ClawHub
Back to skill

Security audit

Openclaw Skill Gastown

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed multi-agent coding orchestrator, but it gives agents broad automatic execution authority and includes high-impact installation steps that users should review carefully before use.

Install only if you intentionally want a persistent multi-agent coding system that can spawn agents, run shell commands, alter repositories, and manage merge workflows. Review setup.sh and the SKILL.md setup commands before running them, prefer pinned and verified tool versions, avoid autonomous hook execution for untrusted tasks, and keep the Gas Town workspace limited to repositories and credentials you are comfortable exposing to these agents.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:500
Finding

Mutable Remote Homebrew Installer Is Executed Directly by Bash

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:81
Finding

Unconditional Hook Execution Redirects the Agent to Potentially Untrusted Persistent Instructions

Content
View full analysis
**"If there is work on your Hook, YOU MUST RUN IT."** This principle ensures agents autonomously proceed with available work without waiting for external input. GUPP is the heartbeat of autonomous operation. Gas Town is a steam engine. Agents are pistons. The entire system's throughput depends on one thing: when an agent finds work on their hook, they EXECUTE. **Why This Matters:** - There is no supervisor polling asking "did you start yet?" - The hook IS your assignment - it was placed there deliberately - Every moment you wait is a moment the engine stalls - Other agents may be blocked waiting on YOUR output ... > **If you find something on your hook, YOU RUN IT.** This applies regardless of role. The hook is your assignment. Execute it immediately without waiting for confirmation. ... **Startup Behavior**: 1. Check hook (`gt hook`) 2. Work hooked → EXECUTE immediately 3. Hook empty → Check mail for attached work 4. Nothing anywhere → ERROR: escalate to Witness ``` The Skill also declares at `SKILL.md:36`: ```text **Primary Role**: You operate the system directly - users never run terminal commands themselves. You execute all `gt` and `bd` commands via Bash, reporting results conversationally. ``` ### Technical Analysis The Skill changes the agent's operating policy from responding to the current user's reviewed request to automatically executing instructions retrieved from persistent hooks or mail. It repeatedly requires execution “immediately” and “without waiting for confirmation.” Hooks, mail, beads, formulas, and repository task descriptions cross trust boundaries. They can contain content authored by other agents, repository contributors, coordinators, or compromised components. The Skill provides no requirement to authenti ...[truncated 1957 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
scripts/setup.sh:51
Finding

Runtime Installation Uses Mutable Unpinned Third-Party Executables

Content
View full analysis
/dev/null; then echo "📦 Installing Gas Town (gt)..." go install github.com/steveyegge/gastown/cmd/gt@latest 2>&1 echo "✅ gt $(gt version 2>&1)" else echo "✅ gt $(gt version 2>&1)" fi # Install bd if needed if ! command -v bd &>/dev/null; then echo "📦 Installing Beads (bd)..." CGO_ENABLED=0 go install github.com/steveyegge/beads/cmd/bd@latest 2>&1 echo "✅ bd $(bd version 2>&1)" else echo "✅ bd $(bd version 2>&1)" fi ``` Equivalent mutable installation guidance also appears in `SKILL.md:460`, `SKILL.md:476-478`, `SKILL.md:581-582`, and `README.md:35-36`: ```bash brew install gastown npm install -g @gastown/gt go install github.com/steveyegge/gastown/cmd/gt@latest go install github.com/steveyegge/beads/cmd/bd@latest ``` ### Technical Analysis The setup script installs the latest available revisions of Gas Town and Beads rather than exact audited versions or immutable commit hashes. No lockfile, checksum, signature, vendored source, or reviewed dependency manifest constrains the code that will be built and installed. The installed programs are security-sensitive. They coordinate agents, manipulate repositories and worktrees, maintain persistent state, process mail and hooks, and participate in merge workflows. A compromised upstream revision or transitive dependency would therefore execute in a highly trusted orchestration context. The npm alternative additionally performs a global package installation, expanding the affected environment beyond the project directory. ### Attack Path 1. An upstream repository, package publication account, release process, or transitive dependency is compromised. 2. A malicious revision becomes the version resolved by `@latest`, Homebrew, or npm. 3. A user or agent ...[truncated 1105 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/setup.sh:23
Finding

Go Toolchain Archive Is Unverified and Uses a Predictable Temporary Path

Content
View full analysis
/dev/null; then echo "📦 Installing Go..." ARCH=$(uname -m) case "$ARCH" in x86_64) GOARCH="amd64" ;; aarch64|arm64) GOARCH="arm64" ;; *) echo "❌ Unsupported arch: $ARCH"; exit 1 ;; esac OS=$(uname -s | tr '[:upper:]' '[:lower:]') GO_VERSION="1.23.6" URL="https://go.dev/dl/go${GO_VERSION}.${OS}-${GOARCH}.tar.gz" mkdir -p "$HOME/local" wget -q "$URL" -O /tmp/go.tar.gz tar -C "$HOME/local" -xzf /tmp/go.tar.gz rm /tmp/go.tar.gz export PATH="$PATH:$HOME/local/go/bin:$HOME/go/bin" if ! grep -q 'local/go/bin' "$HOME/.bashrc" 2>/dev/null; then echo 'export PATH=$PATH:$HOME/local/go/bin:$HOME/go/bin' >> "$HOME/.bashrc" fi ``` ### Technical Analysis The script downloads a compiler archive and extracts it without validating its official checksum or signature. HTTPS protects the transport under normal conditions but does not provide artifact-level assurance against an upstream compromise, certificate authority failure, proxy interference, or compromised delivery infrastructure. The script also writes to the fixed path `/tmp/go.tar.gz`. On a shared host, an attacker may pre-create that path as a symbolic link to another file writable by the victim or race creation and replacement of the path. Because `wget -O` writes to the named destination, this can cause unintended file truncation or overwrite. The archive is then trusted as a Go toolchain and used to compile the security-sensitive `gt` and `bd` executables. A malicious compiler can compromise those outputs even if their source repositories are legitimate. ### Attack Path #### Remote artifact attack 1. An attacker compromises the archive source or deli ...[truncated 1714 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (23)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 520)May include surrounding context.

md
# Install Go (apt version may be outdated, use official installer)
wget https://go.dev/dl/go1.24.12.linux-amd64.tar.gz
sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.24.12.linux-amd64.tar.gz
echo 'export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin' >> ~/.bashrc
source ~/.bashrc

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 520)May include surrounding context.

md
# Install Go (apt version may be outdated, use official installer)
wget https://go.dev/dl/go1.24.12.linux-amd64.tar.gz
sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.24.12.linux-amd64.tar.gz
echo 'export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin' >> ~/.bashrc
source ~/.bashrc

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 520)May include surrounding context.

md
# Install Go (apt version may be outdated, use official installer)
wget https://go.dev/dl/go1.24.12.linux-amd64.tar.gz
sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.24.12.linux-amd64.tar.gz
echo 'export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin' >> ~/.bashrc
source ~/.bashrc

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 521)May include surrounding context.

.sh)"

Required

brew install go git

Optional (for full stack mode)

brew install tmux

text

### Linux (Debian/Ubuntu) Installation

```bash
# Required
sudo apt update
sudo apt install -y git

# Install Go (apt version may be outdated, use official installer)
wget https://go.dev/dl/go1.24.12.linux-amd64.tar.gz
sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.24.12.linux-amd64.tar.gz
echo 'export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin' >> ~/.bashrc
source ~/.bashrc

# Optional (for full stack mode)
sudo apt install -y tmux

Linux (Fedora/RHEL) Installation

bash
# Required
sudo dnf install -y git golang

# Optional
sudo dnf install -y tmux

Minimal Mode vs Full Stack Mode

Gas Town supports two operational modes:

Minimal Mode (No Daemon): Run individual runtime instances manually. Gas Town only tracks state.

bash
gt convoy create "Fix bugs" gt-abc12
gt sling gt-abc12 myproject
cd ~/gt/myproject/polecats/<worker>
claude --resume          # Or:

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 876)May include surrounding context.

gt handoff --shutdown # Terminate (polecats) gt session stop / gt peek # Check health gt nudge "message" # Send message to agent gt seance # List discoverable predecessor sessions gt seance --talk # Talk to predecessor (full context)

text

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 881)May include surrounding context.

gt seance --talk # Talk to predecessor (full context)

text

**IMPORTANT**: Always use `gt nudge` to send messages to Claude sessions. Never use raw `tmux send-keys` - it doesn't handle Claude's input correctly.

### Emergency

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 1720)May include surrounding context.

bash
# Deploy different models on similar tasks
gt sling gt-abc gastown --model=claude-sonnet
gt sling gt-def gastown --model=gpt-4

# Compare outcomes

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 1721)May include surrounding context.

bash
# Deploy different models on similar tasks
gt sling gt-abc gastown --model=claude-sonnet
gt sling gt-def gastown --model=gpt-4

# Compare outcomes
bd stats --actor=gastown/polecats/* --group-by=model

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/setup.sh (reported line 38)May include surrounding context.

sh
mkdir -p "$HOME/local"
    wget -q "$URL" -O /tmp/go.tar.gz
    tar -C "$HOME/local" -xzf /tmp/go.tar.gz
    rm /tmp/go.tar.gz
    
    export PATH="$PATH:$HOME/local/go/bin:$HOME/go/bin"
    if ! grep -q 'local/go/bin' "$HOME/.bashrc" 2>/dev/null; then

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/setup.sh (reported line 42)May include surrounding context.

sh
name -s | tr '[:upper:]' '[:lower:]')
    GO_VERSION="1.23.6"
    URL="https://go.dev/dl/go${GO_VERSION}.${OS}-${GOARCH}.tar.gz"
    
    mkdir -p "$HOME/local"
    wget -q "$URL" -O /tmp/go.tar.gz
    tar -C "$HOME/local" -xzf /tmp/go.tar.gz
    rm /tmp/go.tar.gz
    
    export PATH="$PATH:$HOME/local/go/bin:$HOME/go/bin"
    if ! grep -q 'local/go/bin' "$HOME/.bashrc" 2>/dev/null; then
        echo 'export PATH=$PATH:$HOME/local/go/bin:$HOME/go/bin' >> "$HOME/.bashrc"
    fi
    echo "✅ Go $(go version | awk '{print $3}')"
else
    export PATH="$PATH:$HOME/local/go/bin:$HOME/go/bin"
    echo "✅ Go $(go version | awk '{print $3}')"
fi

# Install gt if needed
if ! command -v gt &>/dev/null; then
    echo "📦 Installing Gas Town (gt)..."
    go install github.com/steveyegge/gastown/cmd/gt@latest 2>&1
    echo "✅ gt $(gt version 2>&1)"
else
    echo "✅ gt $(gt version 2>&1)"
fi

# Install bd if needed
if ! command -v bd &>/dev/null; then
    echo "📦 Installing Beads (bd)...

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The usage guidance is extremely broad: 'Just tell the agent what you need' followed by examples of autonomous multi-agent task execution. This can cause the skill to activate for loosely related prompts and launch orchestration behavior unexpectedly, increasing the chance of unintended code changes, unnecessary command execution, or over-delegation across repositories.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 480)May include surrounding context.

md
$ npm install -g @gastown/gt                              # npm
$ go install github.com/steveyegge/gastown/cmd/gt@latest  # From source

# If using go install, add Go binaries to PATH (add to ~/.zshrc or ~/.bashrc)
export PATH="$PATH:$HOME/go/bin"

# Create workspace with git initialization

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 483)May include surrounding context.

md
# If using go install, add Go binaries to PATH (add to ~/.zshrc or ~/.bashrc)
export PATH="$PATH:$HOME/go/bin"

# Create workspace with git initialization
gt install ~/gt --git
cd ~/gt

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 515)May include surrounding context.

bash
# Required
sudo apt update
sudo apt install -y git

# Install Go (apt version may be outdated, use official installer)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 516)May include surrounding context.

bash
# Required
sudo apt update
sudo apt install -y git

# Install Go (apt version may be outdated, use official installer)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 525)May include surrounding context.

bash
# Required
sudo apt update
sudo apt install -y git

# Install Go (apt version may be outdated, use official installer)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 532)May include surrounding context.

bash
# Required
sudo apt update
sudo apt install -y git

# Install Go (apt version may be outdated, use official installer)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 535)May include surrounding context.

bash
# Required
sudo apt update
sudo apt install -y git

# Install Go (apt version may be outdated, use official installer)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 520)May include surrounding context.

md
# Install Go (apt version may be outdated, use official installer)
wget https://go.dev/dl/go1.24.12.linux-amd64.tar.gz
sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf go1.24.12.linux-amd64.tar.gz
echo 'export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin' >> ~/.bashrc
source ~/.bashrc

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file includes commands that remove and replace system directories (sudo rm -rf /usr/local/go && sudo tar ...) and later promotes auto-repair actions like gt doctor --fix without any cautionary note. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data or system integrity, and these commands can materially alter a user's system.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 1737)May include surrounding context.

Option 2: Dispatch to Local Workers

bash
bd create --prefix beads "Fix authentication bug"
gt convoy create "Auth fix" bd-xyz
gt sling bd-xyz beads

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation explicitly instructs agents to execute queued work automatically ('If your hook has work, RUN IT') without any warning, approval gate, or scope limitation. In a multi-agent system that can dispatch tasks, manipulate git state, and coordinate merges, this increases the chance of unintended or unsafe actions being carried out autonomously if malicious, erroneous, or overly broad work lands on a hook.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
95% confidence
Finding

The phrase 'No asking' codifies autonomous decision-making without user confirmation, which is risky in a system designed to persist work across crashes and allow any worker to continue execution. Because this architecture includes automatic dispatch, monitoring, and merge-related workflows, a malicious or malformed task could propagate through the system and trigger impactful actions without a human review point.

Content

Scanner excerpt · references/architecture.md (reported line 155)May include surrounding context.

md
**Gas Town Universal Propulsion Principle:**
> If your hook has work, RUN IT.

No waiting. No asking. Work lands on hook → work runs.

Molecules (work units) survive crashes. Any worker can continue where another left off. The engine never stops as long as there's fuel.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
SKILL.md:520