Tailscale Network Orchestrator

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:20 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward Tailscale status and device-listing helper that uses the local Tailscale CLI with fixed commands.

Install only on a machine where you are comfortable letting ClawBot query the existing Tailscale CLI session, because outputs may include tailnet hostnames, Tailscale IPs, and online status. The reviewed artifacts do not show hidden persistence, credential collection, remote code loading, or destructive network actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Session Persistence

Medium

• Category: Rogue Agent

Content

## Installation

1.  **Create Skill Directory:** Create a new folder named `tailscale-orchestrator` in your ClawBot skills directory (e.g., `~/.openclaw/skills/` or `<project>/skills/`).
2.  **Download Files:** Place the `SKILL.md`, `main.py`, `requirements.txt`, and `README.md` files into this new directory.
3.  **No Python Dependencies:** This skill uses only standard Python libraries and the `tailscale` CLI, so no `pip install` is required for Python dependencies.

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        # Prepend 'tailscale' to the command arguments
        full_command = ["tailscale"] + command_args
        result = subprocess.run(full_command, capture_output=True, text=True, check=True)
        return result.stdout.strip()
    except FileNotFoundError:
        print("Error: Tailscale CLI not found. Please ensure Tailscale is installed and in your system PATH.", file=sys.stderr)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Excessive Permissions

Low

• Category: Privilege Escalation

Content

## Security Considerations

*   **Local CLI Dependency:** This skill executes local `tailscale` CLI commands. Ensure your ClawBot environment is secure and that you trust the `tailscale` CLI installation.
*   **Permissions:** The user running ClawBot must have appropriate permissions to execute `tailscale` commands.

## Contributing

• Confidence: 80% confidence
• Finding: Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Static analysis

No suspicious patterns detected.