Security audit
Security checks for vulnerabilities and agentic risk
The skill largely matches emergency monitoring, but needs review because it handles credentials and safety-related location data with weak scoping and incomplete disclosure.
Review before installing. Use local-only mode where possible, avoid entering cloud LLM or NewsAPI keys unless you accept plaintext local storage, verify file permissions under ~/.openclaw, and only configure Telegram if you are comfortable sending alert content and monitoring context to that channel. Treat the current country support as UAE/Dubai-focused unless you have reviewed and adapted the profiles and scripts for another location.
scripts/aegis_onboard.py:113API credentials are stored in a plaintext configuration file without enforced restrictive permissions
scripts/aegis_channel.py:24The Telegram publisher loads unrelated credentials from the shared OpenClaw secret store
scripts/aegis_scanner.py:396NewsAPI credentials are exposed in curl process arguments and request URLs
scripts/aegis_scanner.py:551LLM bearer tokens are exposed in curl process arguments
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
req = urllib.request.Request(url, data=payload, headers={"Content-Type": "application/json"})
try:
resp = urllib.request.urlopen(req, timeout=15)
result = json.loads(resp.read())
# Auto-pin if requested
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
}).encode()
pin_req = urllib.request.Request(pin_url, data=pin_payload, headers={"Content-Type": "application/json"})
try:
urllib.request.urlopen(pin_req, timeout=10)
except Exception:
pass # Pin failure is non-critical
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
"disable_web_page_preview": True
}).encode()
req2 = urllib.request.Request(url, data=payload2, headers={"Content-Type": "application/json"})
resp2 = urllib.request.urlopen(req2, timeout=15)
return json.loads(resp2.read())
except Exception as e2:
print(f"[AEGIS] Send failed: {e2}", file=sys.stderr)
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
}).encode()
pin_req = urllib.request.Request(pin_url, data=pin_payload, headers={"Content-Type": "application/json"})
try:
urllib.request.urlopen(pin_req, timeout=10)
except:
pass
The code is broadly related to the declared emergency threat-monitoring purpose, but the description overstates its scope and generality. This chunk does not implement a generic 'conflict zones' intelligence system; it is a cron orchestration script specialized for UAE/Dubai alert text and behavior. It runs another scanner, logs/saves results, applies cooldown and corroboration logic, and posts critical alerts through Telegram. Those behaviors support the declared purpose, but the hard-coded UAE/Dubai targeting is a material mismatch from the description's broad, location-agnostic framing.
The description presents a broad automated emergency geopolitical intelligence system for civilians in conflict zones, suitable for monitoring any location, assessing threat levels, configuring alerts, generating briefings, and preparedness planning. The code is much narrower: it specifically filters for UAE/Gulf relevance, scrapes World Monitor and LiveUAMap, deduplicates event text, assigns coarse urgency labels, and posts batched updates to a Telegram channel. That supports part of the declared alerting/monitoring concept, but it does not implement several major claimed uses such as general location setup, comprehensive security briefings, emergency preparedness planning, or broad civilian safety analysis. It also uses undeclared external network resources and Telegram posting. Therefore the code only partially matches the description and is materially narrower/different in purpose and capability.
The declared description presents a full emergency geopolitical intelligence and civilian safety alerting system focused on monitoring, threat analysis, briefing generation, and preparedness workflows. The provided code does not perform monitoring, intelligence gathering, threat assessment, alert delivery, briefing generation, or preparedness planning. Instead, it is a narrow operational script for toggling a single cron-based live feed on or off and checking its status. While this may support a larger AEGIS system, the actual code chunk’s primary purpose is infrastructure/task scheduling control, which is materially different from the declared end-user functionality.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _load_openclaw_dotenv():
"""Best-effort loader for decrypted secrets from tmpfs.
Reads from /run/user/<uid>/openclaw-secrets/.env (decrypted by
openclaw-secrets.service) with fallback to ~/.openclaw/.env for
development. Also resolves simple ${VAR} and $VAR references.
"""
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _load_openclaw_dotenv():
"""Best-effort loader for decrypted secrets from tmpfs.
Reads from /run/user/<uid>/openclaw-secrets/.env (decrypted by
openclaw-secrets.service) with fallback to ~/.openclaw/.env for
development. Also resolves simple ${VAR} and $VAR references.
"""
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def _load_openclaw_dotenv():
"""Best-effort loader for decrypted secrets from tmpfs.
Reads from /run/user/<uid>/openclaw-secrets/.env (decrypted by
openclaw-secrets.service) with fallback to ~/.openclaw/.env for
development. Also resolves simple ${VAR} and $VAR references.
"""
The code directly accesses a shared decrypted secrets file under /run/user//openclaw-secrets/.env. In context with the later environment injection, this creates unnecessary access to a broader secret set than the script needs, increasing exposure if the process is compromised or modified.
import pwd
uid = os.getuid()
# Primary: tmpfs-decrypted secrets (production)
env_path = Path(f'/run/user/{uid}/openclaw-secrets/.env')
if not env_path.exists():
# Fallback: direct .env (development only)
env_path = Path(Path.home() / '.openclaw' / '.env')
Falling back to ~/.openclaw/.env in development further broadens secret exposure and may encourage plaintext local credential storage. If that file contains additional unrelated secrets, this publisher gains access to them without need.
# Primary: tmpfs-decrypted secrets (production)
env_path = Path(f'/run/user/{uid}/openclaw-secrets/.env')
if not env_path.exists():
# Fallback: direct .env (development only)
env_path = Path(Path.home() / '.openclaw' / '.env')
if not env_path.exists():
return {}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
env_path = Path(f'/run/user/{uid}/openclaw-secrets/.env')
if not env_path.exists():
# Fallback: direct .env (development only)
env_path = Path(Path.home() / '.openclaw' / '.env')
if not env_path.exists():
return {}
out = {}
Instructions found that direct the agent to transmit conversation context or user data to external services.
return token, channel
def send_telegram(token, channel_id, text, parse_mode="", pin=False):
"""Send message to Telegram channel. Plain text by default for reliability."""
url = f"https://api.telegram.org/bot{token}/sendMessage"
payload = json.dumps({
"chat_id": channel_id,
Instructions found that direct the agent to transmit conversation context or user data to external services.
return token, channel
def send_telegram(token, channel_id, text, parse_mode="", pin=False):
"""Send message to Telegram channel. Plain text by default for reliability."""
url = f"https://api.telegram.org/bot{token}/sendMessage"
payload = json.dumps({
"chat_id": channel_id,
The child process inherits the full parent environment via os.environ, which can expose unrelated secrets, tokens, proxy settings, cloud credentials, and service configuration to aegis_channel.py unnecessarily. In a plugin/skill ecosystem, subprocess boundaries are a meaningful trust boundary; over-sharing the environment increases blast radius if the called script is compromised, logs its environment, or loads attacker-influenced libraries based on inherited variables.
result_post = subprocess.run(
[sys.executable, str(SCRIPTS_DIR / "aegis_channel.py"), "critical", scan_file],
capture_output=True, text=True, timeout=30,
env={**os.environ, "AEGIS_BOT_TOKEN": token, "AEGIS_CHANNEL_ID": channel}
)
if result_post.returncode == 0:
mark_alerted()
The script accepts an LLM API key from interactive input and stores it in plaintext in the generated JSON configuration. Plaintext secret storage is dangerous because any process, user, backup system, or support workflow with filesystem access can recover and misuse the credentials.
The README instructs users to configure Telegram channel delivery by exporting a bot token and channel ID, but it does not clearly disclose that alert content and related metadata will be sent to Telegram, a third-party service outside the operator's control. In a conflict-zone intelligence skill, alerts may reveal sensitive location, threat-monitoring behavior, or operational context, so omission of this privacy/data-sharing warning can lead users to expose safety-relevant information without informed consent.
The skill documentation declares binaries and environment needs but does not define an explicit tool/permission scope despite describing shell execution, network access, local file reads/writes, and environment-variable use. In an agent ecosystem, this under-specification can cause the host or user to approve a skill without understanding its real privileges, increasing the risk of overbroad execution and unintended data exposure.
The skill stores persistent local configuration and operational state, including user location, alert preferences, scan history, and potentially Telegram configuration. In the context of a conflict-zone safety tool, this data can be sensitive: unauthorized local access could reveal whereabouts, habits, and communication channels, creating privacy and physical-safety risk.
Creates ~/.openclaw/aegis-config.json with location, language, and alert preferences.
Create ~/.openclaw/aegis-config.json:
{
"location": {
The skill transmits data to external services, including Telegram, and the transmitted content may include sensitive location-specific threat context, alert content, or metadata derived from the user's configuration. Even though Telegram delivery is described as optional, external transmission creates privacy and data-handling risk, especially for users in conflict zones where channel exposure, bot-token misuse, or misdirected posting could endanger people.
1. URLs listed in `references/source-registry.json` (RSS feeds, news sites, government pages)
2. `https://world-monitor.com/api/signal-markers` (World Monitor public API)
3. LiveUAMap regional pages (e.g., `https://iran.liveuamap.com`)
4. Telegram Bot API (`https://api.telegram.org/bot.../sendMessage`) — only if channel delivery is configured
No telemetry. No analytics. No phone-home.
The briefing format explicitly states updates are provided 'in plain English,' which is a language constraint in the skill's natural-language behavior. Although the config example includes a language field earlier, this section does not present language choice for generated briefings and reads as a fixed requirement.
The documentation presents a cloud LLM configuration that sends alert content to a third-party API endpoint, but it does not explicitly warn users that potentially sensitive safety-monitoring data may leave the local device and be processed by an external provider. In the AEGIS context, alerts may include location, threat context, and user-specific monitoring scope, so the omission can lead to unintentional data exposure and poor privacy decisions by users.
This JSON template sets "language": "en" as a fixed default, which can encode a language preference across all generated country profiles. Because the file provides no user choice, opt-in mechanism, or documented region-specific justification, it may violate language/locale policy requirements.
This section switches into UAE-specific evacuation routes and assumptions without prominently scoping the document as UAE-only or requiring the user to confirm location. In an emergency-preparedness skill, users may overgeneralize these routes, border assumptions, and airport options to other regions, which can cause dangerous misrouting, border denial, or movement into less safe areas during a crisis.