T09 · Insecure Skill Coding Practices
Error
- Location
scripts/gateway-qr.sh:81- Finding
Arbitrary Python Code Execution Through Unescaped Configuration Values
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawket
Security checks for vulnerabilities and agentic risk
Overview
This skill does what it claims, but it handles a live gateway login token too loosely and includes a script injection flaw that should be reviewed before installation.
Install only if you are comfortable with a skill reading your OpenClaw Gateway auth token. Treat any generated QR image or terminal QR as a password, avoid running it in logged or shared terminals, delete ~/.openclaw/media/clawket-qr.png after pairing, and rotate the Gateway token if the payload has been exposed. The script should be fixed to avoid printing the token, set restrictive file permissions, clean up the QR, and pass config values to Python as data rather than source code.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/gateway-qr.sh:91- Finding
Gateway Authentication Token Disclosed Through Terminal Output
- Content
View full analysis
- Remediation
View remediation
&2 qrencode -t UTF8 -m 1 "$PAYLOAD" fi ``` ]]>
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/gateway-qr.sh:7- Finding
Persistent Token-Bearing QR File Created Without Explicit Access Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This skill explicitly generates and sends a QR code containing a live Gateway auth token, but it provides no warning that the PNG and terminal-rendered QR are effectively bearer credentials. A user could forward, screenshot, store, or display the code insecurely, allowing anyone who scans it to authenticate to the local OpenClaw Gateway.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## Troubleshooting - If `qrencode` is not installed: `brew install qrencode` (macOS) / `sudo apt install qrencode` (Linux) / `choco install qrencode` (Windows) - If the LAN IP detection fails, the script falls back to `127.0.0.1` - The token is read directly from the JSON config file (not via `openclaw config get` which redacts it)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh ## Troubleshooting - If `qrencode` is not installed: `brew install qrencode` (macOS) / `sudo apt install qrencode` (Linux) / `choco install qrencode` (Windows) - If the LAN IP detection fails, the script falls back to `127.0.0.1` - The token is read directly from the JSON config file (not via `openclaw config get` which redacts it)
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script prints the full QR payload to the terminal, and that payload contains the gateway authentication token. Anyone with terminal visibility, shell history capture, screen recording, logging, or shoulder-surfing access can recover the token and authenticate to the local gateway, which exceeds the stated need of simply generating a QR code.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The terminal output discloses a sensitive bearer-style token without warning or minimization, creating an unnecessary secret exposure channel. In practice, terminals are often logged, copied into support chats, or visible to other local users, so disclosure can lead to unauthorized mobile pairing or gateway access.
- Content
Static analysis
No suspicious patterns detected.