Claw Sos

• Outcome: Review
• Latest audit: May 28, 2026 · 9:52 AM UTC
• Version: 6.1.2

Overview

This appears to be a real OpenClaw emergency recovery tool, but it needs Review because its automatic repair and install paths can make privileged, system-wide changes without enough confirmation.

Install only on OpenClaw hosts you administer. Prefer the bundled script or a pinned, reviewed release over `curl | bash`; avoid unattended `sos auto` unless you accept service restarts, process kills, DNS changes, cleanup actions, and real Telegram API calls using the configured bot token.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill clearly instructs the agent/user to execute shell commands locally and over SSH, including installation to privileged paths and recovery actions, but it declares no permissions. This mismatch can bypass governance expectations and cause the skill to be invoked without the explicit shell/remote-execution safeguards that such powerful operations require.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Autofix unconditionally rewrites /etc/resolv.conf with hardcoded public resolvers, making a host-wide network configuration change that exceeds routine application recovery. This can break managed DNS setups, violate enterprise policy, disrupt split-horizon/internal name resolution, and alter connectivity for unrelated services on the machine.

Vague Triggers

Medium

• Confidence: 81% confidence
• Finding: The trigger text includes broad operational phrases like "sos," "recovery," "bot is down," and "not responding," which can match routine troubleshooting conversations and cause unintended activation of a highly privileged recovery skill. Because this skill performs shell and remote recovery actions, accidental invocation materially increases the chance of disruptive or destructive commands being suggested or run in the wrong context.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The installer downloads a remote script and writes it into a system binary path, potentially using sudo, without an explicit confirmation step or strong warning that a privileged executable is being installed. In this skill context, the danger is higher because it is an emergency-recovery tool that users may run quickly under pressure, increasing the chance they approve privileged changes without scrutiny.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script performs a destructive system configuration change at runtime without a just-in-time warning or confirmation from the operator. In an emergency recovery context, users may invoke autofix expecting service-local remediation, not host-wide DNS rewrites, increasing the chance of accidental damage.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The Telegram test sends bot-authenticated requests and may auto-discover a chat ID from recent updates, but it does not provide a clear privacy or data-transmission warning before contacting Telegram. In practice this can expose operational metadata and trigger a real outbound message without the operator fully understanding what data is being transmitted.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Allow custom install dir
INSTALL_DIR="${INSTALL_DIR:-/usr/local/bin}"
mkdir -p "$INSTALL_DIR" 2>/dev/null || $SUDO mkdir -p "$INSTALL_DIR"

# Detect OS
OS="$(uname -s)"

• Confidence: 82% confidence
• Finding: This line conditionally uses sudo to create the target installation directory, enabling privileged filesystem modification in a persistent executable path. While common in installers, it is security-relevant because it contributes to installing code into a trusted location and should be gated by explicit user consent.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Download
echo -ne "  Downloading sos.sh... "
if command -v curl &>/dev/null; then
  $SUDO curl -fsSL "$RAW_URL" -o "${INSTALL_DIR}/${SCRIPT_NAME}"
elif command -v wget &>/dev/null; then
  $SUDO wget -qO "${INSTALL_DIR}/${SCRIPT_NAME}" "$RAW_URL"
else

• Confidence: 97% confidence
• Finding: This command downloads remote content directly into a system executable path using sudo, making any compromise of the upstream source, branch, or transport endpoint immediately impact the local system. In the context of an emergency-recovery skill, this is especially risky because operators may run it quickly on production machines with elevated trust.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if command -v curl &>/dev/null; then
  $SUDO curl -fsSL "$RAW_URL" -o "${INSTALL_DIR}/${SCRIPT_NAME}"
elif command -v wget &>/dev/null; then
  $SUDO wget -qO "${INSTALL_DIR}/${SCRIPT_NAME}" "$RAW_URL"
else
  echo -e "${RED}Error: curl or wget required${NC}"
  exit 1

• Confidence: 97% confidence
• Finding: This wget variant has the same risk profile as the curl path: it retrieves remote content and writes it directly to a privileged executable location. If the downloaded file is altered upstream or through dependency compromise, the system installs attacker-controlled code into a trusted path.

External Script Fetching

Low

• Category: Supply Chain

Content

Alternative — install from GitHub:
```bash
curl -fsSL https://raw.githubusercontent.com/clawsos/claw-sos/main/install.sh | bash
```

## Usage

• Confidence: 96% confidence
• Finding: The skill recommends fetching and executing a remote installer directly from GitHub at runtime. If the upstream repository, network path, or referenced branch is compromised, arbitrary code will be executed immediately on the target machine, potentially as root in the documented install flow.

External Script Fetching

Low

• Category: Supply Chain

Content

# ═══════════════════════════════════════════════════════════════
# Claw-SOS Installer
# ═══════════════════════════════════════════════════════════════
# Usage: curl -fsSL https://raw.githubusercontent.com/clawsos/claw-sos/main/install.sh | bash
# Or:    wget -qO- https://raw.githubusercontent.com/clawsos/claw-sos/main/install.sh | bash

set -euo pipefail

• Confidence: 99% confidence
• Finding: The usage example encourages piping a remotely fetched script directly into bash, bypassing review, integrity validation, and safe staging. In this skill's incident-recovery context, users may copy-paste such commands under time pressure, making remote code execution more likely on important systems.

External Script Fetching

Low

• Category: Supply Chain

Content

# Claw-SOS Installer
# ═══════════════════════════════════════════════════════════════
# Usage: curl -fsSL https://raw.githubusercontent.com/clawsos/claw-sos/main/install.sh | bash
# Or:    wget -qO- https://raw.githubusercontent.com/clawsos/claw-sos/main/install.sh | bash

set -euo pipefail

• Confidence: 99% confidence
• Finding: This wget-based example has the same issue as the curl example: it promotes immediate execution of unverified remote code. Any compromise of the repository, branch, or delivery path could lead to arbitrary code execution by the operator.

Chaining Abuse

High

• Category: Tool Misuse

Content

Alternative — install from GitHub:
```bash
curl -fsSL https://raw.githubusercontent.com/clawsos/claw-sos/main/install.sh | bash
```

## Usage

• Confidence: 98% confidence
• Finding: The `curl ... | bash` pattern is a direct arbitrary-code-execution primitive: remote content is streamed uninspected into a shell. In this skill's context, where installation is performed on local or remote systems and may involve root-owned paths, exploitation could fully compromise the host, persistence mechanisms, and any bot credentials or configs present on the machine.

Chaining Abuse

High

• Category: Tool Misuse

Content

# ═══════════════════════════════════════════════════════════════
# Claw-SOS Installer
# ═══════════════════════════════════════════════════════════════
# Usage: curl -fsSL https://raw.githubusercontent.com/clawsos/claw-sos/main/install.sh | bash
# Or:    wget -qO- https://raw.githubusercontent.com/clawsos/claw-sos/main/install.sh | bash

set -euo pipefail

• Confidence: 99% confidence
• Finding: The '| bash' pattern is a classic command-chaining risk because it executes remote content immediately without validation. When combined with an emergency-repair use case and potential sudo operations later in the script, it materially increases the chance of a high-impact system compromise.

Chaining Abuse

High

• Category: Tool Misuse

Content

# Claw-SOS Installer
# ═══════════════════════════════════════════════════════════════
# Usage: curl -fsSL https://raw.githubusercontent.com/clawsos/claw-sos/main/install.sh | bash
# Or:    wget -qO- https://raw.githubusercontent.com/clawsos/claw-sos/main/install.sh | bash

set -euo pipefail

• Confidence: 99% confidence
• Finding: This line repeats the same dangerous command-chaining pattern using wget output piped into bash. It creates a straightforward remote-code-execution path for anyone following the documented install command.

Static analysis

No suspicious patterns detected.