Security audit

OtterKit Tunnel

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate tunneling and webhook helper, but it deserves review because it can expose local services to the internet, run persistent endpoints, and execute an unpinned npm package.

Install only if you trust OtterKit and are comfortable exposing selected local services publicly. Prefer short TTLs, avoid ttl never unless truly needed, keep OpenClaw gateway and hooks tokens enabled, avoid putting real secrets directly in command-line arguments, and use a pinned or preinstalled OtterKit version where possible.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:13
Finding: Unpinned npm Package Is Executed Through npx
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:102
Finding: Authentication and Webhook Secrets Passed in Command-Line Arguments
Content: View full analysis
# foreground, Ctrl+C to stop npx otterkit tunnel --daemon --ttl 4h # background, auto-stops after TTL (default 24h, or "never") npx otterkit tunnel --subdomain myapp # stable URL: https://myapp.otterkit.app every run npx otterkit tunnel --auth user:pass # require HTTP Basic auth (enforced locally, free) npx otterkit tunnel --log # also capture every request for inspect/replay ``` The signature-verification examples use the same pattern: ```bash npx otterkit webhook --verify stripe:whsec_abc123 npx otterkit webhook --daemon --verify github:my-webhook-secret ``` ### Technical Analysis The documentation encourages users to substitute authentication credentials and webhook-signing secrets directly into command-line arguments. Command-line secrets may be exposed through several channels: - Interactive shell history. - Process listings or process-inspection interfaces while the command runs. - Terminal capture, debugging output, or session transcripts. - Agent execution logs and command telemetry. - Error reports that retain the original command. - Administrative process-monitoring systems. The example values appear to be placeholders, and no hardcoded production credential was found. The vulnerability arises when a user replaces those placeholders with real credentials as instructed. The credentials are relevant to the declared functionality, but placing them in process arguments is not necessary if the CLI supports, or is changed to support, protected files, standard input, or appropriately scoped environment variables. ### Attack Path 1. A user replaces `user:pass`, `whsec_abc123`, or `my-webhook-secret` with a real secret. 2. The user or agent executes ...[truncated 1276 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (46)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
npx otterkit login

text
This opens the browser, the user approves the device, and a token is saved to `~/.otterkit/credentials.json`. Buy credits at https://console.otterkit.com. New accounts get a small free-credit grant to start. For headless/CI agents, set `OTTERKIT_TOKEN` (create a token at console.otterkit.com → API Tokens) instead of running `otterkit login`.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 81% confidence
Finding: The skill explicitly enables persistent public endpoints, webhook capture, replay, and daemonized tunnels, which extends attack surface over time. In context, persistence is a core feature rather than stealthy malware behavior, but it still increases security risk because exposed services may remain reachable longer than intended.
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.
md
--- name: otterkit-tunnel description: Expose a local port to the internet via OtterKit tunnel, or create a webhook endpoint to capture incoming HTTP requests. Give your OpenClaw gateway a public HTTPS URL for incoming webhooks (/hooks/wake, /hooks/agent), capture and replay webhook deliveries, and protect tunnels with HTTP Basic auth. Use when the user asks to "tunnel", "expose", "share my localhost", needs a public URL for a local service or for OpenClaw webhooks, needs a webhook endpoint to capture requests, or wants to re-test a webhook handler against a previously received payload. homepage: https://www.otterkit.com/docs metadata: {

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The description contains very broad trigger phrases such as "tunnel", "expose", and "share my localhost", which can cause the skill to be invoked in situations where the user did not intend to make a service public. Because this skill creates internet exposure for local services, accidental invocation materially increases risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The skill repeatedly instructs use of npx otterkit without pinning a specific package version. Because npx resolves and may download the latest package at execution time, a compromised upstream package, malicious update, or typosquatted dependency could cause arbitrary code execution on the host running the skill.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This invocation uses npx otterkit without a pinned version, allowing execution of whatever version the npm registry currently serves. In an agent context, that creates a supply-chain execution path outside the reviewed skill contents.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: An unpinned npx otterkit command permits execution of a mutable external package version. If the package or one of its dependencies is compromised, the agent may run attacker-controlled code with the user's privileges.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This command invokes npx otterkit without version pinning in a security-sensitive workflow that exposes network services. A supply-chain compromise here would let arbitrary code run before or alongside tunnel creation, potentially exfiltrating tokens or exposing additional services.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
bash
npx otterkit webhook --subdomain my-claw-hooks --daemon --ttl never \ --deliver-exec 'curl -s -X POST http://127.0.0.1:18789/hooks/wake \ -H "Authorization: Bearer $OPENCLAW_HOOKS_TOKEN" \ -H "Content-Type: application/json" -d @-'

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The skill references a mutable package via npx instead of a pinned build. This is a classic supply-chain risk because the command can fetch and execute code not covered by the skill review.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Running npx otterkit without version control allows unexpected or malicious upstream changes to affect execution. In a tunneling tool, that can directly impact confidentiality and system integrity.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The use of an unpinned package through npx creates a code-execution supply-chain risk. Since this skill is designed to expose local services publicly, compromise of the package would be especially damaging.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This is another occurrence of runtime execution from an unpinned npm package. Attackers who gain control of the package or dependency tree could execute arbitrary code on user systems.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Unpinned npx use means the command's behavior can change after review and may execute compromised code. Because the command can open public tunnels, the risk extends beyond local execution to network exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This finding reflects a supply-chain hazard from invoking npx otterkit without an exact version. The agent may download and execute new code from the network implicitly, which is unsafe for a reviewed security-sensitive skill.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The command uses a mutable upstream package reference through npx, enabling arbitrary code execution if the npm package lineage is compromised. This risk is material in agent tooling because the execution is automated and may handle credentials.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This invocation is vulnerable to supply-chain drift because it does not specify a fixed package version. The reviewed markdown cannot guarantee the code actually executed at runtime.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: An unversioned npx package reference allows silent execution of updated or malicious code. In this skill, that code would run in the context of tooling that receives external traffic and may access local services.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Because the package version is not fixed, this command can execute code that was never reviewed with the skill. The risk is amplified by the network-facing nature of the functionality described.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Using npx otterkit without a version pin creates an avoidable supply-chain code execution path. A malicious release could steal OtterKit or OpenClaw tokens, alter forwarding destinations, or expose additional ports.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This example executes an unpinned npm package, which is a true supply-chain vulnerability in an agent skill context. The runtime may differ materially from the reviewed documentation if the upstream package changes.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The command allows mutable package resolution at execution time, opening the door to malicious updates or dependency hijacking. Since this feature handles externally supplied webhook traffic, compromise could lead to broad system impact.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: An unpinned npx invocation is a genuine security issue because it outsources executable integrity to the current state of the npm ecosystem. That is particularly risky for a skill that may be run unattended by agents.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This is another true positive for supply-chain risk: the command can download and run whatever otterkit version is current. A compromise could subvert signature verification or forward captured traffic to attacker-controlled endpoints.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The use of an unversioned package via npx can result in arbitrary code execution from upstream changes. Because the command is involved in webhook validation and forwarding, exploitation could undermine security controls directly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This command references a mutable external package without pinning, which is unsafe in reviewed automation. A compromised package could access local logs, webhook payloads, or stored tokens.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.