proxy auto config

• Outcome: Review
• Latest audit: May 28, 2026 · 10:49 AM UTC
• Version: 1.0.0

Overview

This is a real proxy-configuration skill, but it makes persistent networking changes and disables normal Node.js HTTPS certificate checks in ways users should review before installing.

Install only if you intentionally want a skill to modify OpenClaw proxy settings and create recurring local proxy checks. Before running the installer, review or patch the cron/systemd setup, avoid proxy URLs containing credentials, and remove the NODE_TLS_REJECT_UNAUTHORIZED=0 behavior so HTTPS certificate validation remains enabled.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (34)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

f.write(cron_content)
        
        # 添加到 crontab
        subprocess.run(['crontab', cron_file], check=True, capture_output=True)
        print(f"✅ 定时任务已创建: {cron_file}")
        return True
    except Exception as e:

• Confidence: 88% confidence
• Finding: The script installs a cron entry that creates persistence in the user's environment without confirmation. While the command itself is static and not shell-injected, it modifies scheduled execution state and will cause this skill's code to run automatically in the future, increasing the blast radius if the skill or its files are later changed or compromised.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print(f"   定时器: {timer_file}")
        
        # 启用定时器
        subprocess.run(['systemctl', '--user', 'enable', 'openclaw-proxy-check.timer'], 
                      capture_output=True)
        subprocess.run(['systemctl', '--user', 'start', 'openclaw-proxy-check.timer'], 
                      capture_output=True)

• Confidence: 90% confidence
• Finding: Enabling a user systemd timer establishes persistence and recurring execution of skill code. The arguments are static, so this is not classic command injection, but silently registering automatic background execution is a security-relevant behavior that can be abused if the skill is modified later or if users did not knowingly consent.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# 启用定时器
        subprocess.run(['systemctl', '--user', 'enable', 'openclaw-proxy-check.timer'], 
                      capture_output=True)
        subprocess.run(['systemctl', '--user', 'start', 'openclaw-proxy-check.timer'], 
                      capture_output=True)
        
        print("✅ systemd 定时器已启用")

• Confidence: 90% confidence
• Finding: Starting the user systemd timer immediately activates persistent scheduled execution without a confirmation step. In a proxy-configuration skill, automatic background execution materially increases risk because later changes to the referenced scripts will execute repeatedly under the user's account.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

return False
        elif dep in ['psutil', 'requests']:
            try:
                subprocess.run([sys.executable, '-m', 'pip', 'install', dep], 
                             check=True, capture_output=True)
                print(f"✅ 已安装 {dep}")
            except subprocess.CalledProcessError as e:

• Confidence: 93% confidence
• Finding: The installer performs runtime `pip install` operations, which fetch and execute package installation logic from package repositories without explicit user approval. Although package names are hardcoded, this still expands trust to external package supply chains and network state, which is broader than necessary for a local installer and increases compromise risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill describes capabilities to read environment variables and files, write configuration and startup scripts, invoke shell commands, and perform network-related proxy checks, yet it declares no permissions. This creates a transparency and consent problem: users and the host platform cannot accurately reason about the skill's access level before installation or execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented behavior goes beyond simple proxy detection/configuration into persistence and system modification: package installation, crontab changes, systemd unit creation, wrapper script deployment, and executable permission changes. Even if related to the feature set, these are materially more invasive actions that can establish long-lived execution paths and alter how other software launches.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The code sets NODE_TLS_REJECT_UNAUTHORIZED=0 while configuring proxy environment variables, which disables TLS certificate validation for Node.js processes. That allows man-in-the-middle interception of supposedly HTTPS traffic and is unrelated to the minimum functionality needed for proxy setup, making the proxy-management context more dangerous rather than safer.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The generated startup script persists the TLS-verification bypass into a reusable launcher, so every future Gateway start inherits disabled certificate validation. This expands the blast radius from the current process to repeated operational use and enables silent interception of outbound Node.js HTTPS connections.

Context-Inappropriate Capability

Medium

• Confidence: 99% confidence
• Finding: The generated systemd user service hardcodes NODE_TLS_REJECT_UNAUTHORIZED=0, causing the insecure TLS setting to persist across service restarts and user sessions. In a long-running service context this materially increases exposure to MITM attacks against Gateway or other Node.js network activity.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The CLI advertises --no-gateway-config and --no-startup-script, but those options are never honored and the script still performs both actions. This violates user intent and can cause unexpected persistent changes to configs and executable files, which is especially risky in a system-configuration skill.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The installer goes beyond one-time proxy setup and creates persistent cron jobs, startup hooks, and wrapper scripts in the user's home directory. This is security-significant because it establishes ongoing execution paths that can later run modified code automatically, which is more dangerous than the stated proxy-detection purpose suggests.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Automatically installing Python packages at runtime is not strictly necessary to detect or configure proxies and broadens the skill's capabilities into package management. That creates avoidable supply-chain and integrity risk, especially for an installer that also sets up persistence.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The proxy test sends an outbound request to `http://httpbin.org/ip`, which leaks that the tool is running, the tested proxy path, and potentially identifying network metadata to a third-party service unrelated to local configuration. In a proxy-auto-detection skill, this is more sensitive because users may expect only local inspection, not external beaconing during a test operation.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script persists detected proxy URLs, selected proxy information, and current proxy-related environment values to disk in JSON and shell script form. Proxy URLs can embed credentials or reveal internal network topology, so writing them to disk expands exposure beyond what is needed for transient runtime configuration.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The script presents itself as a simple proxy checker but also writes persistent configuration files and an executable shell script under the user's home directory. That hidden side effect increases the chance of unexpected environment modification and can persist unsafe settings, especially because the generated script later weakens TLS-related behavior.

Intent-Code Divergence

Medium

• Confidence: 76% confidence
• Finding: The top-level documentation describes a simplified detection script, but the implementation performs configuration generation and filesystem writes. This mismatch is risky because users or higher-level agents may treat the script as observational when it actually changes system state.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README instructs users to run automatic proxy detection and apply generated shell configuration without clearly warning that this will modify environment behavior and potentially Gateway-related configuration on the system. In an agent skill context, proxy settings affect all downstream network traffic, so understated documentation can lead to unintended interception, routing changes, or troubleshooting difficulty.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README provides cron, reboot, and systemd examples that create persistent startup behavior, but does not prominently warn users that these mechanisms will cause proxy configuration logic to run automatically after installation or reboot. Persistent proxy automation is security-relevant because it can silently alter future network routing and survive beyond the user's immediate testing session.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill is presented as auto-triggering whenever the system is in a proxy network environment, but the trigger scope is not narrowly defined. Broad or ambiguous activation criteria can cause unexpected execution of file writes, environment mutation, and persistence setup without a clear user action.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The listed auto-trigger conditions include Gateway startup, network changes, proxy process state changes, and manual requests, but they do not specify safeguards or limits on what is allowed during those triggers. In context, this is risky because the skill also discusses modifying configs, hooks, timers, and startup behavior, so an automatic invocation could make persistent changes unexpectedly.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This section describes automatic updates to environment variables, Gateway configuration, startup scripts, and possibly system proxy settings, but does not foreground that these are system-changing operations. Users may reasonably interpret the skill as passive detection rather than a tool that rewrites launch paths and runtime environment.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow includes creating scheduled check tasks and startup hooks, which are persistent background changes, but the documentation does not clearly highlight the persistence and ongoing execution implications. Persistence mechanisms increase risk because they continue to run after the initial setup and may alter behavior over time.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Reading proxy-related environment variables and configuration files can expose sensitive information such as internal endpoints, authentication tokens, usernames, or passwords embedded in proxy URLs or configs. The skill does not warn users that detection may access sensitive network configuration data.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The script silently disables Node.js TLS verification without any explicit user disclosure or consent. Because users would reasonably expect a proxy helper to preserve HTTPS security, the lack of warning makes unsafe behavior stealthier and increases the likelihood of compromise through intercepted traffic.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The generated startup script embeds disabled TLS verification with no warning in the file or surrounding UX, so users may execute it repeatedly without realizing HTTPS protections are gone. That hidden insecure state is particularly dangerous for a convenience script intended to simplify normal operations.

Static analysis

Detected: suspicious.destructive_delete_command, suspicious.dynamic_code_execution, suspicious.insecure_tls_verification

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:145

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/gateway_proxy_setup.py:26

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/gateway_proxy_setup.py:133