Agent Deployment Checklist

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:52 AM UTC
• Version: 98.0.1

Overview

The skill is a coherent deployment checklist, but it should be reviewed because it recommends unverified remote code execution and persistent scheduled backups on client infrastructure without enough containment detail.

Before installing or using this skill, review and harden the provided scripts: avoid curl-to-bash installers, pin and verify external installers, confirm every sudo firewall change, explicitly approve cron installation, encrypt and restrict backup storage, and ensure client credentials stay scoped and out of the backed-up workspace.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:49

Finding

Unverified Remote Homebrew Installer Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 49
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

Technical Analysis

The deployment template downloads a shell script from the mutable HEAD branch of an external GitHub repository and immediately executes the response with Bash. Although the URL belongs to the official Homebrew repository, the command does not pin the installer to an immutable reviewed commit and does not validate a cryptographic checksum or signature.

Consequently, the effective code executed during deployment can differ from the code reviewed during this audit. The operator has no opportunity to inspect the downloaded response before execution. Compromise of the upstream repository, a maintainer account, the delivery infrastructure, or the trusted TLS path could turn this installation command into arbitrary local code execution.

This exceeds the minimum privilege and trust necessary to install Homebrew because safer alternatives can separate download, verification, review, and execution.

Attack Path

1. An attacker compromises the upstream repository, a sufficiently privileged maintainer account, or another trusted component in the payload delivery path.
2. The attacker modifies the script served from Homebrew/install/HEAD/install.sh.
3. An operator follows the Layer 1 deployment instructions.
4. curl retrieves the modified script without commit pinning or integrity verification.
5. Command substitution passes the response directly to /bin/bash.
6. The attacker-controlled script executes with all permissions available to the deployment operator and may request or abuse elevated access during installation.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking ac ...[truncated 475 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not pipe or interpolate network responses directly into a shell.

2. Pin the installer to a reviewed immutable release or full Git commit rather than HEAD.

3. Download the script to a protected local file first:

   bash

   curl --proto '=https' --tlsv1.2 --fail --show-error --location \
     --output /tmp/homebrew-install.sh \
     'https://raw.githubusercontent.com/Homebrew/install/REVIEWED_COMMIT/install.sh'
   

4. Verify the downloaded file against a trusted, vendor-published cryptographic checksum or signature before execution.

5. Inspect the downloaded script and execute it as a separate step only after verification.

6. Run installation with the least-privileged account possible and review every request for administrative authorization.

7. Prefer a trusted package-management or manually documented installation method when an independently verifiable installer artifact is unavailable.

8. Record the pinned version, checksum, verification result, and source URL in deployment logs to support reproducible audits.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

- [ ] `.env` file created with proper permissions (`chmod 600`)
- [ ] Client-specific service accounts created
- [ ] MCP server credentials configured
- [ ] GitHub/GitLab access tokens scoped to client repos only
- [ ] Email/calendar integrations authorized (OAuth tokens)
- [ ] QuickBooks / accounting integrations connected (if applicable)
- [ ] All credentials tested with a live API call

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 95% confidence

Finding

The install script pipes a remote script fetched via curl directly into bash, which creates a supply-chain and remote code execution risk. If the upstream source, transport, or repository is compromised, deployment hosts would execute attacker-controlled code during initial setup.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

# macOS-specific
xcode-select --install 2>/dev/null || true
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
brew update && brew upgrade

# Runtime

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

nvm use --lts

# OpenClaw workspace
mkdir -p ~/.openclaw/workspace
cd ~/.openclaw/workspace
git init

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

md

- [ ] API keys provisioned (Anthropic, OpenAI if needed)
- [ ] API keys stored in environment variables (never in files)
- [ ] `.env` file created with proper permissions (`chmod 600`)
- [ ] Client-specific service accounts created
- [ ] MCP server credentials configured
- [ ] GitHub/GitLab access tokens scoped to client repos only

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

bash

# Verify all credentials work
echo "Testing Anthropic API..."
curl -s https://api.anthropic.com/v1/messages \
  -H "x-api-key: $ANTHROPIC_API_KEY" \
  -H "content-type: application/json" \
  -d '{"model":"claude-sonnet-4-20250514","max_tokens":10,"messages":[{"role":"user","content":"ping"}]}' \

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

bash

#!/bin/bash
# layer-4-firewall.sh
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

bash

#!/bin/bash
# layer-4-firewall.sh
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

bash

#!/bin/bash
# layer-4-firewall.sh
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

bash

#!/bin/bash
# layer-4-firewall.sh
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

md

#!/bin/bash
# layer-4-firewall.sh
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setblockall on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on
echo "Firewall configured. Verify: sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate"

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

md

## Boundaries
- Never share client data outside this environment
- Never execute financial transactions without explicit approval
- Never modify production systems without confirmation
- Escalate to human when uncertain

## Communication Style

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Backing up crontab definitions can unintentionally preserve persistence mechanisms, embedded secrets, internal paths, or operational schedules in backup storage. If backups are less protected than the live host, an attacker gaining backup access learns how tasks are executed and may recover sensitive command material.

Content

Scanner excerpt · SKILL.md (reported line 356)May include surrounding context.

md

"$HOME/.openclaw/workspace/" "$BACKUP_DIR/workspace/"

# Back up cron definitions
crontab -l > "$BACKUP_DIR/crontab.bak"

# Keep last 30 days of backups
find /backups/openclaw -maxdepth 1 -type d -mtime +30 -exec rm -rf {} \;

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

At L073 the checklist states Layer 2 is always manual and never scripted because each client's access pattern differs. However, L090-L101 contains a bash snippet that scripts credential testing against Anthropic and GitHub, which directly contradicts the absolute 'never scripted' statement rather than merely adding detail.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.