2. The attacker presents an arbitrary SSH host key. 3. `AutoAddPolicy()` accepts that key without operator confirmation. 4. The client authenticates to the impersonating endpoint and begins deployment. 5. The script transmits API keys, gateway tokens, configuration, and administrative commands to the attacker-controlled server. ### Impact Assessment The attacker can obtain Anthropic and OpenAI API keys, the generated OpenClaw gateway token, deployment configuration, and operational details. The attacker can also return misleading command output and cause the operator to believe the intended VPS was configured. This issu ...[truncated 98 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: scripts/deploy.py:34

Finding

Unpinned Dependencies Are Installed and Executed at Runtime

Content

View full analysis

&1 | tail -2", timeout=60) run(client, "npm install -g pnpm 2>&1 | tail -3", timeout=120) run(client, f"rm -rf /opt/openclaw && git clone --depth 1 {repo} /opt/openclaw", timeout=120) run(client, "cd /opt/openclaw && pnpm install --frozen-lockfile 2>&1 | tail -5", timeout=300) run(client, "cd /opt/openclaw && pnpm build 2>&1 | tail -5", timeout=300) else: # npm install from registry run(client, f"npm install -g {repo} 2>&1 | tail -8", timeout=300) ``` ### Technical Analysis The script installs the latest available `paramiko` and `pnpm` releases rather than reviewed, pinned versions. It also accepts an arbitrary npm package expression or Git repository through `--repo`. Package installation can execute build and lifecycle scripts. Remote npm and Git installation occurs under the default root SSH session, so malicious installation scripts or compromised dependencies execute with administrative privileges. The local Paramiko installation uses `--break-system-packages`, potentially modifying the system-managed Python environment and causing dependency conflicts. The exact local privileges depend on how the deployment script is invoked, but no isolated virtual environment or hash verification is used. `pnpm install --frozen-lockfile` improves reproducibility only when the selected repository and lockfile are trusted and pinned. The repository is cloned from its current default branch without selecting or verifying a commi ...[truncated 826 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/deploy.py:172

Finding

Persistent Network Service Runs with Unnecessary Root Privileges

Content

View full analysis

/etc/systemd/system/openclaw.service << 'EOF'\n{service}\nEOF", timeout=10) run(client, "systemctl daemon-reload", timeout=15) run(client, "systemctl enable openclaw", timeout=10) run(client, "systemctl restart openclaw", timeout=30) ``` ### Technical Analysis Creating and enabling a system service is consistent with the declared goal of running OpenClaw continuously, so the persistence mechanism is disclosed and functionally relevant. However, the gateway is configured to run as root indefinitely and restart automatically after failure. A network-facing application generally does not require unrestricted root privileges to listen on port `18789` or access its own configuration. Running the gateway, custom forks, npm packages, plugins, and their dependencies as root violates least privilege. The service unit also lacks common systemd sandboxing controls. Consequently, exploitation of OpenClaw or any loaded component immediately crosses the application boundary into full operating-system compromise. The same root-service pattern is also documented in `SKILL.md:109-129` and `references/multi-agent.md:125-156`. ### Att ...[truncated 834 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/deploy.py:140

Finding

Gateway Is Exposed Publicly over Unencrypted HTTP

Content

View full analysis

None: step("Configuring UFW firewall") run(client, f"ufw allow 22/tcp && ufw allow {gw_port}/tcp && ufw --force enable", timeout=30) ``` ### Technical Analysis The gateway binds to a LAN-accessible interface, the firewall opens its port, and the allowed origin explicitly uses `http://` with the public server IP. The deployment instructions also direct users to access the service through a plaintext HTTP URL. Token authentication controls who may access the gateway but does not encrypt the token or application traffic. Any party able to observe or modify traffic between the client and VPS may capture the bearer token, inspect sessions, or tamper with responses. Opening the raw gateway port by default also increases the service's direct internet-facing attack surface. The multi-agent documentation recommends private ports behind a Cloudflare Tunnel, but the primary deployment script does not adopt that safer default. ### Attack Path 1. The deployment binds OpenClaw to the network and opens the gateway port in UFW. 2. A user visits the documented public `http://SERVER_IP:PORT` endpoint. 3. The browser transmits the gateway token and application data without TLS protection. 4. An attacker with a suitable network observation or interception position captures or modifies the traffic. 5. A captured bearer token is replayed ...[truncated 408 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (33)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

# Official package (most common)
python3 scripts/deploy.py \
  --ip 187.124.84.25 \
  --key ~/.ssh/id_ed25519 \
  --name "Koda"

# Custom git fork

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

# Official package (most common)
python3 scripts/deploy.py \
  --ip 187.124.84.25 \
  --key ~/.ssh/id_ed25519 \
  --name "Koda"

# Custom git fork

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Automatically reading ANTHROPIC_API_KEY from ~/.openclaw/secrets.json or the environment is sensitive credential access. In an agent skill, implicit secret retrieval without a clear permission boundary or explicit user acknowledgment can lead to unintended credential use and broader exposure if logs, errors, or downstream commands mishandle the value.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

--gw-port 18789

text

The script auto-reads `ANTHROPIC_API_KEY` from the local OpenClaw vault (`~/.openclaw/secrets.json`) or environment. Pass `--anthropic` to override.

## What the Script Does

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The WSL2 section instructs users to copy a Windows private SSH key into /tmp, which increases exposure of highly sensitive credential material on the local system. Even with restrictive permissions, temporary locations are easier to mishandle, leave behind, or access inadvertently compared with using the key in place or an agent-based workflow.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

SSH Key on WSL2

The user's Windows SSH key is accessible at /mnt/c/Users/<username>/.ssh/id_ed25519 in WSL2. Copy it with correct permissions before use:

bash

cp /mnt/c/Users/charl/.ssh/id_ed25519 /tmp/vps_key

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

This example continues the unsafe temporary-key workflow by passing the copied /tmp/vps_key into the deployment script. If that file persists or is accessed by another local process or backup mechanism, the user's SSH credential could be exposed and reused to access the VPS.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

The user's Windows SSH key is accessible at /mnt/c/Users/<username>/.ssh/id_ed25519 in WSL2. Copy it with correct permissions before use:

bash

cp /mnt/c/Users/charl/.ssh/id_ed25519 /tmp/vps_key
chmod 600 /tmp/vps_key
python3 scripts/deploy.py --ip 1.2.3.4 --key /tmp/vps_key

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The documentation includes a one-liner that enumerates and prints stored VPS auth tokens from the local secrets vault. That is an explicit credential disclosure pattern: it normalizes dumping secrets to stdout, where they may be captured in terminal history, logs, screenshots, or agent transcripts.

Content

Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.

md

Navigate to `http://SERVER_IP:18789`. When prompted for an auth token, use the value stored in:
- Local vault: `OPENCLAW_VPS_<IP_WITH_UNDERSCORES>_TOKEN`
- Or retrieve: `python3 -c "import json; v=json.load(open('/home/charl/.openclaw/secrets.json')); [print(k,v[k]) for k in v if 'VPS' in k and 'TOKEN' in k]"`

## Multi-Agent VPS Setup

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The document instructs operators to copy an existing private SSH key from a user workstation into /tmp/vps_key for automation. Even with chmod 600, placing long-lived private key material in /tmp increases risk of accidental disclosure, mishandling, persistence on disk, or reuse outside its intended scope; in a deployment skill, this is more dangerous because the skill normalizes credential movement across trust boundaries.

Content

Scanner excerpt · references/gotchas.md (reported line 98)May include surrounding context.

Hostinger VPS instances typically disable password auth after initial setup (or set a specific root password during creation that may differ from what you specified in a failed API purchase attempt).

Fix: Always use key-based auth. In WSL2, the Windows SSH key is at /mnt/c/Users/<username>/.ssh/id_ed25519.

python

client.connect(ip, port=port, username=user, key_filename="/tmp/vps_key")

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

The repo value is interpolated directly into a remote shell command: rm -rf /opt/openclaw && git clone --depth 1 {repo} /opt/openclaw. Because repo is user-controlled and unquoted, an attacker can inject shell metacharacters and execute arbitrary commands as root on the VPS, making this highly dangerous in a remote deployment context.

Content

Scanner excerpt · scripts/deploy.py (reported line 96)May include surrounding context.

python

# Clone and build from source
        run(client, "apt-get install -y git 2>&1 | tail -2", timeout=60)
        run(client, "npm install -g pnpm 2>&1 | tail -3", timeout=120)
        run(client, f"rm -rf /opt/openclaw && git clone --depth 1 {repo} /opt/openclaw", timeout=120)
        run(client, "cd /opt/openclaw && pnpm install --frozen-lockfile 2>&1 | tail -5", timeout=300)
        run(client, "cd /opt/openclaw && pnpm build 2>&1 | tail -5", timeout=300)
        # Link binary

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The repo value is interpolated directly into a remote shell command: rm -rf /opt/openclaw && git clone --depth 1 {repo} /opt/openclaw. Because repo is user-controlled and unquoted, an attacker can inject shell metacharacters and execute arbitrary commands as root on the VPS, making this highly dangerous in a remote deployment context.

Content

Scanner excerpt · scripts/deploy.py (reported line 96)May include surrounding context.

python

# Clone and build from source
        run(client, "apt-get install -y git 2>&1 | tail -2", timeout=60)
        run(client, "npm install -g pnpm 2>&1 | tail -3", timeout=120)
        run(client, f"rm -rf /opt/openclaw && git clone --depth 1 {repo} /opt/openclaw", timeout=120)
        run(client, "cd /opt/openclaw && pnpm install --frozen-lockfile 2>&1 | tail -5", timeout=300)
        run(client, "cd /opt/openclaw && pnpm build 2>&1 | tail -5", timeout=300)
        # Link binary

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Reading ~/.openclaw/secrets.json constitutes access to local credential storage on the operator machine. In a deployment tool, that is especially sensitive because it can collect API keys not explicitly supplied for this run and then embed them into remote configuration, expanding the blast radius from local compromise to remote service compromise.

Content

Scanner excerpt · scripts/deploy.py (reported line 241)May include surrounding context.

python

if not anthropic_key:
        # Try reading from OpenClaw vault
        vault_path = os.path.expanduser("~/.openclaw/secrets.json")
        if os.path.exists(vault_path):
            vault = json.load(open(vault_path))
            anthropic_key = vault.get("ANTHROPIC_API_KEY", "")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

Writing the generated remote auth token into a local secrets vault creates additional credential persistence on the operator machine. This broadens token exposure and may place infrastructure access secrets into a shared or unrelated local store without the user's informed approval.

Content

Scanner excerpt · scripts/deploy.py (reported line 294)May include surrounding context.

python

""")

        # Save token to local vault if possible
        vault_path = os.path.expanduser("~/.openclaw/secrets.json")
        if os.path.exists(vault_path):
            vault = json.load(open(vault_path))
            key_name = f"OPENCLAW_VPS_{args.ip.replace('.', '_')}_TOKEN"

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill describes operations that use shell commands, read environment/local secrets, and write configuration/service files, but it declares no explicit tool scope or permission boundary. That makes the skill harder to govern safely and increases the chance an agent executes sensitive actions without clear user awareness or platform enforcement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description frames the skill as making OpenClaw accessible via the cloud but does not clearly warn that it opens firewall ports and exposes a service on a public IP/URL. Users may invoke it without realizing it changes network exposure, which can lead to unintended internet-facing services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation states that the script auto-reads ANTHROPIC_API_KEY from local secret storage and later writes generated auth tokens back to the vault, but it does not present this as an explicit security warning. Silent secret ingestion and persistence can surprise users and increase the risk of accidental credential disclosure or mishandling.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

bash

cp /mnt/c/Users/charl/.ssh/id_ed25519 /tmp/vps_key
chmod 600 /tmp/vps_key
python3 scripts/deploy.py --ip 1.2.3.4 --key /tmp/vps_key

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/gotchas.md (reported line 104)May include surrounding context.

bash

cp /mnt/c/Users/charl/.ssh/id_ed25519 /tmp/vps_key
chmod 600 /tmp/vps_key
python3 scripts/deploy.py --ip 1.2.3.4 --key /tmp/vps_key

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/multi-agent.md (reported line 112)May include surrounding context.

bash

cp /mnt/c/Users/charl/.ssh/id_ed25519 /tmp/vps_key
chmod 600 /tmp/vps_key
python3 scripts/deploy.py --ip 1.2.3.4 --key /tmp/vps_key

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/gotchas.md (reported line 12)May include surrounding context.

md

| `openclaw gateway start` | Starts the **user-level systemd service** — requires D-Bus session |
| `openclaw gateway` | Runs the gateway **directly in foreground** — what you want in a system service |

**Symptom:** `Gateway service check failed: systemctl is-enabled unavailable: $DBUS_SESSION_BUS_ADDRESS not defined`

**Fix:** Use `openclaw gateway --bind lan --port 18789 --auth token --allow-unconfigured` as ExecStart.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/gotchas.md (reported line 57)May include surrounding context.

Symptom: Service starts, immediately exits with D-Bus error.

Fix: Add to systemd unit and create the directory:

ini

Environment=XDG_RUNTIME_DIR=/run/user/0

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/gotchas.md (reported line 62)May include surrounding context.

Environment=XDG_RUNTIME_DIR=/run/user/0

text

```bash
mkdir -p /run/user/0 && chmod 700 /run/user/0

---

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/multi-agent.md (reported line 72)May include surrounding context.

md

# 1. Create config directory
mkdir -p /root/agents/${AGENT_NAME}/.openclaw/agents/main/sessions
chmod 700 /root/agents/${AGENT_NAME}/.openclaw

# 2. Write openclaw.json
cat > /root/agents/${AGENT_NAME}/.openclaw/openclaw.json << EOF

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/deploy.py (reported line 161)May include surrounding context.

python

# 1. Create config directory
mkdir -p /root/agents/${AGENT_NAME}/.openclaw/agents/main/sessions
chmod 700 /root/agents/${AGENT_NAME}/.openclaw

# 2. Write openclaw.json
cat > /root/agents/${AGENT_NAME}/.openclaw/openclaw.json << EOF

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/deploy.py (reported line 195)May include surrounding context.

python

# 1. Create config directory
mkdir -p /root/agents/${AGENT_NAME}/.openclaw/agents/main/sessions
chmod 700 /root/agents/${AGENT_NAME}/.openclaw

# 2. Write openclaw.json
cat > /root/agents/${AGENT_NAME}/.openclaw/openclaw.json << EOF

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide writes an API key and generated auth token into a persistent JSON file under /root without explicit warnings about secret lifecycle, shell history/logging, backup exposure, or process/operator disclosure. While permissions are tightened afterward, the documentation still encourages storing high-value credentials in plaintext configuration and echoing the token to the terminal, increasing the chance of accidental exposure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/multi-agent.md (reported line 156)May include surrounding context.

Enable and start:

bash

systemctl daemon-reload
systemctl enable openclaw-alex
systemctl start openclaw-alex
systemctl status openclaw-alex

Static analysis

No suspicious patterns detected.