Security audit
Security checks for vulnerabilities and agentic risk
The coding-agent features are clearly described, but setup immediately executes a changeable online installer before configuring powerful access to the computer.
Review and pin the installer before executing it, and treat the controller as fully trusted software because of its Docker access. Restrict the workspace root, keep workers isolated, exclude secrets, and confirm the model provider's data handling. Keep the API local unless protected by authentication and TLS, and explicitly stop unattended work.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- "docs/**"
- ".env.example"
write:
- ".env"
- "AGENTS.md"
- ".agents/**"
shell:
The command pipes install.sh from the repository's mutable main branch directly into Bash without inspection or integrity verification. A compromised repository or malicious upstream change could execute arbitrary commands with the invoking user's privileges, exposing local files and credentials; the documented Docker-socket architecture could amplify a successful compromise if the installer receives that access.
Install the peen command, configure one provider, then open a project. Delete the provider entries you do not use, together with their key variables. PEEN_UPSTREAMS is raw JSON for Docker, so do not source .env in Bash.
curl -fsSL https://raw.githubusercontent.com/psyb0t/peen/main/install.sh | bash
peen config edit
cd ~/work/my-app
peen
Referenced artifact was not completely inspected
, `peen doctor`, `peen stop`, and `peen upgrade` manage the controller. [Setup](references/setup.md) also points to the manual `docker run` route.
Referenced artifact was not completely inspected
- [Setup, providers, WebSocket, and REST](references/setup.md)
Piping the downloaded response directly into bash turns unverified network content into immediate local code execution. This is the same underlying supply-chain issue as SC2, not a separate exploit, and the setup context makes it actionable because users are instructed to run the command before using the tool.
curl -fsSL https://raw.githubusercontent.com/psyb0t/peen/main/install.sh | bash
peen config edit
cd ~/work/my-app
peen
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
`GET /api/v1/sessions` lists what exists and needs no session header.
Use REST to read stored state and control work. A message for the agent goes over the WebSocket. Send `X-Session-ID` to the session endpoints. For example, list messages with `GET /api/v1/messages` and ask a turn to stop with `POST /api/v1/session/cancel`. The [API reference](https://github.com/psyb0t/peen/blob/main/docs/http-api.md) has every frame and endpoint.
## Inspect and continue retained work
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
A message for the agent goes over the WebSocket only. REST reads stored state and controls work, and the one REST call that can start a turn is a posted notice that an event handler lets wake an idle session.
const opened = await (await fetch("http://127.0.0.1:8080/api/v1/sessions/open", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ workspace: "/abs/path/to/project" }),
Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.
A message for the agent goes over the WebSocket only. REST reads stored state and controls work, and the one REST call that can start a turn is a posted notice that an event handler lets wake an idle session.
const opened = await (await fetch("http://127.0.0.1:8080/api/v1/sessions/open", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ workspace: "/abs/path/to/project" }),
The example submits an instruction to read the project after the setup configures an external model upstream at lines 16–22. The guide does not disclose that prompts and project content used by the agent may leave the machine and be processed by that provider.
The curl permission alone would not establish a vulnerability, but the installation instructions use it to fetch a mutable remote script and execute it immediately. HTTPS authenticates the hosting endpoint but does not protect against repository compromise or unsafe upstream changes; this is the same supply-chain exposure reported under TM2, not a separate exploit.
shell:
- "peen *"
- "docker run *"
- "curl *"
metadata:
openclaw:
emoji: "🧰"
The installation command downloads a script from a mutable GitHub main branch and executes it immediately without integrity verification or review. Compromise of the repository or publishing credentials could therefore execute arbitrary commands with the installing user's permissions; pinning the release selected by that script does not pin or authenticate the script itself.
curl -fsSL https://raw.githubusercontent.com/psyb0t/peen/main/install.sh | bash
peen config edit
cd ~/work/my-app
peen
No suspicious patterns detected.