ClawHub
Back to skill

Security audit

aigate

Security checks for vulnerabilities and agentic risk

Overview

This skill documents a powerful self-hosted AI platform with clearly disclosed risks and operator-controlled optional features.

Enable only the services you need and protect their credentials. The master token can authorize code execution and account actions when those services are enabled; use separate service credentials before granting narrower access. Keep the gateway private, consider a dedicated machine or VM for privileged execution, and review the upstream version before deployment. Enabled cloud providers and fallback routes may receive your requests.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Privileged Kubernetes Workload

High
Category
Tool Misuse
Confidence
92% confidence
Finding

Although the static rule labels this a Kubernetes workload, the document describes a privileged Docker execution service. Running a service that processes potentially untrusted code with privileged container access increases the consequences of an nsjail or service compromise, potentially including host compromise; an internal-only network does not remove that local privilege risk.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
ARED=1`) or Tailscale (`TAILSCALE=1`) — both keep no ports open on the host — or put a real authenticating gateway/reverse-proxy in front of it.
- Every request needs `Authorization: Bearer $AIGATE_TOKEN` (or a per-service override token) — there is no unauthenticated path once a service is enabled. Don't hardcode the token in scripts committed to a repo; source it from `.env`/environment.
- Internal services (Postgres, Redis, LiteLLM, and most optional services) bind to no host ports at all — only nginx is exposed. Don't add host port mappings for internal services unless you specifically need direct access and understand you're widening the blast radius.
- `piston` runs `privileged: true` (required for nsjail's own isolation, not a bypass of it) and lives on an internal-only network with no outbound internet — don't change that without understanding why.
- Guard `.env` and any mailbox/Telethon config files — they hold plaintext secrets and are gitignored for a reason.

## When to use

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

bash
git clone https://github.com/psyb0t/aigate
cd aigate
make bootstrap # creates .env from .env.example (any target does this)
# edit .env: set AIGATE_TOKEN, flip the flags for the providers/services you want to 1
# .env is gitignored. docker-compose.yml is tracked, so put compose changes in
# docker-compose.override.yml, which is gitignored and merges last

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

md
cd aigate
make bootstrap # creates .env from .env.example (any target does this)
# edit .env: set AIGATE_TOKEN, flip the flags for the providers/services you want to 1
# .env is gitignored. docker-compose.yml is tracked, so put compose changes in
# docker-compose.override.yml, which is gitignored and merges last
make limits    # checks enabled services fit this machine, writes CPU caps to .env.limits
make run-bg    # start the stack in the background

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 10)May include surrounding context.

bash
git clone https://github.com/psyb0t/aigate
cd aigate
make bootstrap   # creates .env from .env.example (any target does this)
# edit .env — see "Required env" below, then flip service flags to 1
# .env is gitignored. docker-compose.yml is tracked, so put compose changes in
# docker-compose.override.yml, which is gitignored and merges last

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 11)May include surrounding context.

md
git clone https://github.com/psyb0t/aigate
cd aigate
make bootstrap   # creates .env from .env.example (any target does this)
# edit .env — see "Required env" below, then flip service flags to 1
# .env is gitignored. docker-compose.yml is tracked, so put compose changes in
# docker-compose.override.yml, which is gitignored and merges last
make limits      # checks enabled services fit this machine, writes CPU caps to .env.limits

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 12)May include surrounding context.

md
cd aigate
make bootstrap   # creates .env from .env.example (any target does this)
# edit .env — see "Required env" below, then flip service flags to 1
# .env is gitignored. docker-compose.yml is tracked, so put compose changes in
# docker-compose.override.yml, which is gitignored and merges last
make limits      # checks enabled services fit this machine, writes CPU caps to .env.limits
make run-bg      # start detached

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
- aigate itself reaches out to model providers, MCP tool backends, and the open internet on the user's behalf (web search, browser automation, email, Telegram)
  shell:
    - docker / docker compose (bring the stack up/down, read logs)
    - curl (call the OpenAI-compatible endpoint and direct service routes)
metadata:
  openclaw:
    emoji: "🚪"

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
94% confidence
Finding

Arbitrary code execution is intentional functionality, but the surrounding documentation describes a default shared bearer token covering inference, shell/file access, browser automation, and messaging without per-tool authorization. A compromised token or an agent given that token for a narrow task could therefore access substantially broader capabilities; optional services and explicit warnings reduce exposure but do not enforce least privilege.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

md
**This is a very high-capability, very high-blast-radius stack. Treat the endpoint and its token like root on the host.** A single `AIGATE_TOKEN` bearer can, depending on what's enabled:

- Hold API keys/credentials for many cloud model providers (Groq, Cerebras, OpenRouter, HuggingFace, Mistral, Cohere, Anthropic, OpenAI) plus subscription agent backends (Claude Code OAuth/API key, z.ai GLM Coding Plan).
- Execute arbitrary code — three full agentic coding agents (claudebox, pibox-zai, pibox) with shell + file access, plus sandboxed multi-language execution (piston).
- Drive a real browser (stealth Camoufox cluster) that can log into sites, fill forms, and act as the user across the open web.
- Send email and Telegram messages on the user's behalf (mailbox, Telethon) — mailbox additionally holds plaintext IMAP/SMTP credentials in its YAML config.
- Read/write S3-compatible object storage with a public-read bucket.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/setup.md (reported line 53)May include surrounding context.

All requests carry Authorization: Bearer $AIGATE_TOKEN (or the relevant per-service override):

bash
curl http://localhost:4000/chat/completions \
  -H "Authorization: Bearer $AIGATE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"model": "local-ollama-cpu-llama3.2-3b", "messages": [{"role": "user", "content": "hello"}]}'

Static analysis

No suspicious patterns detected.