iOS Setup

• Outcome: Pass
• Latest audit: May 28, 2026 · 12:42 PM UTC
• Version: 1.0.2

Overview

This skill does what it claims: it helps connect the OpenClaw iOS app by reading local OpenClaw settings, starting the stats server, and showing connection details.

Install only if you are comfortable with the skill reading your local OpenClaw gateway token and showing it in the agent conversation. Treat the token like a password, avoid sharing logs or screenshots that contain it, use HTTPS or Tailscale for remote access, and inspect any existing workspace stats_server.py or ensure_stats_server.sh before letting the skill run them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

e = os.environ.copy()
    if env:
        e.update(env)
    r = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout, env=e)
    return r.returncode, r.stdout.strip(), r.stderr.strip()

• Confidence: 93% confidence
• Finding: The helper executes shell commands with shell=True, which is inherently dangerous because any future use with variable or attacker-influenced input can lead to command injection. In this file the current call sites use fixed strings, so exploitation is not immediate, but the primitive is unsafe and unnecessary in a deployment script that starts services and handles tokens.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# Start directly — token passed via env, NOT inlined in shell command
        log_path = "/tmp/stats_server.log"
        with open(log_path, "a") as log:
            proc = subprocess.Popen(
                ["python3", stats_script],
                stdout=log,
                stderr=log,

• Confidence: 78% confidence
• Finding: The code starts a Python script located by searching a dynamically discovered workspace directory, so execution is delegated to whatever file exists at that path. If an attacker can influence the workspace contents or config, this becomes arbitrary code execution under the user's privileges and also exposes the gateway token to that process via environment variables.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The docstring claims the script only reports environment and install details, but the implementation also retrieves and emits a gateway authentication token. That mismatch is dangerous because it hides credential collection behind a benign-looking environment detection tool, increasing the chance the token is exposed in logs, agent outputs, or downstream systems without informed consent.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The script reads a gateway auth token from CLI config or directly from the local config file and includes it in its JSON output. This exposes a sensitive credential far beyond what is necessary for environment detection, creating a direct risk of unauthorized gateway access if the output is logged, transmitted, or viewed by unintended parties.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The documented output scope omits the gateway token even though the runtime JSON includes it. This hidden sensitive output increases the likelihood of accidental disclosure because callers, reviewers, and operators may treat the output as harmless environment metadata.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly instructs the agent to output the gateway authentication token in summaries and connection details, but provides no warning that this credential is sensitive or guidance to avoid unnecessary disclosure. In an agent setting, echoing secrets into chat transcripts or logs can leak persistent access to anyone with transcript visibility.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill walks the user through exposing the service via nginx, Tailscale, or direct LAN access and provides ready-to-use configuration, but does not clearly frame this as publishing access to a live authenticated service. That omission increases the chance of accidental exposure, especially for users who may copy the instructions without understanding the security implications of internet or network reachability.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script silently reads a gateway authentication token from user configuration and then uses it to launch another process, without any user-facing disclosure or consent at the point of use. In a skill context, this increases the risk of covert credential use and makes abuse harder for users to detect.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script starts or ensures a long-running service and modifies execution state without an explicit warning or confirmation. In an agent skill, silently starting background services is security-relevant because it can persist processes, consume resources, and act on sensitive data without the user's awareness.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code accesses a sensitive credential without any user-facing warning, consent, or disclosure. In an agent skill context, silently reading secrets from local configuration is especially dangerous because users may invoke the tool expecting harmless diagnostics while actually leaking credentials into tool results or orchestration logs.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script performs an external network request to api.ipify.org to determine the public IP without any visible disclosure. Even though the purpose is diagnostic, this leaks execution metadata to a third party and may violate privacy, policy, or offline/air-gapped assumptions in sensitive environments.

Static analysis

No suspicious patterns detected.