aleph-cloud-self-deployment

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:09 PM UTC
• Version: 1.0.2004

Overview

This skill is openly for autonomous cloud self-cloning, but its examples give spawned VMs broad paid-account credentials and use unsafe setup and secret-handling patterns.

Review before installing. Use only in an isolated test account or VM, set hard spending and instance limits outside the agent, require human approval for provisioning, use delegated per-child Aleph keys instead of copying the parent key, verify SSH host keys, pin and verify dependencies, and avoid placing API keys or wallet keys in command-line arguments or logs.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:261

Finding

Remote setup script is downloaded and executed directly as root

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:24

Finding

Unpinned dependencies are installed with system-wide root privileges

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:252

Finding

SSH host authenticity verification is disabled for privileged connections and file transfers

Content

View full analysis

-p -i ~/.ssh/aleph_agent ``` ```bash HOST="" PORT="" KEY="$HOME/.ssh/aleph_agent" SCP="scp -i $KEY -P $PORT -o StrictHostKeyChecking=no" ``` ```bash # Skills directory (recursive) scp -r -i $KEY -P $PORT -o StrictHostKeyChecking=no /root/openclaw/skills/ root@$HOST:/root/openclaw/skills/ ``` ### Technical Analysis `StrictHostKeyChecking=no` instructs SSH and SCP to accept an unverified server host key. This removes the mechanism that authenticates the destination VM before a root session is established or sensitive files are copied. Initial connection automation may require provisioning a new host key, but completely disabling verification is broader than necessary. The Skill transfers identity files, memory, Skills, and potentially deployment-related material through these connections. ### Attack Path 1. An attacker gains a network interception position or causes the operator to use a substituted host address or mapped port. 2. The attacker presents an arbitrary SSH host key. 3. Because strict verification is disabled, the client accepts the impersonating server. 4. Identity, memory, and Skill files are copied to the attacker-controlled endpoint. 5. The attacker may return modified content, deceive the operator into transferring additional credentials, or interfere with deployment. ### Impact Assessment The immediate scope includes disclosure of copied OpenClaw identity, memory, and Skill content and loss of destination integrity. If the same unverified channel is used for later private-key or credential operations, the compromise can expand to control of the agent and funded cloud account. The SSH client key itself is not normally disclosed by the SSH protocol, but server ...[truncated 71 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:412

Finding

Parent account private key is duplicated to autonomous child agents

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:463

Finding

API and gateway secrets may be exposed through process arguments and deployment logs

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

If Interactive TUI Still Appears

Some versions of aleph-client may still show prompts. Use pexpect:

python

#!/usr/bin/env python3

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The document explicitly says never to log or echo private keys, but later activates an account by passing the private key inline on the command line via --private-key $(cat ...). Command-line arguments can be exposed through shell history, process listings, audit logs, or orchestration telemetry, making wallet compromise much more likely.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill instructs importing or creating a long-lived private key for automated instance control and later reuses that credential to enable recursive self-deployment. Persisting such wallet keys on disk across autonomous child instances expands the blast radius of any host compromise and creates durable access to billing and provisioning functions.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

Step 1: Account Setup

Import or Create a Private Key

bash

# Import existing private key

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

aleph account create --chain BASE --active

text

Keys are stored at `~/.aleph-im/private-keys/`. Always `chmod 600` key files.

### Check Balance

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

aleph account create --chain BASE --active

text

Keys are stored at `~/.aleph-im/private-keys/`. Always `chmod 600` key files.

### Check Balance

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.

aleph account create --chain BASE --active

text

Keys are stored at `~/.aleph-im/private-keys/`. Always `chmod 600` key files.

### Check Balance

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 342)May include surrounding context.

aleph account create --chain BASE --active

text

Keys are stored at `~/.aleph-im/private-keys/`. Always `chmod 600` key files.

### Check Balance

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 417)May include surrounding context.

aleph account create --chain BASE --active

text

Keys are stored at `~/.aleph-im/private-keys/`. Always `chmod 600` key files.

### Check Balance

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 341)May include surrounding context.

EOF

Harden permissions

chmod 700 /root/.openclaw chmod 600 /root/.openclaw/openclaw.json

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 417)May include surrounding context.

EOF

Harden permissions

chmod 700 /root/.openclaw chmod 600 /root/.openclaw/openclaw.json

text

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 431)May include surrounding context.

md

echo -n "aleph-client: "; aleph --version
echo -n "Balance: "; aleph account balance 2>&1 | head -3
echo -n "SSH key: "; ls ~/.ssh/aleph_agent.pub 2>/dev/null && echo "OK" || echo "MISSING — generate with: ssh-keygen -t ed25519 -f ~/.ssh/aleph_agent -N ''"
echo -n "This skill: "; ls ~/openclaw/skills/aleph-vm-deployment/SKILL.md 2>/dev/null && echo "OK" || echo "MISSING"
echo -n "OpenClaw: "; openclaw --version
echo "=== Ready to deploy ==="
REMOTE

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 599)May include surrounding context.

md

}
CONF

chmod 700 /root/.openclaw
chmod 600 /root/.openclaw/openclaw.json

echo "=== Starting gateway ==="

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 600)May include surrounding context.

md

CONF

chmod 700 /root/.openclaw
chmod 600 /root/.openclaw/openclaw.json

echo "=== Starting gateway ==="
openclaw gateway install --force

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 618)May include surrounding context.

md

CONF

chmod 700 /root/.openclaw
chmod 600 /root/.openclaw/openclaw.json

echo "=== Starting gateway ==="
openclaw gateway install --force

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 619)May include surrounding context.

md

CONF

chmod 700 /root/.openclaw
chmod 600 /root/.openclaw/openclaw.json

echo "=== Starting gateway ==="
openclaw gateway install --force

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill's security guidance says API keys should not be stored in config files, yet the instructions create auth-profiles.json containing the Anthropic token. This contradiction encourages persistent plaintext secret storage on disk, increasing the chance of credential theft through file disclosure, backup leakage, or compromise of the spawned VM.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 654)May include surrounding context.

sleep 3 openclaw gateway status --token "$GATEWAY_TOKEN"

text

The systemd service file caches the token — `install --force` re-syncs it.

### Interactive TUI Blocks Automation
Use `--crn-hash <HASH>` + `--skip-volume` + `--crn-auto-tac`. If still interactive, use the pexpect script from Step 4.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Piping a remote script directly into bash executes third-party code without verification. If the upstream endpoint, network path, or DNS is compromised, the VM will run attacker-controlled code as root during bootstrap.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

bash

# Install Node.js 22
curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs git

# Install OpenClaw

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The markdown provides a direct aleph instance delete <INSTANCE_HASH> command to remove a VM instance, which is a destructive operation that can affect deployed workloads and associated data. Although the document has general security notes elsewhere, this specific deletion step does not include a local warning about irreversibility or verifying the target instance first.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The setup script repeats the unsafe curl | bash pattern in an automation path intended for fresh VMs. Because this runs unattended and typically as root, compromise of the fetched script could fully subvert every deployed child instance.

Content

Scanner excerpt · SKILL.md (reported line 553)May include surrounding context.

md

ANTHROPIC_KEY="${1:-}"

echo "=== Installing Node.js 22 ==="
curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
DEBIAN_FRONTEND=noninteractive apt-get install -y nodejs git python3-pip

echo "=== Installing OpenClaw ==="