ClawHub
Back to skill

Security audit

Thetaedge Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a real ThetaEdge finance integration, but it grants sensitive credential and financially consequential API authority without enough guardrails.

Review this before installing. Use a limited ThetaEdge API key, avoid running the VM setup script unless you trust its remote installers, do not let the agent print API keys, keep credentials out of shared logs/transcripts, and require explicit final confirmation before any opportunity action or deletion.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
scripts/setup-openclaw-vm.sh:87
Finding

Unverified Remote Installers Are Executed Directly by Bash

Content
View full analysis

Vulnerability Details

File Location: scripts/setup-openclaw-vm.sh:82-88 and scripts/setup-openclaw-vm.sh:102-105
Vulnerability Type: Remote code execution through mutable network-delivered scripts
Risk Level: Critical

Vulnerable Code

bash
install_nodejs() {
    info "Installing nvm and Node.js 22..."

    export NVM_DIR="$HOME/.nvm"

    if [ ! -s "$NVM_DIR/nvm.sh" ]; then
        curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
    fi
}
bash
install_openclaw() {
    info "Installing OpenClaw..."
    curl -fsSL https://openclaw.ai/install.sh | bash || true
}

Technical Analysis

Both commands execute an HTTP response immediately through Bash. The downloaded content is not verified using a cryptographic checksum, signature, or pinned immutable artifact. The NVM URL contains a release version, but it points to a mutable GitHub branch/tag path rather than a verified commit digest. The OpenClaw URL is an unversioned installer whose contents can change after this Skill has been reviewed.

TLS protects traffic in transit under normal conditions, but it does not protect against compromise of the hosting account, website, release infrastructure, DNS/TLS trust chain, or upstream installer. The || true suffix on the OpenClaw installation additionally suppresses failure and allows provisioning to continue in a partially compromised or inconsistent state.

These installers run as the VM user and may alter shell startup files, install executable packages, inspect Agent configuration, or invoke sudo. During the documented workflow, the environment may also expose a forwarded SSH agent and later store API credentials.

Attack Path

  1. An attacker compromises the remote installer host, repository account, release tag, or delivery infrastructure.
  2. The attacker replaces the installer response with malicious shell commands.
  3. A user runs `scri ...[truncated 869 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not pipe network responses directly into a shell.
  2. Download each installer into a newly created, owner-only temporary directory.
  3. Pin the artifact to an immutable commit or versioned release.
  4. Verify a publisher-provided SHA-256 checksum or cryptographic signature before execution.
  5. Abort immediately if download or verification fails.
  6. Display the exact artifact version and source before asking the user to approve execution.
  7. Prefer Ubuntu packages or another package manager with signature and integrity verification.
  8. Remove || true so installation failures cannot be silently ignored.
  9. Avoid exposing SSH-agent forwarding while untrusted installation code is executing.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/lib/common.py:182
Finding

Unrestricted API Base Can Exfiltrate the ThetaEdge Bearer Credential

Content
View full analysis

Vulnerability Details

File Location: scripts/lib/common.py:182-198, with attacker-controlled input accepted at scripts/install.py:52-54 and scripts/install-thetix-skill.sh:60-61
Vulnerability Type: Credential exfiltration through an unvalidated destination
Risk Level: High

Vulnerable Code

python
def test_api_connection(api_base: str, api_key: str, timeout: int = 5) -> tuple:
    """Make a test GET /api/accounts call. Returns (ok, message)."""
    url = f"{api_base.rstrip('/')}/api/accounts"
    req = urllib.request.Request(url, headers={"Authorization": f"Bearer {api_key}"})
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            if resp.status == 200:
                return True, "API key accepted"
            return False, f"Unexpected status {resp.status}"
    except urllib.error.HTTPError as e:
        if e.code in (401, 403):
            return False, "API key is invalid or expired"
        return False, f"HTTP {e.code}: {e.reason}"
    except (urllib.error.URLError, OSError) as e:
        return False, f"Could not reach API: {e}"

The Python installer accepts an arbitrary base URL:

python
p.add_argument(
    "--api-base",
    default=DEFAULT_API_BASE,
    help=f"API base URL (default: {DEFAULT_API_BASE})",
)

The shell installer also accepts an arbitrary destination and defaults to plaintext HTTP:

bash
read -rp "ThetaEdge API base URL [http://localhost:3200]: " api_base
api_base="${api_base:-http://localhost:3200}"

The same unsafe destination model is present in SKILL.md, which directs authenticated requests to $THETAEDGE_API_BASE:

bash
curl -s -H "Authorization: Bearer $THETAEDGE_API_KEY" "$THETAEDGE_API_BASE/api/..."

Technical Analysis

The API base is read from command-line input or credential configuration without validating its scheme, hostname, port, or resolved network add ...[truncated 1640 chars]

Remediation
View remediation

Remediation Suggestions

  1. Restrict authenticated production requests to an explicit allowlist, normally https://api.thetaedge.ai.
  2. Parse URLs with a standard URL parser and reject embedded credentials, fragments, unexpected ports, and non-HTTPS schemes.
  3. Permit plaintext HTTP only for an explicitly enabled development mode and only after verifying that the destination resolves exclusively to loopback.
  4. Disable automatic redirects for authenticated requests, or strip authorization before every cross-origin redirect.
  5. Resolve and validate the destination immediately before connection to reduce DNS rebinding risk.
  6. Show a prominent warning and require separate confirmation before sending a bearer token to any non-default endpoint.
  7. Store development and production credentials separately so a production credential is never sent to a local or custom server.

T09 · Insecure Skill Coding Practices

Error
Location
scripts/install-thetix-skill.sh:60
Finding

Credential Values Are Interpolated into Executable Python Source

Content
View full analysis

Vulnerability Details

File Location: scripts/install-thetix-skill.sh:60-101
Vulnerability Type: Code injection through unsafe shell-to-Python interpolation
Risk Level: High

Vulnerable Code

bash
read -rp "ThetaEdge API base URL [http://localhost:3200]: " api_base
api_base="${api_base:-http://localhost:3200}"

echo "Enter your ThetaEdge API key (input is hidden):"
read -rs api_key
echo ""

if [ -f "$OPENCLAW_CONFIG" ]; then
    info "Merging thetix config into existing $OPENCLAW_CONFIG..."

    tmp_config="$(mktemp)"

    if command -v python3 &>/dev/null; then
        python3 -c "
import json, sys

with open('$OPENCLAW_CONFIG') as f:
    config = json.load(f)

config.setdefault('skills', {}).setdefault('entries', {})
config['skills']['entries']['thetix'] = {
    'enabled': True,
    'env': {
        'THETAEDGE_API_KEY': '''$api_key''',
        'THETAEDGE_API_BASE': '''$api_base'''
    }
}

with open('$tmp_config', 'w') as f:
    json.dump(config, f, indent=2)
    f.write('\n')
"
        mv "$tmp_config" "$OPENCLAW_CONFIG"
    fi
fi

Technical Analysis

The API key and API base are inserted into the source text passed to python3 -c. Triple-quoted Python literals do not make this safe: input containing a closing triple quote can terminate the intended string and append arbitrary Python statements.

The configuration and temporary-file paths are also interpolated into Python string literals rather than passed as data. Although those paths are normally derived from $HOME and mktemp, unusual path characters can similarly alter the generated program.

Hidden terminal input only prevents shoulder surfing; it does not validate the value or stop it from becoming executable syntax.

Attack Path

  1. The attacker convinces a user to enter a crafted API base or API key, or supplies it through an automated wrapper around the installer.
  2. The cra ...[truncated 723 chars]
Remediation
View remediation

Remediation Suggestions

  1. Never generate Python source using shell-expanded user input.
  2. Pass values as positional arguments or environment variables and retrieve them from sys.argv or os.environ.
  3. Pass configuration paths in the same data-only manner.
  4. Prefer invoking the existing Python installer and its set_credentials() function instead of maintaining a separate JSON merge implementation.
  5. Validate the API base independently before writing it.
  6. Write the merged JSON to an owner-only temporary file in the destination directory, flush and synchronize it, then atomically replace the configuration.
  7. Add regression tests with quotes, triple quotes, newlines, backslashes, Unicode, and shell metacharacters in every accepted field.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:34
Finding

Skill Instructions Reveal the Complete API Key in Agent Tool Output

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:34-43
Vulnerability Type: Secret exposure through command output and Agent transcripts
Risk Level: Medium

Vulnerable Code

markdown
### Loading credentials

1. **Check shell environment first** — Run `echo $THETAEDGE_API_KEY` in Bash. If both vars are already set, skip to the curl pattern below. If `THETAEDGE_API_BASE` is not set, default to `https://api.thetaedge.ai`.
2. **Read from config file** — If the vars are not set, check these locations in order:
   - `~/.openclaw/openclaw.json` — Extract `THETAEDGE_API_KEY` and `THETAEDGE_API_BASE` from `skills.entries.thetix.env`
   - `~/.config/thetaedge/credentials.json` — Extract `api_key` and `api_base`
   Then export them in Bash:
   ```bash
   export THETAEDGE_API_KEY="<value from config>"
   export THETAEDGE_API_BASE="<value from config>"
   ```

Technical Analysis

echo $THETAEDGE_API_KEY prints the complete secret into Bash tool output. Agent frameworks commonly preserve tool invocations and output in conversation transcripts, diagnostic logs, observability systems, or session recordings. Checking whether an environment variable exists does not require exposing its value.

Reading credential files and then reconstructing export commands with literal values can also place secrets into generated shell commands or transcript content, depending on how the Agent follows the instructions.

Attack Path

  1. The user configures THETAEDGE_API_KEY.
  2. The user invokes the Skill.
  3. The Agent follows the credential-loading instruction and runs echo $THETAEDGE_API_KEY.
  4. Bash returns the full key as tool output.
  5. The value is retained in the Agent conversation, logs, or monitoring records.
  6. A person or service with access to those records can reuse the key.

Impact Assessment

This issue can disclose the full ThetaEdge bearer credential to any party with ac ...[truncated 234 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the echo command with a presence check that does not reveal the value:
    bash
    if [ -n "${THETAEDGE_API_KEY:-}" ]; then
    printf '%s\n' "THETAEDGE_API_KEY is configured"
fi
  2. Do not print, summarize, or partially reproduce secrets in Agent responses.
  3. Avoid generating commands containing literal credential values.
  4. Use framework-managed secret injection where available.
  5. Redact authorization headers and known secret fields from tool logs and diagnostics.
  6. Advise affected users to rotate keys that may already have appeared in retained transcripts.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:220
Finding

Financial Opportunity Execution Lacks a Mandatory User-Confirmation Boundary

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:220-229, corroborated by reference.md:384-404
Vulnerability Type: Financially consequential action without enforced confirmation
Risk Level: High

Vulnerable Code

markdown
### Browsing Opportunities

- `GET /api/opportunities` — List opportunities, filterable by `tickers`, `status`, `accountId`, `limit`, `risk_level`, `frequency`, `generated_date_start`, `generated_date_end`
- `GET /api/opportunities/<id>` — Full opportunity details with rationale
- `POST /api/opportunities/<id>` — Act on or dismiss an opportunity (`action: "act"` or `action: "dismiss"`)
- `POST /api/opportunities/<id>/feedback` — Rate and comment on an opportunity (`rating: 1-5`, `comments: "string"`)

The API reference describes the effect as execution:

markdown
### Act on Opportunity
POST /api/opportunities/<opp_id>

{
  "action": "act | dismiss",
  "reason": "string (optional, for dismiss)",
  "details": {
    "strike": "number (optional)",
    "expiration": "YYYY-MM-DD (optional)",
    "contracts": "number (optional)",
    "premium": "number (optional)",
    "closePrice": "number (optional, for rolls)"
  }
}

Use `action: "act"` to execute the opportunity or `action: "dismiss"` to reject it. The `details` object allows overriding opportunity parameters when acting.

Technical Analysis

The Skill exposes an authenticated endpoint explicitly described as executing an opportunity, including overrides for contracts, strike, expiration, premium, and close price. Its instructions do not impose a mandatory order preview, fresh explicit confirmation, account verification, transaction limit, or read-only default before using action: "act".

Natural-language requests are inherently ambiguous. Without a confirmation boundary, the Agent may interpret a request to inspect, discuss, or prepare an opportunity as authorization to ex ...[truncated 1110 chars]

Remediation
View remediation

Remediation Suggestions

  1. Make the Skill read-only by default and separate execution into a distinct, explicitly enabled permission.
  2. Require the preview endpoint before every action: "act" request.
  3. Present the account, ticker, strategy, strike, expiration, contract count, premium, total exposure, maximum loss, and estimated fees to the user.
  4. Require fresh, unambiguous confirmation immediately before submission; earlier general consent must not count.
  5. Do not infer confirmation from phrases such as “looks good,” “consider this,” or “what if.”
  6. Bind confirmation to an immutable preview identifier or hash to prevent parameters changing after approval.
  7. Enforce server-side transaction limits, idempotency keys, audit logging, and reauthentication for execution.
  8. Clearly distinguish dismissing, saving, previewing, and executing an opportunity in the Skill instructions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (80)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

git clone https://github.com/thetaedge/thetaedge-skill.git ~/.claude/skills/thetaedge-skill

text

Add your API key to `~/.claude/settings.json`:

```json
{

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents an end-user finance and trading skill with capabilities around market data, portfolio analysis, options screening, accounts, and trading ideas. The actual code does none of those things. Instead, it is an infrastructure utility script for establishing SSH tunnels (-L and -R port forwards) between localhost and a VM. This is a materially different primary purpose and introduces undeclared capabilities related to network access and service exposure. While such tunneling might support development or deployment of a finance platform, it is not itself one of the declared user-facing capabilities, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description describes user-facing finance and trading functionality. The actual code chunk does not implement any of those trading, portfolio, market-data, or idea-retrieval capabilities. Instead, it serves a materially different purpose: operational diagnostics for the skill installation. It inspects the local environment, checks for git, verifies installation paths, reads configured API credentials, tests API connectivity, and audits config permissions. Those are maintenance/installer support functions, not the declared finance assistant behaviors. This is therefore a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose describes end-user finance and trading capabilities of the ThetaEdge/Thetix skill itself. However, the provided code chunk does not implement any of those capabilities; it is purely a setup/install script for OpenClaw integration. Its primary behavior is local environment configuration: creating a symlink, collecting API credentials, editing ~/.openclaw/openclaw.json, and verifying installation. Those behaviors are not reflected in the declared description, and the actual code does not exhibit the declared finance-analysis, dashboard, options-screening, account, or ideas functionality. This is therefore a material description-versus-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description says the skill’s purpose is to provide trading, investing, portfolio, options, account, and ideas capabilities. However, this code chunk does not implement any of those end-user finance functions. Instead, it is an installation utility that sets up the skill for different agent platforms, manages repository placement/update, and stores API credentials. While installer code can be a supporting part of a skill package, the task here is to compare the declared skill description to what the supplied code chunk actually does. This chunk’s actual behavior is operational/devops setup rather than finance functionality, so the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents an end-user finance and trading intelligence skill with capabilities like chat, dashboards, opportunity screening, account listing, and trading ideas. The supplied code does not implement any of those finance-facing functions. Instead, it provides shared utilities for installation/configuration: locating config paths for different agent targets, persisting API keys, validating key format, testing connectivity to the ThetaEdge API, detecting OS/installed platforms, and running git commands. While contacting /api/accounts is loosely related to the declared Accounts capability, here it is only used as a credential/connectivity check, not to expose account data to the user. This is a materially different purpose for this code chunk, indicating the description does not accurately represent what this code actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description presents an end-user finance and options intelligence skill with capabilities around trading analysis, market data, brokerage accounts, and ideas retrieval. The supplied code does not implement any of those finance-related capabilities. Instead, it is an infrastructure/setup script whose primary purpose is to prepare an Ubuntu VM environment for running OpenClaw/Claude Code and installing/registering the thetaedge skill. While cloning and registering the skill could support the broader deployment of ThetaEdge, this code chunk itself is not the trading skill and performs materially different system-administration actions that are not reflected in the declared purpose.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The skill instructs reading credentials from ~/.openclaw/openclaw.json and ~/.config/thetaedge/credentials.json, both of which may store reusable API secrets. Agent access to these files is dangerous because secrets can be exposed, reused beyond the immediate task, or mishandled in logs and error output.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

  1. Check shell environment first — Run echo $THETAEDGE_API_KEY in Bash. If both vars are already set, skip to the curl pattern below. If THETAEDGE_API_BASE is not set, default to https://api.thetaedge.ai.
  2. Read from config file — If the vars are not set, check these locations in order:
    • ~/.openclaw/openclaw.json — Extract THETAEDGE_API_KEY and THETAEDGE_API_BASE from skills.entries.thetix.env
    • ~/.config/thetaedge/credentials.json — Extract api_key and api_base Then export them in Bash:
    bash
    export THETAEDGE_API_KEY="<value from config>"

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

The skill directs modification of an agent-wide configuration file (~/.claude/settings.json) to store an API key in plaintext environment configuration. Writing secrets into a broadly used config location can expose them to other skills, processes, backups, and accidental disclosure, creating long-lived compromise risk.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

text
3. **If neither works** — Ask the user to set up credentials. They should go to their ThetaEdge **Profile > API Keys** page to create a key, then configure it:

   **Claude Code** — Add to `~/.claude/settings.json`:
   ```json
   {
     "env": {

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

}

text

**Other agents** — Create `~/.config/thetaedge/credentials.json`:
```json
{
  "api_key": "te_your_key_here",

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/lib/common.py (reported line 73)May include surrounding context.

python
}
   ```

   **Other agents** — Create `~/.config/thetaedge/credentials.json`:
   ```json
   {
     "api_key": "te_your_key_here",

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The documentation instructs users to write a live API key directly via echo 'ANTHROPIC_API_KEY=...' > ~/.openclaw/.env, which encourages plaintext secret handling on the command line. Although quoting avoids shell history expansion in many shells, this pattern still normalizes direct secret insertion into files and may expose secrets through terminal logs, screen recording, backups, or copy/paste leakage.

Content

Scanner excerpt · docs/vm-setup.md (reported line 161)May include surrounding context.

If you need to change your Anthropic API key:

bash
echo 'ANTHROPIC_API_KEY=sk-your-new-key' > ~/.openclaw/.env
chmod 600 ~/.openclaw/.env

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
93% confidence
Finding

The documented DELETE /api/thetix-cards/<card_id> endpoint can permanently remove dashboard artifacts, and the reference provides no guardrails around confirmation, validation of ownership/context, or dry-run behavior. In an agentic environment, this creates a parameter-abuse risk where a mistaken or maliciously induced card ID could trigger unintended deletion.

Content

Scanner excerpt · reference.md (reported line 59)May include surrounding context.

Delete Card

text
DELETE /api/thetix-cards/<card_id>

Returns 204 No Content.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The DELETE /api/thetix-card-collections/<collection_id> endpoint can remove an entire collection, potentially affecting multiple cards and dashboards at once, yet the reference gives no warning about scope or recovery. Because this skill manages trading analysis artifacts, collection-level deletion magnifies the blast radius of parameter abuse or prompt-induced mistakes.

Content

Scanner excerpt · reference.md (reported line 137)May include surrounding context.

Delete Collection

text
DELETE /api/thetix-card-collections/<collection_id>

Returns 204 No Content.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
92% confidence
Finding

The DELETE /api/thetix-chats/<chat_id> endpoint enables deletion of chat history that may contain portfolio analysis, market reasoning, or saved reports, with no documented confirmation or retention safeguards. An agent could be manipulated into deleting the wrong chat if supplied an incorrect ID or ambiguous instruction.

Content

Scanner excerpt · reference.md (reported line 221)May include surrounding context.

Delete Chat

text
DELETE /api/thetix-chats/<chat_id>

Returns 204 No Content.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The DELETE /api/thetix-chat-collections/<collection_id> endpoint can erase an entire collection of chats, increasing the impact of any mistaken or adversarial parameter selection. In a financial-assistant context, losing collections of analysis and reports can materially disrupt user decision-making and auditability.

Content

Scanner excerpt · reference.md (reported line 356)May include surrounding context.

Delete Chat Collection

text
DELETE /api/thetix-chat-collections/<collection_id>

Returns 204 No Content.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'file_write' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/setup-openclaw-vm.sh (reported line 44)May include surrounding context.

sh
install_system_packages() {
    info "Updating system packages..."
    sudo apt update && sudo apt upgrade -y

    info "Installing essential packages..."
    sudo apt install -y curl git ufw

Chaining Abuse

High
Category
Tool Misuse
Confidence
97% confidence
Finding

Piping the nvm installer from GitHub straight into bash is another unverified remote code execution path. This is a classic supply-chain risk and is especially dangerous in a script that users may run with elevated trust during environment bootstrap.

Content

Scanner excerpt · scripts/setup-openclaw-vm.sh (reported line 87)May include surrounding context.

sh
export NVM_DIR="$HOME/.nvm"

    if [ ! -s "$NVM_DIR/nvm.sh" ]; then
        curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
    fi

    # Load nvm into this shell session

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

Executing a remote installer directly via 'curl ... | bash' hands full code execution to whatever is served at that URL at runtime, with no pinning, signature verification, or review. In a setup script that also handles credentials and SSH-enabled access, this creates substantial supply-chain risk.

Content

Scanner excerpt · scripts/setup-openclaw-vm.sh (reported line 105)May include surrounding context.

sh
install_openclaw() {
    info "Installing OpenClaw..."
    curl -fsSL https://openclaw.ai/install.sh | bash || true

    # The OpenClaw installer sets an npm prefix in ~/.npmrc which conflicts
    # with nvm. Remove it so nvm-managed node/npm work correctly.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup-openclaw-vm.sh (reported line 107)May include surrounding context.

sh
info "Installing OpenClaw..."
    curl -fsSL https://openclaw.ai/install.sh | bash || true

    # The OpenClaw installer sets an npm prefix in ~/.npmrc which conflicts
    # with nvm. Remove it so nvm-managed node/npm work correctly.
    if [ -f "$HOME/.npmrc" ] && grep -q "prefix=" "$HOME/.npmrc"; then
        info "Removing OpenClaw's npm prefix (conflicts with nvm)..."

Credential Access

High
Category
Privilege Escalation
Confidence
77% confidence
Finding

Deleting the entire ~/.npmrc can destroy unrelated security- or registry-related configuration, including auth tokens or enterprise registry settings. While not exfiltration, it is unsafe handling of a file that may contain credentials and can disrupt package trust boundaries or cause later fallback to public registries.

Content

Scanner excerpt · scripts/setup-openclaw-vm.sh (reported line 109)May include surrounding context.

sh
# The OpenClaw installer sets an npm prefix in ~/.npmrc which conflicts
    # with nvm. Remove it so nvm-managed node/npm work correctly.
    if [ -f "$HOME/.npmrc" ] && grep -q "prefix=" "$HOME/.npmrc"; then
        info "Removing OpenClaw's npm prefix (conflicts with nvm)..."
        rm -f "$HOME/.npmrc"
    fi

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup-openclaw-vm.sh (reported line 111)May include surrounding context.

sh
# with nvm. Remove it so nvm-managed node/npm work correctly.
    if [ -f "$HOME/.npmrc" ] && grep -q "prefix=" "$HOME/.npmrc"; then
        info "Removing OpenClaw's npm prefix (conflicts with nvm)..."
        rm -f "$HOME/.npmrc"
    fi

    # Ensure the npm-global bin dir is on PATH (OpenClaw installs there)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Removing the entire ~/.npmrc is overly broad and can destroy user configuration unrelated to the intended prefix conflict, including trusted registries and authentication settings. Broad file deletion in setup automation can have security and integrity side effects beyond the stated purpose.

Content

Scanner excerpt · scripts/setup-openclaw-vm.sh (reported line 111)May include surrounding context.

sh
# with nvm. Remove it so nvm-managed node/npm work correctly.
    if [ -f "$HOME/.npmrc" ] && grep -q "prefix=" "$HOME/.npmrc"; then
        info "Removing OpenClaw's npm prefix (conflicts with nvm)..."
        rm -f "$HOME/.npmrc"
    fi

    # Ensure the npm-global bin dir is on PATH (OpenClaw installs there)

Static analysis

No suspicious patterns detected.