OpenClaw HTTPS Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:31 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims, but its helper script makes privileged Nginx and Certbot changes using unvalidated user input, which could let a crafted domain alter server configuration.

Install only if you are comfortable reviewing and running VPS administration commands. Before running the script, add strict domain and email validation, quote variable expansions, avoid manually appending to crontab, and prefer the platform's Certbot renewal timer. Do not run it with domain or email values copied from an untrusted party.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/setup_openclaw_https.sh:72

Finding

Unvalidated Domain and Email Inputs Reach Privileged Configuration and Commands

Content

View full analysis

/dev/null <

Remediation

View remediation

&2 exit 1 fi ``` 2. **Validate the email address conservatively** - Reject control characters, whitespace, and leading hyphens. - Require a bounded, conventional mailbox format suitable for Certbot. 3. **Quote all variable expansions and terminate option parsing where supported** ```bash sudo tee -- "$CONFIG_FILE" > /dev/null sudo certbot certonly --nginx --non-interactive --agree-tos \ --email "$EMAIL" -d "$DOMAIN" ``` Apply equivalent quoting to the standalone Certbot command. 4. **Separate validation from configuration generation** - Generate the file only after all arguments pass validation. - Use a securely created temporary file with restrictive permissions. - Validate the temporary configuration before atomically installing it into `/etc/nginx/conf.d`. 5. **Use a safe bootstrap sequence** - First install an HTTP-only configuration that does not reference nonexistent certificate files. - Obtain the certificate. - Generate the final HTTPS configuration. - Run `nginx -t` and atomically install or reload only after successful validation. 6. **Reduce privileged processing** - Construct and validate content without privileges. - Use privilege elevation only for the final package installation, file installation, service management, and certificate operations. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (48)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 84% confidence

Finding

The pipeline that reads and rewrites root's crontab chains multiple shell operations into a privileged write, which is error-prone and can have unintended side effects such as duplicate entries or propagation of malformed crontab content. Chained privileged shell constructs are harder to audit and safer alternatives exist.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

10. Set up automatic certificate renewal

bash

# Add cron job for certificate renewal
sudo crontab -l | { cat; echo "0 12 * * * /usr/bin/certbot renew --quiet --nginx"; } | sudo crontab -

Verification

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

1. Install Nginx

bash

# For CentOS/RHEL systems
sudo dnf install -y epel-release
sudo dnf install -y nginx

# For Ubuntu/Debian systems

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

1. Install Nginx

bash

# For CentOS/RHEL systems
sudo dnf install -y epel-release
sudo dnf install -y nginx

# For Ubuntu/Debian systems

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

1. Install Nginx

bash

# For CentOS/RHEL systems
sudo dnf install -y epel-release
sudo dnf install -y nginx

# For Ubuntu/Debian systems

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

1. Install Nginx

bash

# For CentOS/RHEL systems
sudo dnf install -y epel-release
sudo dnf install -y nginx

# For Ubuntu/Debian systems

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

1. Install Nginx

bash

# For CentOS/RHEL systems
sudo dnf install -y epel-release
sudo dnf install -y nginx

# For Ubuntu/Debian systems

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

1. Install Nginx

bash

# For CentOS/RHEL systems
sudo dnf install -y epel-release
sudo dnf install -y nginx

# For Ubuntu/Debian systems

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

1. Install Nginx

bash

# For CentOS/RHEL systems
sudo dnf install -y epel-release
sudo dnf install -y nginx

# For Ubuntu/Debian systems

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

1. Install Nginx

bash

# For CentOS/RHEL systems
sudo dnf install -y epel-release
sudo dnf install -y nginx

# For Ubuntu/Debian systems

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

1. Install Nginx

bash

# For CentOS/RHEL systems
sudo dnf install -y epel-release
sudo dnf install -y nginx

# For Ubuntu/Debian systems

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

1. Install Nginx

bash

# For CentOS/RHEL systems
sudo dnf install -y epel-release
sudo dnf install -y nginx

# For Ubuntu/Debian systems

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

1. Install Nginx

bash

# For CentOS/RHEL systems
sudo dnf install -y epel-release
sudo dnf install -y nginx

# For Ubuntu/Debian systems

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

1. Install Nginx

bash

# For CentOS/RHEL systems
sudo dnf install -y epel-release
sudo dnf install -y nginx

# For Ubuntu/Debian systems

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

1. Install Nginx

bash

# For CentOS/RHEL systems
sudo dnf install -y epel-release
sudo dnf install -y nginx

# For Ubuntu/Debian systems

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 79% confidence

Finding

Persistently enabling the SELinux boolean httpd_can_network_connect broadens the network access allowed to the Nginx/httpd domain. While commonly needed for reverse proxies, it weakens SELinux confinement and can increase post-compromise reach if Nginx is later exploited.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

getenforce

If enforcing, allow Nginx to connect to network services

sudo setsebool -P httpd_can_network_connect 1

text

### 3. Test OpenClaw Gateway locally

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

3. Test OpenClaw Gateway locally

bash

# Ensure OpenClaw Gateway is running and accessible locally
curl -v http://127.0.0.1:18789/

4. Create Nginx configuration

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.

bash

sudo nginx -t  # Test configuration
sudo systemctl start nginx
sudo systemctl enable nginx

6. Install Certbot and get SSL certificate

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup_openclaw_https.sh (reported line 143)May include surrounding context.

sh

```bash
sudo nginx -t  # Test configuration
sudo systemctl start nginx
sudo systemctl enable nginx
```

### 6. Install Certbot and get SSL certificate

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The step explicitly instructs adding an automatic renewal cron job, which establishes persistent scheduled execution. This is not malicious in context, but it is still a real persistence mechanism that modifies long-term system behavior and should be implemented using safer, auditable platform-native mechanisms.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

10. Set up automatic certificate renewal

bash

# Add cron job for certificate renewal
sudo crontab -l | { cat; echo "0 12 * * * /usr/bin/certbot renew --quiet --nginx"; } | sudo crontab -

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 73% confidence

Finding

Piping root crontab content through a shell construction and rewriting the crontab introduces a persistent privileged scheduled task and can duplicate or corrupt cron entries if rerun. Although intended for certificate renewal, modifying root's crontab in this ad hoc way increases risk and creates lasting privileged execution.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

10. Set up automatic certificate renewal

bash

# Add cron job for certificate renewal
sudo crontab -l | { cat; echo "0 12 * * * /usr/bin/certbot renew --quiet --nginx"; } | sudo crontab -

Verification

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Adding a root cron job creates persistent privileged code execution on a recurring schedule. In an otherwise benign setup guide this is operationally common, but persistence mechanisms deserve scrutiny because they survive reboots and can be abused if the invoked command or environment is later altered.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

10. Set up automatic certificate renewal

bash

# Add cron job for certificate renewal
sudo crontab -l | { cat; echo "0 12 * * * /usr/bin/certbot renew --quiet --nginx"; } | sudo crontab -

Verification

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 79% confidence

Finding

Repeating the SELinux boolean change in troubleshooting guidance reinforces a broad, persistent permission expansion for the web server domain. If applied without need or understanding, it can unnecessarily weaken host hardening and enlarge the blast radius of an Nginx compromise.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md

- If getting 502 Bad Gateway errors, check that OpenClaw Gateway is running and accessible at 127.0.0.1:18789
- If SSL certificate fails, ensure port 80 is accessible from the internet
- Check Nginx error logs: `sudo tail -f /var/log/nginx/error.log`
- Check SELinux: `sudo setsebool -P httpd_can_network_connect 1`

## Security Notes
- The configuration includes proper security headers

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup_openclaw_https.sh (reported line 19)May include surrounding context.

sh

# Check if running as root
if [[ $EUID -eq 0 ]]; then
   echo "This script should not be run as root"
   exit 1
fi

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.

md

exit 1
fi

# Check if sudo is available
if ! command -v sudo &> /dev/null; then
    echo "sudo is required but not installed"
    exit 1

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

md

exit 1
fi

# Check if sudo is available
if ! command -v sudo &> /dev/null; then
    echo "sudo is required but not installed"
    exit 1

Static analysis

No suspicious patterns detected.