ClawHub
Back to skill

Security audit

IoT Platform Connection

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent OpenClaw MCP setup guide, but it describes exposing an IoT and agent-control MCP gateway remotely, including publicly, without enough safety scoping for that level of access.

Install only if you understand and trust the OpenClaw gateway you are connecting to. Prefer loopback-only access, avoid public funnel mode unless you have strong authentication and network controls, and disable or separately protect powerful tools such as device commands, channel sending, and agent task execution when remote access is enabled.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Agent Config Directory Access

High
Category
Agent Snooping
Content
### 2. Configure MCP Client Connection

Add the OpenClaw MCP server to your Claude Code settings (`~/.claude/settings.json` or project `.claude/settings.json`):

```json
{
Confidence
90% confidence
Finding
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly documents remote exposure modes, including Tailscale tailnet access and a public "funnel" mode for an MCP endpoint that can list devices, read sensors, send channel messages, and run agent tasks, but it does not prominently warn users about the security implications of exposing IoT control surfaces outside localhost. In this context, the omission is dangerous because users may enable remote or public access without understanding that they are exposing device control, sensor data, and potentially agent-execution capabilities to a broader network or the internet.

Static analysis

No suspicious patterns detected.