ClawHub
Back to skill

Security audit

Server Health

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only server health skill that exposes operational details, but the behavior is disclosed and aligned with its monitoring purpose.

Install this only where server health details are appropriate for the caller. Treat its output as administrator diagnostic information, especially if connected to Telegram or automation, because it can reveal process names, OpenClaw port/version/model settings, service state, Docker container count, and session activity.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Note
Location
server-health.sh:44
Finding
Excessive Disclosure of Privileged Host and OpenClaw Operational Metadata<![CDATA[ ## Vulnerability Details **File Location**: `server-health.sh:44-75`, `server-health.sh:118-122`, and `server-health.sh:174-175` **Vulnerability Type**: Excessive System Reconnaissance and Information Disclosure **Risk Level**: Low ### Vulnerable Code ```bash get_top_processes() { ps aux --sort=-%cpu | awk 'NR>1 {printf "%-12s %3d%% %5dMB\n", $11, int($3), int($6/1024)}' | head -3 } get_openclaw_pid() { pgrep -f "openclaw.*gateway" | head -1 || echo "" } get_openclaw_version() { # Get version from package.json instead of CLI (CLI can hang) if [[ -f /usr/lib/node_modules/openclaw/package.json ]]; then jq -r '.version // "unknown"' /usr/lib/node_modules/openclaw/package.json 2>/dev/null else echo "unknown" fi } get_openclaw_config() { if [[ -f /root/.openclaw/openclaw.json ]]; then local port=$(jq -r '.gateway.port // 18789' /root/.openclaw/openclaw.json 2>/dev/null) local model=$(jq -r '.agents.defaults.model.primary // "unknown"' /root/.openclaw/openclaw.json 2>/dev/null) local fallbacks=$(jq -r '.agents.defaults.model.fallbacks // [] | map(split("/")[1] // .) | join(" → ")' /root/.openclaw/openclaw.json 2>/dev/null) echo "${port} ${model} ${fallbacks}" else echo "18789 unknown " fi } get_docker_containers() { if command -v docker &>/dev/null; then docker ps -q 2>/dev/null | wc -l else echo "0" fi } ``` The standard output additionally exposes session metadata: ```bash # Simplified - just count session files local sessions=$(ls /root/.openclaw/agents/main/sessions/*.json 2>/dev/null | wc -l || echo "0") ``` ### Technical Analysis The script gathers system-wide process information, identifies the OpenClaw gateway process, reads package and configuration data, queries Docker, and counts session files under a root-owned directory. These operations are read-only and broadly align with the stated monitoring purpose. However, ...[truncated 2538 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Run the skill under a dedicated, least-privileged service account rather than `root`. 2. Restrict invocation through the surrounding OpenClaw or automation interface to authenticated and explicitly authorized administrators. 3. Make sensitive checks opt-in, for example: - `--processes` - `--openclaw-config` - `--sessions` - `--docker` 4. Exclude process command names, process IDs, gateway ports, software versions, model configuration, and session counts from output intended for remote or untrusted recipients. 5. Provide a redacted mode that returns only high-level health states such as `healthy`, `warning`, or `unavailable`. 6. Avoid hardcoded access to `/root/.openclaw`. Resolve an explicitly configured OpenClaw data directory and verify that the caller is authorized to inspect it. 7. Apply output-level access controls so privileged diagnostic details are not relayed to public channels, group chats, logs, or monitoring systems with broader readership. 8. Document the permissions required for each check and disable checks when the execution account lacks a legitimate operational need for that data. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Context Leakage

High
Category
Data Exfiltration
Content
# Get from session status - parse the output
    local status=$(openclaw status 2>/dev/null || echo "")
    
    # Try to extract context and tokens
    local context=$(echo "$status" | grep -oP 'Context:.*?\K\d+k/\d+k \(\d+%\)' | head -1 || echo "N/A")
    local tokens=$(echo "$status" | grep -oP 'Tokens:.*?\K\d+ in / \d+ out' | head -1 || echo "N/A")
Confidence
75% confidence
Finding
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly displays operational details such as running services, gateway status, port numbers, model configuration, process names, and session activity, but the description provides no warning that this output may contain sensitive infrastructure information. If shared through Telegram, logs, screenshots, or automation outputs, these details can aid reconnaissance and expose internal architecture to unauthorized viewers.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script reads sensitive OpenClaw configuration from /root/.openclaw/openclaw.json, including gateway port, primary model, and fallback models, and later enumerates session files under /root/.openclaw/agents/main/sessions. In a skill designed for Telegram or CLI health checks, this information may be exposed to untrusted chat recipients or lower-trust operators, creating unnecessary disclosure of internal configuration and agent activity.

Missing User Warnings

Low
Confidence
89% confidence
Finding
This markdown file advertises reporting of top processes, OpenClaw gateway status, model configuration, and service status, and the example output includes process names, PID, port, version, and model identifiers. The description does not warn users that running the skill may reveal operational or environment details that could be sensitive when shared or logged.

Static analysis

No suspicious patterns detected.