T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:24- Finding
Unverified Mutable Remote Installer Executed Directly by Bash
- Content
View full analysis
- Remediation
View remediation
Security audit
Claw Sos
Security checks for vulnerabilities and agentic risk
Overview
This recovery skill mostly matches its stated purpose, but it gives agents and installers broad system-changing authority with unsafe remote installation and under-disclosed automatic repairs.
Review before installing. Prefer the bundled `scripts/sos.sh` over the GitHub pipe-to-bash path, avoid running `sos auto` as root on production or managed hosts, and use the read-only diagnostics first unless you are comfortable with service restarts, process kills, DNS changes, and temporary-file cleanup.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)
T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/install.sh:10- Finding
Installer Downloads, Installs, and Executes an Unverified Remote Executable
- Content
View full analysis
/dev/null; then $SUDO curl -fsSL "$RAW_URL" -o "${INSTALL_DIR}/${SCRIPT_NAME}" elif command -v wget &>/dev/null; then $SUDO wget -qO "${INSTALL_DIR}/${SCRIPT_NAME}" "$RAW_URL" else echo -e "${RED}Error: curl or wget required${NC}" exit 1 fi echo -e "${GREEN}✓${NC}" # Make executable $SUDO chmod +x "${INSTALL_DIR}/${SCRIPT_NAME}" ``` ```bash VERSION=$("${INSTALL_DIR}/${SCRIPT_NAME}" --version 2>/dev/null || echo "unknown") ``` ### Technical Analysis Even if the installer itself has been reviewed, it does not install the bundled `scripts/sos.sh`. Instead, it retrieves another script from the mutable remote `main` branch, writes it into a trusted executable directory, marks it executable, and immediately runs it to obtain its version. No checksum, signature, pinned commit, expected size, or trusted release manifest is verified. The installer can use `sudo` when `/usr/local/bin` is not writable, allowing the unverified script to be placed in a system-wide command path. This creates two execution opportunities: 1. Immediate execution during the version check. 2. Future execution whenever a user invokes the trusted-looking `sos` command. ### Attack Path 1. An attacker changes `sos.sh` on the remote `main` branch. 2. A user runs the installer. 3. The installer downloads the modified script using `curl` or `wget`. 4. When needed, `sudo` writes the payload to `/usr/local/bin/sos`. 5. The installer marks the payload executable. 6. The version check immediately invokes the downloaded payload. 7. The malicious executable ...[truncated 572 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sos.sh:121- Finding
Automatic Recovery Deletes Unrelated Files Across the Shared Temporary Directory
- Content
View full analysis
/dev/null || true find /tmp -type f -mtime +1 -delete 2>/dev/null || true else journalctl --vacuum-size=50M &>/dev/null || true npm cache clean --force &>/dev/null || true find /tmp -type f -mtime +1 -delete 2>/dev/null || true fi } ``` This function is invoked automatically when available disk space is below 200 MB: ```bash if ! $disk_ok; then echo -e "${YELLOW}Step 0.5: Clearing disk space...${NC}" clean_disk log "AUTOFIX" "Cleared disk space" echo -e " Disk now: ${CYAN}$(get_avail_disk_mb)MB${NC}" echo "" fi ``` ### Technical Analysis The cleanup operation recursively deletes every regular file under `/tmp` whose modification time is older than one day. It does not restrict deletion to OpenClaw-owned paths, verify file ownership, identify active consumers, or request confirmation. `/tmp` is shared by unrelated applications and users. File age does not establish that a file is unused. Long-running jobs, package managers, sockets accompanied by state files, lock-based workflows, and application recovery processes may depend on files older than one day. The function is reached through `sos auto`, which is documented as the recommended default action. Therefore, a recovery operation for one application can destructively affect unrelated system workloads. ### Attack Path 1. Available space on the root filesystem falls below 200 MB. 2. A user or automated agent runs the recommended `sos auto` command. 3. The disk check marks storage as critical. 4. `clean_disk` recursively scans the shared `/tmp` hierarchy. 5. Every regular file older than one day that the invoking account can delete is removed. 6. Applications relying on those files fail, lose state, ...[truncated 608 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/sos.sh:507- Finding
Autofix Replaces System DNS Configuration Without Administrator Confirmation
- Content
View full analysis
/dev/null; then echo -e " ${RED}✗ Can't reach Telegram API!${NC}" log "AUTOFIX" "Network: Telegram API unreachable" if ! check_dns; then echo -e " ${RED}✗ DNS is broken too${NC}" echo -e " ${YELLOW}Attempting DNS fix...${NC}" cp /etc/resolv.conf /etc/resolv.conf.bak 2>/dev/null || true echo -e "nameserver 1.1.1.1\nnameserver 8.8.8.8" > /etc/resolv.conf log "AUTOFIX" "Fixed DNS (set 1.1.1.1 + 8.8.8.8)" sleep 2 if timeout 5 curl -sf https://api.telegram.org -o /dev/null 2>/dev/null; then echo -e " ${GREEN}✓ DNS fix worked!${NC}" else echo -e " ${RED}✗ Still can't reach internet — network problem, not OpenClaw${NC}" echo -e "\n${RED}⚠ Fix the network first. No point restarting without internet.${NC}" log "AUTOFIX" "FAILED — network issue, not OpenClaw" return 1 fi else echo -e " ${YELLOW}DNS works but Telegram blocked — might be temporary${NC}" net_ok=false fi fi ``` ### Technical Analysis When both Telegram connectivity and the script's DNS test fail, automatic recovery attempts to overwrite `/etc/resolv.conf` with Cloudflare and Google public DNS servers. No explicit confirmation is requested, and the original configuration is not restored after testing. The backup operation ignores errors. If copying `/etc/resolv.conf` fails, the script still attempts to overwrite the file. The implementation also does not account for systems where DNS is managed by NetworkManager, `systemd-resolved`, DHCP, VPN software, configuration management, split-horizon DNS, or enterprise policy. A transient connectivity failure can therefore trigger a persistent host-wide network configuration change unrelated to OpenClaw proce ...[truncated 1164 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/sos.sh:943- Finding
Rollback Performs Global npm Installation from Insufficiently Validated Version Input
- Content
View full analysis
/dev/null | head -1) LAST_VER_PATH=$(ls -t $BACKUP_DIR/pre-update-*.version 2>/dev/null | head -1) if [[ -z "${LAST_BACKUP_PATH:-}" ]]; then echo -e "${RED}No backup found!${NC}" echo -e "${DIM}Enter the version number you want (e.g. 2026.3.7):${NC}" echo -ne "> " read -r ROLLBACK_VER log "WARN" "No backup found, manual version entry: $ROLLBACK_VER" else ROLLBACK_VER=$(cat "$LAST_VER_PATH" 2>/dev/null || "") echo -e "Backup found: ${CYAN}$(basename $LAST_BACKUP_PATH)${NC}" echo -e "Will rollback to version: ${CYAN}${ROLLBACK_VER:-unknown}${NC}" if [[ -z "${ROLLBACK_VER:-}" ]]; then echo -e "${DIM}Version file missing. Enter the version:${NC}" echo -ne "> " read -r ROLLBACK_VER fi fi echo -ne "${RED}Rollback to ${ROLLBACK_VER}? (y/N): ${NC}" read -r confirm if [[ "$confirm" == "y" || "$confirm" == "Y" ]]; then log "ACTION" "Rollback started to version $ROLLBACK_VER" echo -e "${YELLOW}Step 1/4: Installing openclaw@${ROLLBACK_VER}...${NC}" if ! npm install -g openclaw@${ROLLBACK_VER}; then echo -e "${RED}npm install failed! Aborting.${NC}" log "ERROR" "npm install failed for $ROLLBACK_VER" else echo -e "${YELLOW}Step 2/4: Reinstalling gateway service...${NC}" openclaw gateway install --force if [[ -n "${LAST_BACKUP_PATH:-}" ]]; then echo -e "${YELLOW}Step 3/4: Restoring config backup...${NC}" cp "$LAST_BACKUP_PATH" "$OC_CONFIG" fi fi fi ``` ### Technical Analysis The rollback version is accepted from interactive input or read from a local version file without validation against a strict version syntax or an approved release manifest. It is then used in a global npm installation. Although ordinary shell metacharacters introduc ...[truncated 1695 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (45)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description presents the skill primarily as a recovery/management utility for SOS, focused on installing, running, diagnosing, and fixing OpenClaw bot issues. The supplied code chunk instead performs a narrow and materially different action: uninstalling the
soscommand from the system. While uninstall might loosely fall under 'manage,' it is not stated in the declared purpose, and none of the recovery, diagnosis, autofix, rollback, network check, or Telegram test behaviors are present in this code. Therefore this code chunk does not accurately represent the declared description.- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
Piping curl output directly into bash executes network-delivered code immediately without giving the operator or agent a chance to inspect it. In this skill's context, the command may run with elevated privileges during emergency recovery, making compromise especially damaging and increasing the blast radius to full host takeover.
- Content
Alternative — install from GitHub:
bash curl -fsSL https://raw.githubusercontent.com/clawsos/claw-sos/main/install.sh | bashUsage
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
Piping curl output directly into bash is a classic unsafe command-chaining pattern because it immediately executes remote content without validation. In this script's context, it can lead to arbitrary code execution and privileged system modification if the fetched installer or its source is compromised.
- Content
sh # ═══════════════════════════════════════════════════════════════ # Claw-SOS Installer # ═══════════════════════════════════════════════════════════════ # Usage: curl -fsSL https://raw.githubusercontent.com/clawsos/claw-sos/main/install.sh | bash # Or: wget -qO- https://raw.githubusercontent.com/clawsos/claw-sos/main/install.sh | bash set -euo pipefail
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
Piping wget output into bash is equally dangerous because it combines network retrieval and code execution into one step with no review or verification. This creates a simple path for supply-chain compromise to become immediate local execution.
- Content
sh # Claw-SOS Installer # ═══════════════════════════════════════════════════════════════ # Usage: curl -fsSL https://raw.githubusercontent.com/clawsos/claw-sos/main/install.sh | bash # Or: wget -qO- https://raw.githubusercontent.com/clawsos/claw-sos/main/install.sh | bash set -euo pipefail
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh if [[ -z "$chat_id" ]]; then # Try to get from recent updates chat_id=$(timeout 5 curl -sf "https://api.telegram.org/bot${token}/getUpdates?limit=1" 2>/dev/null \ | python3 -c "import json,sys; d=json.load(sys.stdin); print(d['result'][-1]['message']['chat']['id'])" 2>/dev/null || echo "") if [[ -z "$chat_id" ]]; then echo -e "${RED}✗ Can't auto-detect chat ID. Please enter manually.${NC}"
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
sh local msg="🔧 SOS Test Message | $timestamp | This confirms Telegram delivery is working." echo -e "\n Sending test message..." local result=$(timeout 10 curl -sf -X POST "https://api.telegram.org/bot${token}/sendMessage" \ -d "chat_id=${chat_id}" -d "text=${msg}" 2>/dev/null) if echo "$result" | python3 -c "import json,sys; d=json.load(sys.stdin); assert d['ok']" 2>/dev/null; then
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Autofix silently overwrites /etc/resolv.conf with hard-coded public resolvers after a failed DNS check, without an immediate confirmation prompt at the moment of change. On production systems this can break managed DNS setups, bypass enterprise controls, or disrupt networking further, while making a destructive system change during an automated recovery flow.
- Content
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh echo -e "${GREEN}Backed up:${NC}" echo " Config → $BACKUP_DIR/pre-update-${TIMESTAMP}.json" echo " Version → $CURRENT_VER" ls -t $BACKUP_DIR/pre-update-*.json 2>/dev/null | tail -n +6 | xargs rm -f 2>/dev/null ls -t $BACKUP_DIR/pre-update-*.version 2>/dev/null | tail -n +6 | xargs rm -f 2>/dev/null echo -e "${GREEN}Old backups cleaned (keeping last 5).${NC}" log "INFO" "Manual backup created: pre-update-${TIMESTAMP}"
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
sh echo -e "${GREEN}Backed up:${NC}" echo " Config → $BACKUP_DIR/pre-update-${TIMESTAMP}.json" echo " Version → $CURRENT_VER" ls -t $BACKUP_DIR/pre-update-*.json 2>/dev/null | tail -n +6 | xargs rm -f 2>/dev/null ls -t $BACKUP_DIR/pre-update-*.version 2>/dev/null | tail -n +6 | xargs rm -f 2>/dev/null echo -e "${GREEN}Old backups cleaned (keeping last 5).${NC}" log "INFO" "Manual backup created: pre-update-${TIMESTAMP}"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh fi if [[ -f "${INSTALL_DIR}/${SCRIPT_NAME}" ]]; then $SUDO rm -f "${INSTALL_DIR}/${SCRIPT_NAME}" echo -e "${GREEN}✓ Removed ${INSTALL_DIR}/${SCRIPT_NAME}${NC}" echo -e " Log file kept at: ~/.openclaw/backups/sos.log" echo -e " Config backups kept at: ~/.openclaw/backups/"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill clearly instructs use of shell commands including local installation, remote SSH/SCP actions, and execution of a recovery script, but it declares no explicit tool scope or permissions. That omission weakens policy enforcement and increases the chance an agent could invoke impactful shell operations without clear authorization boundaries.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger phrases are broad and overlap with common support language like 'bot is down,' 'not responding,' and 'emergency fix.' In an agent environment, that can cause over-invocation of a high-impact recovery skill, leading to unnecessary SSH actions, restarts, rollback, or destructive remediation in situations that only needed diagnosis.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 78% confidence
- Finding
Installing a command into /usr/local/bin creates persistence by adding a new executable into a standard path that may be invoked later by users or automation. In this skill's emergency-recovery context, such persistence is somewhat expected, but it still increases risk because the installed artifact is network-fetched and intended for repeated future use.
- Content
sh echo -e "${CYAN}╚═══════════════════════════════════════╝${NC}" echo "" # Check if running as root or can write to install dir if [[ -w "$INSTALL_DIR" ]]; then SUDO="" elif command -v sudo &>/dev/null; then
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 50% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh SUDO="" elif command -v sudo &>/dev/null; then SUDO="sudo" echo -e "${YELLOW}Need sudo to install to ${INSTALL_DIR}${NC}" else echo -e "${RED}Error: Can't write to ${INSTALL_DIR} and sudo not available.${NC}" echo -e "${YELLOW}Try: INSTALL_DIR=~/.local/bin bash <(curl -fsSL ...)${NC}"
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
This line creates the installation directory with sudo when needed, contributing to privileged filesystem modification. In the context of an installer that later places a remotely fetched executable there, this privileged directory creation helps enable persistence in a trusted execution path.
- Content
sh # Allow custom install dir INSTALL_DIR="${INSTALL_DIR:-/usr/local/bin}" mkdir -p "$INSTALL_DIR" 2>/dev/null || $SUDO mkdir -p "$INSTALL_DIR" # Detect OS OS="$(uname -s)"
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
This command fetches remote content and writes it directly to an executable location, potentially under sudo. That creates a straightforward supply-chain and remote-code-execution risk because mutable network content is being trusted as a local command without verification.
- Content
sh # Download echo -ne " Downloading sos.sh... " if command -v curl &>/dev/null; then $SUDO curl -fsSL "$RAW_URL" -o "${INSTALL_DIR}/${SCRIPT_NAME}" elif command -v wget &>/dev/null; then $SUDO wget -qO "${INSTALL_DIR}/${SCRIPT_NAME}" "$RAW_URL" else
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The installer downloads a remote script from GitHub and writes it directly into a system executable path, potentially using sudo, without any integrity verification or interactive confirmation. If the remote content, branch, repository, or network path is compromised, the user can silently install attacker-controlled code with elevated privileges.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
This wget variant has the same security issue as the curl path: it writes unverified remote content into a trusted local executable path, potentially with elevated privileges. An attacker who can influence the fetched content gains code execution and persistence when the installed command is later run.
- Content
sh if command -v curl &>/dev/null; then $SUDO curl -fsSL "$RAW_URL" -o "${INSTALL_DIR}/${SCRIPT_NAME}" elif command -v wget &>/dev/null; then $SUDO wget -qO "${INSTALL_DIR}/${SCRIPT_NAME}" "$RAW_URL" else echo -e "${RED}Error: curl or wget required${NC}" exit 1
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh local svc_type=$(detect_service) if [[ "$action" == "start" && "$svc_type" == "none" ]]; then if [[ "$OS_TYPE" == "macos" ]]; then # Check for plist even if not currently loaded if ls ~/Library/LaunchAgents/*openclaw* &>/dev/null 2>&1 || ls /Library/LaunchDaemons/*openclaw* &>/dev/null 2>&1; then svc_type="launchctl" fi
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh local svc_type=$(detect_service) if [[ "$action" == "start" && "$svc_type" == "none" ]]; then if [[ "$OS_TYPE" == "macos" ]]; then # Check for plist even if not currently loaded if ls ~/Library/LaunchAgents/*openclaw* &>/dev/null 2>&1 || ls /Library/LaunchDaemons/*openclaw* &>/dev/null 2>&1; then svc_type="launchctl" fi
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh local svc_type=$(detect_service) if [[ "$action" == "start" && "$svc_type" == "none" ]]; then if [[ "$OS_TYPE" == "macos" ]]; then # Check for plist even if not currently loaded if ls ~/Library/LaunchAgents/*openclaw* &>/dev/null 2>&1 || ls /Library/LaunchDaemons/*openclaw* &>/dev/null 2>&1; then svc_type="launchctl" fi
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh local svc_type=$(detect_service) if [[ "$action" == "start" && "$svc_type" == "none" ]]; then if [[ "$OS_TYPE" == "macos" ]]; then # Check for plist even if not currently loaded if ls ~/Library/LaunchAgents/*openclaw* &>/dev/null 2>&1 || ls /Library/LaunchDaemons/*openclaw* &>/dev/null 2>&1; then svc_type="launchctl" fi
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh local svc_type=$(detect_service) if [[ "$action" == "start" && "$svc_type" == "none" ]]; then if [[ "$OS_TYPE" == "macos" ]]; then # Check for plist even if not currently loaded if ls ~/Library/LaunchAgents/*openclaw* &>/dev/null 2>&1 || ls /Library/LaunchDaemons/*openclaw* &>/dev/null 2>&1; then svc_type="launchctl" fi
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh local svc_type=$(detect_service) if [[ "$action" == "start" && "$svc_type" == "none" ]]; then if [[ "$OS_TYPE" == "macos" ]]; then # Check for plist even if not currently loaded if ls ~/Library/LaunchAgents/*openclaw* &>/dev/null 2>&1 || ls /Library/LaunchDaemons/*openclaw* &>/dev/null 2>&1; then svc_type="launchctl" fi
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh local svc_type=$(detect_service) if [[ "$action" == "start" && "$svc_type" == "none" ]]; then if [[ "$OS_TYPE" == "macos" ]]; then # Check for plist even if not currently loaded if ls ~/Library/LaunchAgents/*openclaw* &>/dev/null 2>&1 || ls /Library/LaunchDaemons/*openclaw* &>/dev/null 2>&1; then svc_type="launchctl" fi
Static analysis
No suspicious patterns detected.