Security audit
Security checks for vulnerabilities and agentic risk
This connector mostly matches its remote-agent-management purpose, but it gives Ekybot broad background control over local agents and contains consent and deletion-safety issues that require review before use.
Install only if you are comfortable giving Ekybot background access to manage local OpenClaw agents and relay prompts into them. Use a low-privilege account, back up OpenClaw workspaces, avoid running the daemon with sudo, restrict tools available to remotely reachable agents, review memory files before enabling sync, and verify/disable background services after setup.
runtime/src/config-manager.js:413Cloud-Controlled Recursive Workspace Deletion Uses an Insufficient Path Boundary Check
runtime/src/companion-relay-processor.js:105Untrusted Cloud Relay Messages Are Injected Directly into Local Agent Prompts
scripts/setup.sh:151Setup Starts a Background Daemon After the User Declines Daemon Installation
runtime/scripts/companion-install-launchd.js:17Unescaped Path Values Are Embedded in a LaunchAgent XML File
If the packaged runtime creates agent workspaces, modifies OpenClaw configuration, restarts the gateway, and creates remote channels, those are materially broader and more invasive actions than a simple connector setup description implies. Such behavior can alter local agent topology and remote collaboration state, which increases blast radius beyond basic enrollment or health monitoring.
If the packaged runtime creates agent workspaces, modifies OpenClaw configuration, restarts the gateway, and creates remote channels, those are materially broader and more invasive actions than a simple connector setup description implies. Such behavior can alter local agent topology and remote collaboration state, which increases blast radius beyond basic enrollment or health monitoring.
If the packaged runtime creates agent workspaces, modifies OpenClaw configuration, restarts the gateway, and creates remote channels, those are materially broader and more invasive actions than a simple connector setup description implies. Such behavior can alter local agent topology and remote collaboration state, which increases blast radius beyond basic enrollment or health monitoring.
If the packaged runtime creates agent workspaces, modifies OpenClaw configuration, restarts the gateway, and creates remote channels, those are materially broader and more invasive actions than a simple connector setup description implies. Such behavior can alter local agent topology and remote collaboration state, which increases blast radius beyond basic enrollment or health monitoring.
If the packaged runtime creates agent workspaces, modifies OpenClaw configuration, restarts the gateway, and creates remote channels, those are materially broader and more invasive actions than a simple connector setup description implies. Such behavior can alter local agent topology and remote collaboration state, which increases blast radius beyond basic enrollment or health monitoring.
If the packaged runtime creates agent workspaces, modifies OpenClaw configuration, restarts the gateway, and creates remote channels, those are materially broader and more invasive actions than a simple connector setup description implies. Such behavior can alter local agent topology and remote collaboration state, which increases blast radius beyond basic enrollment or health monitoring.
If the packaged runtime creates agent workspaces, modifies OpenClaw configuration, restarts the gateway, and creates remote channels, those are materially broader and more invasive actions than a simple connector setup description implies. Such behavior can alter local agent topology and remote collaboration state, which increases blast radius beyond basic enrollment or health monitoring.
If the packaged runtime creates agent workspaces, modifies OpenClaw configuration, restarts the gateway, and creates remote channels, those are materially broader and more invasive actions than a simple connector setup description implies. Such behavior can alter local agent topology and remote collaboration state, which increases blast radius beyond basic enrollment or health monitoring.
If the packaged runtime creates agent workspaces, modifies OpenClaw configuration, restarts the gateway, and creates remote channels, those are materially broader and more invasive actions than a simple connector setup description implies. Such behavior can alter local agent topology and remote collaboration state, which increases blast radius beyond basic enrollment or health monitoring.
The code stores an API key in a project-local .env file under process.cwd(). Even with mode 0600, this is risky because project directories are commonly committed, copied, backed up, or exposed to other tooling, which can lead to credential disclosure and unauthorized remote control of the connected service.
class AuthManager {
constructor() {
this.tokenFile = path.join(process.cwd(), '.ekybot-token');
this.configFile = path.join(process.cwd(), '.env');
}
// Load API token from environment or token file
Reading credentials from a project .env file means any user or process with access to the working directory contents can recover the token. In this connector context, the token appears to enable remote agent control and memory sync, so exposure could let an attacker access or control external systems tied to the account.
return process.env.EKYBOT_API_KEY;
}
// Try .env file
if (fs.existsSync(this.configFile)) {
const envContent = fs.readFileSync(this.configFile, 'utf8');
const match = envContent.match(/EKYBOT_API_KEY=(.+)/);
The function explicitly saves the API token to .env, creating persistent plaintext credential storage in the current working directory. In a tool that connects to a remote control service, theft of this token could enable unauthorized access, impersonation, or manipulation of agent operations and synced project memory.
return null;
}
// Save API token to .env file
saveToken(token) {
try {
let envContent = '';
Reading and rewriting the entire .env file to manage the API key increases the chance that secrets remain in an insecure, broadly accessible project artifact. This also normalizes storing operational credentials alongside application configuration, which is dangerous in shared development environments and CI/CD workspaces.
try {
let envContent = '';
// Read existing .env if it exists
if (fs.existsSync(this.configFile)) {
envContent = fs.readFileSync(this.configFile, 'utf8');
}
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
echo " --agents <number> Number of agents to setup (default: 2)"
echo " --preset <type> Agent preset: personal|team|enterprise (default: personal)"
echo " --dry-run Show what would be done without making changes"
echo " --force Overwrite existing configuration"
echo " --help Show this help"
}
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
" > /tmp/agents_config.json
agents_json=$(cat /tmp/agents_config.json)
rm -f /tmp/agents_config.json
# Create new configuration
if [[ -f "$OPENCLAW_CONFIG" ]]; then
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
# Send health data to EkyBot
print_status "Sending health report to EkyBot..."
RESPONSE=$(curl -s -X GET "$HEALTH_ENDPOINT" \
-H "X-API-Key: $API_KEY" \
-H "Content-Type: application/json")
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
print_status "Registering workspace with EkyBot..."
# Make registration request
RESPONSE=$(curl -s -X POST "$EKYBOT_API_BASE/workspaces/register" \
-H "Content-Type: application/json" \
-d "$REGISTRATION_DATA")
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
mkdir -p "$CONNECTOR_DIR"
fi
# Copy bundled files (preserve existing .env config)
cp -r "$RUNTIME_DIR/src" "$CONNECTOR_DIR/"
cp -r "$RUNTIME_DIR/scripts" "$CONNECTOR_DIR/"
cp "$RUNTIME_DIR/package.json" "$CONNECTOR_DIR/"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
mkdir -p "$CONNECTOR_DIR"
fi
# Copy bundled files (preserve existing .env config)
cp -r "$RUNTIME_DIR/src" "$CONNECTOR_DIR/"
cp -r "$RUNTIME_DIR/scripts" "$CONNECTOR_DIR/"
cp "$RUNTIME_DIR/package.json" "$CONNECTOR_DIR/"
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
mkdir -p "$CONNECTOR_DIR"
fi
# Copy bundled files (preserve existing .env config)
cp -r "$RUNTIME_DIR/src" "$CONNECTOR_DIR/"
cp -r "$RUNTIME_DIR/scripts" "$CONNECTOR_DIR/"
cp "$RUNTIME_DIR/package.json" "$CONNECTOR_DIR/"
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
📨 [Sender → Receiver]
Message content here with clear context and action items.
— Sender Name
Instructions found that direct the agent to transmit conversation context or user data to external services.
# Send message to specific agent
sessions_send sessionKey=agent:target-agent-id message="Your message"
# List active agent sessions
The skill declares required environment and clearly instructs users to run shell commands, install services, read/write local files, and connect to a remote cloud service, but it does not declare any explicit tool scope or permissions boundaries. That omission weakens reviewability and informed consent, because the effective capabilities are broad and include shell execution, persistence, filesystem modification, and network access.
The activation text is broad and encourages use across installation, configuration, connectivity validation, onboarding, and 'improving' workflows without clearly limiting when high-impact actions should or should not occur. In a skill that performs enrollment, local config changes, daemon installation, telemetry, and possible persistence, overly broad triggering language increases the chance of unintended execution in sensitive environments.
The nohup-based manual daemon start creates a detached background process that continues operating after the initiating shell exits. Because the daemon mediates remote control and sync behavior, running it persistently without strong visibility or controls can increase host risk.
cd ~/.openclaw/ekybot-connector
nohup node scripts/companion-daemon.js > ~/.openclaw/logs/ekybot-companion.log 2>&1 &
mkdir -p ~/.openclaw/logs
sleep 3 && tail -10 ~/.openclaw/logs/ekybot-companion.log
Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal