Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed HTTP gateway for remote agent control, but its default cleartext network exposure and self-healing global configuration changes make it something users should review carefully before installing.
Install only on a host and network you trust. Before starting it, bind to 127.0.0.1 or put it behind HTTPS/reverse-proxy TLS, restrict exposed skills and allowed agents, protect the API key like a password, and disable the watchdog if you need configuration changes to stay reverted. Expect API-key holders to be able to trigger broad agent actions and read returned transcripts.
This skill starts a persistent proxy that **exposes your OpenClaw agent as a remotely callable HTTP endpoint**. The agent has file, shell, and messaging capabilities on the host, so this is a **remote control surface** — treat it as exposing an internal service, not a zero-risk wrapper: - **`/agent/run` is an open-ended entry point.** Any authenticated caller can send **arbitrary prompts** to the agent, which then decides which Skills to run — including side-effecting ones (send messages, modify data). Keep the port reachable only by trusted callers. - **HTTP is the default and is unencrypted.** By default the `X-API-Key`, prompts, and results travel in **cleartext**. Acceptable only on `localhost` / a trusted network; enable HTTPS when binding `0.0.0.0` or calling cross-host, and never use `curl -k` (skip cert verification) in production. - **It modifies global config.** init / watchdog write and self-heal the hooks config in `~/.openclaw/openclaw.json` (and optionally sync to external sources via `OPENCLAW_CONFIG_SYNC_PATHS`). This is a platform-level change; the watchdog may re-apply it after a manual revert — be aware of this persistence behavior. - **Protect the API Key.** It is a bearer credential — leaking it grants agent-invocation rights. Keep it out of shell history, logs, screenshots, and world-readable files.
CERT=<workspace>/.http/certs/server.crt
# 跑指定 skill
curl --cacert $CERT -H "X-API-Key: $API_KEY" \
-H "Content-Type: application/json" \
-d '{"message":"运行 hello-env"}' \
https://192.168.1.10:7720/skills/hello-env/runHEADERS = {"X-API-Key": API_KEY}
# 触发
resp = requests.post(
f"{BASE}/agent/run",
headers=HEADERS,
json={"message": "帮我生成本周工作总结"},BASE=http://<your-server-ip>:7720 # 健康检查（无需鉴权） curl $BASE/health # 列出可用 skill curl -H "X-API-Key: $API_KEY" $BASE/skills
banner("Step 4/5: TLS / HTTPS")
print("HTTPS 提供传输层加密，但需要生成自签证书 + 客户端导入，有一定门槛。")
print("说明：")
print(" - 不开 HTTPS → 调用方直接 curl 即可，零门槛（推荐先跑通再加 TLS）")
print(" - 开 HTTPS → 调用方需要 --cacert 指定证书（或导入系统信任库）")
if config.get("listen_host") == "0.0.0.0":
print(" ⚠️ 当前监听 0.0.0.0（局域网可达），如有跨机器调用强烈建议开 TLS")- **`/agent/run` is an open-ended entry point.** Any authenticated caller can send **arbitrary prompts** to the agent, which then decides which Skills to run — including side-effecting ones (send messages, modify data). Keep the port reachable only by trusted callers. - **HTTP is the default and is unencrypted.** By default the `X-API-Key`, prompts, and results travel in **cleartext**. Acceptable only on `localhost` / a trusted network; enable HTTPS when binding `0.0.0.0` or calling cross-host, and never use `curl -k` (skip cert verification) in production. - **It modifies global config.** init / watchdog write and self-heal the hooks config in `~/.openclaw/openclaw.json` (and optionally sync to external sources via `OPENCLAW_CONFIG_SYNC_PATHS`). This is a platform-level change; the watchdog may re-apply it after a manual revert — be aware of this persistence behavior. - **Protect the API Key.** It is a bearer credential — leaking it grants agent-invocation rights. Keep it out of shell history, logs, screenshots, and world-readable files. ## Features
- **`/agent/run` is an open-ended entry point.** Any authenticated caller can send **arbitrary prompts** to the agent, which then decides which Skills to run — including side-effecting ones (send messages, modify data). Keep the port reachable only by trusted callers. - **HTTP is the default and is unencrypted.** By default the `X-API-Key`, prompts, and results travel in **cleartext**. Acceptable only on `localhost` / a trusted network; enable HTTPS when binding `0.0.0.0` or calling cross-host, and never use `curl -k` (skip cert verification) in production. - **It modifies global config.** init / watchdog write and self-heal the hooks config in `~/.openclaw/openclaw.json` (and optionally sync to external sources via `OPENCLAW_CONFIG_SYNC_PATHS`). This is a platform-level change; the watchdog may re-apply it after a manual revert — be aware of this persistence behavior. - **Protect the API Key.** It is a bearer credential — leaking it grants agent-invocation rights. Keep it out of shell history, logs, screenshots, and world-readable files. ## Features
## 8. 常见问题 ### Q1：客户端报「证书不受信任」 A：把 `~/.http/certs/server.crt` 加到客户端 CA 信任链，或临时用 `curl -k` 跳过校验（仅调试）。 ### Q2：服务起不来，提示「api_key 不能为空」或「hook_url 无法解析」 A：跑一遍向导：`python3 scripts/server.py init`（会启用 OpenClaw hooks + 生成 API Key）。
print(f"证书路径：{CERT_PATH}")
print()
print("【curl】")
print(f" curl --cacert {CERT_PATH} https://your-host:port/health")
print(" # 或临时跳过验证：curl -k https://...")
print()
print("【Python requests】")Detected: suspicious.exposed_secret_literal