Aapanel 5h3ll

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:40 AM UTC
• Version: 1.0.7

Overview

This skill is not clearly malicious, but it needs review because it exposes broad aaPanel administration with weak guardrails around destructive actions and API tokens.

Install only if you intentionally want OpenClaw to have broad aaPanel administrative control. Use a dedicated least-privilege aaPanel token if possible, keep the config file owner-only, avoid bt-config show in logged environments, avoid passing real tokens or passwords on the command line, keep TLS verification enabled, and manually confirm destructive operations such as delete, chmod -R, database/user changes, SSL revoke, firewall changes, downloads, and unzip destinations before running them.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: bt_common/config.py:151

Finding

API Tokens Stored Without Enforced Restrictive File Permissions

Content

View full analysis

Vulnerability Details

File Location: bt_common/config.py:151-162, bt_common/config.py:421-424
Vulnerability Type: Insecure storage of privileged API credentials
Risk Level: High

Technical Analysis

The global configuration file contains aaPanel API tokens but is created and rewritten without explicitly enforcing owner-only permissions.

python

if not GLOBAL_CONFIG_FILE.exists():
    GLOBAL_CONFIG_FILE.write_text(default_config, encoding="utf-8")

return GLOBAL_CONFIG_FILE

Server additions subsequently rewrite the credential-bearing YAML file using the process's current umask:

python

# Save config
path = Path(config_path)
with open(path, "w", encoding="utf-8") as f:
    yaml.dump(
        config,
        f,
        default_flow_style=False,
        allow_unicode=True,
        sort_keys=False,
    )

return True

The resulting permissions therefore depend on the runtime environment. Under a permissive umask or when a user-selected configuration path is used, the file may be readable by other local accounts. The implementation also does not verify that the file is owned by the current user before loading or rewriting it.

Attack Path

1. A user adds an aaPanel server, causing its API token to be written to the YAML configuration.
2. The configuration is created under a permissive umask, inherited permissions, or an inadequately protected custom path.
3. Another local user or compromised process reads the file.
4. The attacker extracts the aaPanel host and API token.
5. The attacker uses the token to invoke the same privileged panel APIs exposed by the skill.

Impact Assessment

Exposure of the API token can grant access to all capabilities allowed by that aaPanel API credential. In this project, those capabilities include arbitrary remote file reads and writes, file deletion, recursive permission changes, site and certificate management, database and FT ...[truncated 143 chars]

Remediation

View remediation

Remediation Suggestions

• Create the configuration atomically with mode 0600, such as by using os.open with O_CREAT | O_EXCL and an explicit mode.
• Apply chmod(0o600) after every rewrite and ensure ~/.openclaw is mode 0700.
• Write updates to a protected temporary file in the same directory and atomically replace the destination.
• Reject configuration files not owned by the current user or writable by group/others.
• Warn and refuse to proceed when existing permissions are broader than 0600.
• Prefer an operating-system credential store or dedicated secret manager over plaintext YAML.
• Limit the aaPanel token to the minimum API permissions and source IPs required.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/bt-config.py:262

Finding

Configuration Display Command Reveals API Tokens in Plaintext

Content

View full analysis

Vulnerability Details

File Location: scripts/bt-config.py:262-281
Vulnerability Type: Plaintext credential disclosure through command output
Risk Level: High

Technical Analysis

The show command loads and serializes the complete configuration without redacting the token field:

python

def cmd_show(args):
    """Show full config"""
    try:
        config_path = find_config_file()
        if not config_path:
            print("Config file not found")
            print("Run 'bt-config init' to create config file")
            return 1

        config = load_config(config_path)

        if args.format == "json":
            print(json.dumps(config, ensure_ascii=False, indent=2))
        else:
            import yaml
            print(
                yaml.dump(
                    config,
                    default_flow_style=False,
                    allow_unicode=True,
                    sort_keys=False,
                )
            )

        return 0

Because server configuration objects contain plaintext API tokens, this output can disclose credentials through terminal scrollback, shell-session recording, CI logs, agent transcripts, or redirected output. This is particularly sensitive in an AI skill context, where a model may invoke the command for troubleshooting and copy its output into a broader conversation or log.

Attack Path

1. A server and token are present in the active configuration.
2. A user, automation process, or AI agent invokes bt-config.py show.
3. The complete token is printed to standard output.
4. Terminal capture, build logging, transcript retention, or another observer records the output.
5. An attacker retrieves the token and authenticates to the configured aaPanel server.

Impact Assessment

A disclosed token can provide remote administrative access within the token's aaPanel authorization scope. Potential conseque ...[truncated 180 chars]

Remediation

View remediation

Remediation Suggestions

• Redact tokens by default, for example by displaying only a short suffix.
• Add an explicit reveal option only if operationally necessary, accompanied by an interactive warning and confirmation.
• Send any intentional secret reveal directly to a secure terminal rather than normal stdout.
• Avoid exposing secret-bearing output to AI context, CI logs, telemetry, or support bundles.
• Add automated tests verifying that JSON and YAML display modes never contain complete tokens.
• Document token rotation procedures in case output has already been captured.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/bt-config.py:342

Finding

Panel Tokens and Account Passwords Accepted as Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/bt-config.py:342-350, scripts/databases.py:223-233, scripts/ftp.py:174-184
Vulnerability Type: Secret exposure through process arguments and shell history
Risk Level: Medium

Technical Analysis

Privileged secrets are accepted directly through command-line options:

python

add_parser = subparsers.add_parser("add", help="Add server configuration")
add_parser.add_argument("--name", "-n", required=True, help="Server name")
add_parser.add_argument(
    "--host",
    "-H",
    required=True,
    help="Panel address (e.g., https://panel.example.com:8888)",
)
add_parser.add_argument(
    "--token",
    "-t",
    required=True,
    help="API Token",
)

Database commands similarly accept passwords in argv:

python

create_parser.add_argument(
    "--password",
    required=True,
    help="Database user password",
)

create_user_parser.add_argument(
    "--password",
    required=True,
    help="Password",
)

FTP creation and password-change commands follow the same pattern:

python

create_parser.add_argument(
    "--password",
    required=True,
    help="FTP password",
)

pass_parser.add_argument(
    "--password",
    required=True,
    help="New password",
)

Command-line arguments may be retained in shell history and can be visible to process-monitoring systems or other local users, depending on operating-system configuration. The documentation actively demonstrates commands containing literal secrets, making accidental exposure more likely.

Attack Path

1. A user follows the documented examples and enters a token or password directly on the command line.
2. The shell records the command in history, or a process monitor captures the argument vector.
3. A local attacker, support bundle, telemetry agent, or later compromised process obtains the recorded command.
4. The at ...[truncated 451 chars]

Remediation

View remediation

Remediation Suggestions

• Use getpass.getpass() for interactive secret entry.
• Support reading secrets from protected files, stdin, dedicated file descriptors, or an operating-system secret store.
• If environment-variable support is added, clearly warn that some execution and diagnostic environments may expose environment values.
• Remove literal passwords and tokens from documentation examples.
• Allow password generation by the tool and display the result only once through a secure channel.
• Ensure error messages never include request parameters containing passwords.
• Recommend clearing affected shell histories and rotating credentials previously supplied through argv.

T09 · Insecure Skill Coding Practices

Error

• Location: bt_common/bt_client.py:88

Finding

Administrative API Traffic Can Use Plaintext HTTP or Disabled TLS Verification

Content

View full analysis

Vulnerability Details

File Location: bt_common/config.py:282-318, bt_common/bt_client.py:88-127
Vulnerability Type: Insufficient transport security for privileged operations
Risk Level: High

Technical Analysis

Host normalization preserves explicitly supplied plaintext HTTP URLs:

python

def normalize_host(host: str) -> str:
    host = host.strip()

    # If no scheme, add https://
    if not host.startswith(("http://", "https://")):
        host = "https://" + host

    parsed = urlparse(host)

    # Remove path part, keep only scheme://netloc
    normalized = f"{parsed.scheme}://{parsed.netloc}"

    return normalized

The client mounts an HTTP adapter and allows certificate validation to be disabled:

python

self._session = requests.Session()

retry = Retry(
    total=3,
    backoff_factor=0.5,
    status_forcelist=[500, 502, 503, 504],
)
adapter = HTTPAdapter(max_retries=retry)
self._session.mount("https://", adapter)
self._session.mount("http://", adapter)

self._session.headers.update(
    {"Content-Type": "application/x-www-form-urlencoded"}
)

self._session.verify = self.verify_ssl

All requests include a time-derived authentication signature and may contain highly sensitive parameters:

python

signed_params = sign_request(self.token, params)
url = f"{self.host}{endpoint}"

response = self._session.post(
    url,
    data=urlencode(signed_params),
    timeout=self.timeout / 1000,
)

Plaintext HTTP provides no confidentiality or integrity. Disabling certificate validation on HTTPS allows a man-in-the-middle attacker to impersonate the panel. Sensitive database and FTP passwords, file contents, authentication signatures, and requested operations can consequently be observed or modified in transit.

Attack Path

1. The panel is configured with an http:// URL, or HTTPS is used with verify_ssl set to false.
2. An att ...[truncated 895 chars]

Remediation

View remediation

Remediation Suggestions

• Reject all non-HTTPS panel URLs during validation.
• Remove or disable the verify_ssl=False mode in production.
• Support self-signed deployments through a user-provided CA bundle or certificate/public-key pinning.
• Emit a fatal error rather than silently proceeding over an unverified connection.
• Never retry sensitive non-idempotent requests unless the operation is demonstrably safe to repeat.
• Add tests proving that HTTP URLs and unverified TLS configurations are rejected.
• Rotate panel tokens and service passwords if they were previously transmitted through insecure transport.

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/download.py:84

Finding

Unrestricted Server-Side Download Supports SSRF and Unsafe File Placement

Content

View full analysis

Vulnerability Details

File Location: scripts/download.py:84-113
Vulnerability Type: Server-side request forgery and unrestricted destination selection
Risk Level: High

Technical Analysis

The downloader accepts an arbitrary URL, destination path, and filename and forwards them directly to the aaPanel server:

python

def cmd_download(args):
    """Download file"""
    client = get_client(args.server)

    # Auto-extract file name (if not specified)
    filename = args.filename
    if not filename:
        from urllib.parse import urlparse
        parsed = urlparse(args.url)

        path_parts = parsed.path.rstrip('/').split('/')
        filename = (
            path_parts[-1]
            if path_parts and path_parts[-1]
            else 'downloaded_file'
        )

    print(f"\n📥 Starting download...")
    print(f"   URL: {args.url}")
    print(f"   Target path: {args.path}")
    print(f"   File name: {filename}")
    print()

    endpoint = "/files?action=DownloadFile"
    params = {
        "url": args.url,
        "path": args.path,
        "filename": filename,
    }

    try:
        result = client.request(endpoint, params)

There is no URL scheme allowlist, DNS/IP validation, redirect validation, metadata-address blocking, destination-root restriction, or filename sanitization. Because the fetch is performed by aaPanel, the request originates from the managed server's network context rather than from the local skill process.

If untrusted input reaches this command, an attacker can direct aaPanel toward loopback, private, link-local, or cloud metadata endpoints. The response is stored on the server and may then be recovered through the skill's arbitrary file-read capability. Arbitrary destination control also increases the risk of placing attacker-controlled data in sensitive web or configuration locations, subject to aaPanel's server-side checks and per ...[truncated 1091 chars]

Remediation

View remediation

Remediation Suggestions

• Permit only https URLs and reject URLs containing embedded credentials.
• Resolve hostnames before requesting and reject loopback, private, link-local, multicast, reserved, and cloud metadata address ranges.
• Revalidate every redirect target and resolved address to prevent DNS rebinding and redirect-based bypasses.
• Restrict download destinations to explicitly approved roots.
• Normalize paths and reject traversal, symlink escapes, absolute filename components, and path separators in filenames.
• Use a generated temporary filename and require a separate validated move operation.
• Enforce size, content-type, timeout, and checksum constraints.
• Require explicit user confirmation for downloads into web roots or configuration directories.
• Apply equivalent protections in aaPanel itself because server-side enforcement is the final trust boundary.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (81)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 87% confidence

Finding

A generic file deletion command exposed through an agent skill is susceptible to parameter abuse because a user or upstream prompt could direct deletion of arbitrary sensitive paths. Even if deletion goes to a recycle bin, broad path-based destructive operations on remote servers can still disrupt services, remove critical configs, or facilitate sabotage.

Content

Scanner excerpt · README.md (reported line 252)May include surrounding context.

md

| `python3 scripts/files.py edit /path/to/file "content"` | Edit / overwrite file |
| `python3 scripts/files.py mkdir /www/newdir` | Create directory |
| `python3 scripts/files.py touch /www/test.txt` | Create empty file |
| `python3 scripts/files.py rm /www/old.txt` | Delete file (to recycle bin) |
| `python3 scripts/files.py chmod 755 /www/file.txt` | Change permissions |
| `python3 scripts/files.py chmod 755 /www/dir -R` | Recursive chmod |
| `python3 scripts/files.py stat /www/file.txt` | View file permissions |

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Remote archive extraction, especially with password handling and permission changes, can unpack untrusted content onto servers and alter filesystem state at scale. Combined with download functionality, this increases the risk of staging or deploying malicious files through the panel.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Remote archive extraction, especially with password handling and permission changes, can unpack untrusted content onto servers and alter filesystem state at scale. Combined with download functionality, this increases the risk of staging or deploying malicious files through the panel.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Remote archive extraction, especially with password handling and permission changes, can unpack untrusted content onto servers and alter filesystem state at scale. Combined with download functionality, this increases the risk of staging or deploying malicious files through the panel.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Remote archive extraction, especially with password handling and permission changes, can unpack untrusted content onto servers and alter filesystem state at scale. Combined with download functionality, this increases the risk of staging or deploying malicious files through the panel.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Remote archive extraction, especially with password handling and permission changes, can unpack untrusted content onto servers and alter filesystem state at scale. Combined with download functionality, this increases the risk of staging or deploying malicious files through the panel.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Remote archive extraction, especially with password handling and permission changes, can unpack untrusted content onto servers and alter filesystem state at scale. Combined with download functionality, this increases the risk of staging or deploying malicious files through the panel.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Remote archive extraction, especially with password handling and permission changes, can unpack untrusted content onto servers and alter filesystem state at scale. Combined with download functionality, this increases the risk of staging or deploying malicious files through the panel.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Remote archive extraction, especially with password handling and permission changes, can unpack untrusted content onto servers and alter filesystem state at scale. Combined with download functionality, this increases the risk of staging or deploying malicious files through the panel.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

Remote archive extraction, especially with password handling and permission changes, can unpack untrusted content onto servers and alter filesystem state at scale. Combined with download functionality, this increases the risk of staging or deploying malicious files through the panel.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Remote archive extraction, especially with password handling and permission changes, can unpack untrusted content onto servers and alter filesystem state at scale. Combined with download functionality, this increases the risk of staging or deploying malicious files through the panel.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Remote archive extraction, especially with password handling and permission changes, can unpack untrusted content onto servers and alter filesystem state at scale. Combined with download functionality, this increases the risk of staging or deploying malicious files through the panel.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Remote archive extraction, especially with password handling and permission changes, can unpack untrusted content onto servers and alter filesystem state at scale. Combined with download functionality, this increases the risk of staging or deploying malicious files through the panel.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Remote archive extraction, especially with password handling and permission changes, can unpack untrusted content onto servers and alter filesystem state at scale. Combined with download functionality, this increases the risk of staging or deploying malicious files through the panel.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 91% confidence

Finding

The skill exposes destructive file-operation parameters such as arbitrary paths for rm, edit, chmod, and related commands without any stated path restrictions, validation, or safety interlocks. In a remote server-management context, parameter abuse could delete critical files, alter configs, or damage hosted applications with a single invocation.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

python3 scripts/files.py edit /www/config.php "new content"  # Edit file
python3 scripts/files.py mkdir /www/newdir         # Create directory
python3 scripts/files.py touch /www/test.txt       # Create file
python3 scripts/files.py rm /www/old.txt           # Delete file
python3 scripts/files.py chmod 755 /www/file.txt   # Change permissions
python3 scripts/files.py stat /www/file.txt        # View permissions

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Firewall rule management is broader than the stated purpose and can directly weaken network defenses or cut off legitimate access. In a server-administration context, hidden firewall control is especially risky because a single mistaken or malicious change can expose services or cause denial of service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The client exposes broad administrative actions far beyond the declared monitoring, logs, cron, and file-management scope, including site lifecycle changes, SSL issuance/revocation, FTP account management, and firewall modification. This scope mismatch is dangerous because users or higher-level agents may grant trust based on the manifest while the code can perform materially more destructive server administration operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The code can create and delete sites and issue, renew, or revoke SSL certificates even though the skill is presented as focused on monitoring and file management. These actions can alter service availability, domain routing, and transport security, making the mismatch materially unsafe because operators may not anticipate that granting access enables deployment-affecting changes.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

FTP account creation, deletion, and password reset provide direct credential and access-path management to server content, which is outside the stated purpose. In practice, these methods could be abused to create unauthorized access, remove legitimate accounts, or rotate credentials to deny service, all without users expecting identity-management functionality in a monitoring skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Firewall modification is a high-risk privileged capability that can block access, expose services, or alter host network security posture, yet it is not justified by the stated monitoring/log/file-management purpose. In this skill context, hidden network-control functionality is especially dangerous because it can be used to lock out administrators or silently weaken protections under the guise of benign observability tooling.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/bt-config.py (reported line 348)May include surrounding context.

python

add_parser.add_argument("--token", "-t", required=True, help="API Token")
    add_parser.add_argument("--timeout", type=int, default=10000, help="Timeout (milliseconds), default 10000")
    add_parser.add_argument("--disabled", action="store_true", help="Disable this server")
    add_parser.add_argument("--force", "-f", action="store_true", help="Force overwrite existing config")
    add_parser.add_argument("--verify-ssl", type=lambda x: x.lower() in ("true", "1", "yes"), default=None, help="Whether to verify SSL certificate (true/false), default true")

    # remove command

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script exposes database administration actions such as create, delete, user creation, and privilege management, which materially exceed the declared skill scope of monitoring, log reading, and file management. In an agent setting, this scope expansion is dangerous because it grants powerful state-changing capabilities that a user or orchestrator may not expect, increasing the chance of unauthorized or accidental destructive actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The user-creation and privilege-grant paths default to rights='ALL', which gives unrestricted database privileges unless the caller overrides it. In a skill whose stated purpose is not database administration, this default greatly increases blast radius: a mistaken or abused invocation can create overprivileged accounts and enable data theft, tampering, or persistence.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/logs.py (reported line 351)May include surrounding context.

python

help="Output format")
    parser.add_argument("--output", "-o", help="Output file path")
    parser.add_argument("--config", "-c", help="Config file path")
    parser.add_argument("--no-check", action="store_true",
                        help="Skip service installation status check")

    args = parser.parse_args()

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script implements active administrative actions such as site creation, site deletion, and domain modification, which exceeds the declared skill scope of monitoring and file management. In an agent-skill context, this is dangerous because users or orchestrators may grant the skill access expecting read-oriented operations, but the code can perform irreversible control-plane changes on production web hosting resources.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.