Hydra Evolver

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:49 AM UTC
• Version: 1.0.0

Overview

The skill is mostly an infrastructure bootstrap and discovery tool, but it gives broad system and network-changing authority with weak scoping and unsafe install practices.

Review this skill before installing on any real host. Only run the provisioning script on machines you control, after inspecting the remote installers, pinning package versions, and deciding whether Docker group access and Tailscale are acceptable. Treat mesh_scan as LAN probing and restrict it to approved targets.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/provision.sh:18
• Finding: Mutable Remote Installation Scripts Are Executed Directly by a Shell## Vulnerability Details **File Location**: `scripts/provision.sh`, lines 18-42 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash # 2. Docker if ! command -v docker >/dev/null 2>&1; then log "Installing Docker..." curl -fsSL https://get.docker.com | sh usermod -aG docker $SUDO_USER else log "Docker already installed." fi # 3. Node/NPM (via Volta for stability) if ! command -v node >/dev/null 2>&1; then log "Installing Node.js via Volta..." curl https://get.volta.sh | bash export VOLTA_HOME="$HOME/.volta" export PATH="$VOLTA_HOME/bin:$PATH" volta install node@22 else log "Node.js already installed." fi # 4. Tailscale if ! command -v tailscale >/dev/null 2>&1; then log "Installing Tailscale..." curl -fsSL https://tailscale.com/install.sh | sh else log "Tailscale already installed." fi ``` ### Technical Analysis The provisioning script downloads executable content from three mutable external URLs and sends it directly to `sh` or `bash`. No version pinning, cryptographic checksum, signature validation, or opportunity for local inspection is provided. The effective code executed by the Skill can therefore change after the audited package has been published. HTTPS protects transport under ordinary conditions but does not protect against a compromised upstream server, compromised distribution infrastructure, DNS or trust-store compromise, or an upstream script being changed maliciously. The Docker and Tailscale installers are particularly sensitive because this provisioning script already expects administrative privileges for `apt-get` and `usermod`. A remotely supplied script can consequently inherit root privileges. The Volta installer executes as the invoking user and can alter that user's files and development environment. Although installing Docker, Node.js, and Tailsc ...[truncated 1307 chars]
• Remediation: ## Remediation Suggestions - Do not pipe network responses directly into a shell. - Prefer distribution repositories whose packages are verified through the operating system's package-signing mechanism. - If an upstream installer is unavoidable: 1. Download it to a newly created, permission-restricted temporary file. 2. Pin an immutable release or commit rather than a moving installer URL. 3. Verify a vendor signature or a checksum stored independently in this repository. 4. Display the source and intended changes to the operator. 5. Require explicit confirmation before execution. 6. Execute only the installation steps that require elevation. 7. Delete the temporary file after use. - Use `curl --fail --show-error --location --proto '=https' --tlsv1.2` and enforce redirects only to approved hosts. These options improve transport handling but do not replace signature verification. - Pin Docker, Volta, Node.js, and Tailscale to reviewed versions. - Separate root-level system provisioning from user-level setup so that the Volta installer and other user tools never inherit unnecessary administrative privileges.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/provision.sh:18
• Finding: Provisioning Grants Root-Equivalent Docker Group Access## Vulnerability Details **File Location**: `scripts/provision.sh`, lines 18-23 **Vulnerability Type**: Excessive privilege assignment **Risk Level**: High ### Vulnerable Code ```bash if ! command -v docker >/dev/null 2>&1; then log "Installing Docker..." curl -fsSL https://get.docker.com | sh usermod -aG docker $SUDO_USER else log "Docker already installed." fi ``` ### Technical Analysis The script automatically adds `$SUDO_USER` to the `docker` group. Access to the Docker daemon is conventionally root-equivalent: a group member can start privileged containers, mount the host filesystem, access host devices, and alter host namespaces. For example, a Docker group member can mount `/` into a container and modify files owned by root. The operation is automatic and provides no warning or consent prompt. It also assumes `$SUDO_USER` is present and identifies the intended account. If the script is invoked directly as root rather than through `sudo`, this variable may be empty, causing unreliable behavior under `set -e`. Docker access is relevant to the Skill's stated functionality, but unrestricted daemon membership is broader than merely installing or running a constrained OpenClaw workload. Rootless Docker or a narrowly controlled service account would better follow least privilege. ### Attack Path 1. An operator runs the provisioning script through `sudo`. 2. The script adds the invoking account to the `docker` group. 3. Malicious code that later gains control of that account invokes Docker without further administrator approval. 4. It creates a privileged container or mounts the host root filesystem, for example through a container bind mount. 5. From the container, it modifies protected host files, extracts secrets, or installs persistent root-level access. ### Impact Assessment Any process operating as the selected user can obtain effective root control through the Docker daemon after g ...[truncated 251 chars]
• Remediation: ## Remediation Suggestions - Do not automatically add an interactive user to the `docker` group. - Prefer rootless Docker for workloads that do not require host-level container privileges. - Alternatively, create a dedicated service account with no interactive login and restrict it to the necessary workload. - If Docker group membership is unavoidable, clearly explain that it is root-equivalent and require explicit operator confirmation. - Validate the target account before changing membership; reject empty, `root`, malformed, or unexpected values of `$SUDO_USER`. - Separate installation from authorization so an administrator can review and perform the membership change independently. - Constrain containers by dropping capabilities, avoiding privileged mode and host filesystem mounts, and using read-only filesystems and mandatory access-control profiles where possible.

T08 · Insecure Dependencies

Error

• Location: scripts/provision.sh:47
• Finding: Unpinned Global OpenClaw Package Is Installed with Elevated Provisioning Context## Vulnerability Details **File Location**: `scripts/provision.sh`, line 47 **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: High ### Vulnerable Code ```bash # 5. OpenClaw Agent log "Installing OpenClaw..." npm install -g openclaw ``` ### Technical Analysis The command installs the registry's current `openclaw` release without pinning an exact version or verifying package integrity against a reviewed lockfile or trusted digest. The code executed during provisioning is consequently not fixed to the audited Skill version. npm packages can define lifecycle scripts that run during installation. Because earlier commands in the same script require administrative permissions and no privilege drop occurs before this command, operators are likely to run the entire provisioning script as root. In that case, package lifecycle scripts and globally installed files receive root-level execution or write access. This creates supply-chain exposure to registry-account compromise, malicious package updates, or compromise of a transitive dependency. The package name is consistent with the declared functionality, but unrestricted installation of the latest release is not necessary. ### Attack Path 1. An attacker compromises the publisher account, npm package, release pipeline, or a dependency included in a future `openclaw` release. 2. The attacker publishes a version containing a malicious install lifecycle script or runtime payload. 3. An operator runs `mesh_provision`. 4. npm resolves the unpinned name to the malicious current version. 5. The lifecycle script executes during installation. 6. If the provisioning script is running as root, the payload can immediately modify the entire host; otherwise it compromises the invoking user's files and credentials. ### Impact Assessment The possible impact is arbitrary code execution in the provisioning context. Under root execution, this includes com ...[truncated 338 chars]
• Remediation: ## Remediation Suggestions - Pin `openclaw` to an exact reviewed version, such as `openclaw@x.y.z`; do not use a moving tag or version range. - Record and verify the expected package integrity digest. - Use a lockfile or another reproducible dependency manifest for all package and transitive dependency versions. - Install the package as an unprivileged dedicated user rather than running npm in a root provisioning process. - Review package provenance, publisher identity, release signatures, and lifecycle scripts before updating. - Consider installing initially with lifecycle scripts disabled, then explicitly run only reviewed setup operations: ```bash npm install --global --ignore-scripts openclaw@x.y.z ``` This must be tested because some legitimate packages require lifecycle scripts. - Split operating-system provisioning and application installation into separate scripts with distinct privilege boundaries. - Add automated dependency auditing and a controlled update process instead of resolving the newest registry release during every provisioning run.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is described as Proxmox orchestration, but the documented behavior includes network scanning, host discovery, and port probing unrelated to the declared purpose. Hidden or under-disclosed discovery behavior is dangerous because it can enumerate internal assets, trigger monitoring alerts, and normalize lateral movement-style behavior inside a trusted environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill is described as Proxmox orchestration, but the documented behavior includes network scanning, host discovery, and port probing unrelated to the declared purpose. Hidden or under-disclosed discovery behavior is dangerous because it can enumerate internal assets, trigger monitoring alerts, and normalize lateral movement-style behavior inside a trusted environment.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill is described as Proxmox orchestration, but the documented behavior includes network scanning, host discovery, and port probing unrelated to the declared purpose. Hidden or under-disclosed discovery behavior is dangerous because it can enumerate internal assets, trigger monitoring alerts, and normalize lateral movement-style behavior inside a trusted environment.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The script claims to provision a Proxmox-native, self-healing swarm, but actually performs generic host bootstrap actions such as installing Docker, Node/Volta, Tailscale, and an npm package. This mismatch increases security risk because operators may run a broadly privileged script under false assumptions about its scope and necessity, especially where remote-access software is introduced.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Piping a remote script from get.docker.com directly into sh executes unreviewed network content with shell privileges. If the remote endpoint, transport, or upstream distribution is compromised, the host can be fully compromised immediately.

Chaining Abuse

High

• Category: Tool Misuse

Content

# 2. Docker
if ! command -v docker >/dev/null 2>&1; then
    log "Installing Docker..."
    curl -fsSL https://get.docker.com | sh
    usermod -aG docker $SUDO_USER
else
    log "Docker already installed."

• Confidence: 98% confidence
• Finding: The '| sh' chain removes any opportunity to inspect or verify the downloaded Docker installer before execution. This pattern is dangerous because it turns a network fetch into immediate code execution, making upstream compromise catastrophic.

External Script Fetching

High

• Category: Supply Chain

Content

# 3. Node/NPM (via Volta for stability)
if ! command -v node >/dev/null 2>&1; then
    log "Installing Node.js via Volta..."
    curl https://get.volta.sh | bash
    export VOLTA_HOME="$HOME/.volta"
    export PATH="$VOLTA_HOME/bin:$PATH"
    volta install node@22

• Confidence: 97% confidence
• Finding: The Volta installer is fetched from an external URL and piped to bash, so the host trusts and executes remote content without validation. This exposes the environment to supply-chain attacks and defeats change-control or code-review safeguards.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: Fetching Volta's installer over the network and piping it directly to bash executes third-party code without local verification. This creates a direct path to arbitrary code execution on the system if the remote installer or delivery path is tampered with.

Chaining Abuse

High

• Category: Tool Misuse

Content

# 3. Node/NPM (via Volta for stability)
if ! command -v node >/dev/null 2>&1; then
    log "Installing Node.js via Volta..."
    curl https://get.volta.sh | bash
    export VOLTA_HOME="$HOME/.volta"
    export PATH="$VOLTA_HOME/bin:$PATH"
    volta install node@22

• Confidence: 98% confidence
• Finding: Using '| bash' with the Volta installer directly chains remote content into execution, which is a high-risk anti-pattern in bootstrap scripts. It enables silent arbitrary command execution from a remote source without auditability or validation.

External Script Fetching

High

• Category: Supply Chain

Content

# 4. Tailscale
if ! command -v tailscale >/dev/null 2>&1; then
    log "Installing Tailscale..."
    curl -fsSL https://tailscale.com/install.sh | sh
else
    log "Tailscale already installed."
fi

• Confidence: 97% confidence
• Finding: Fetching and executing Tailscale's install script from the internet gives a remote source direct execution on the machine. Because this also installs connectivity software, the combination raises both code-execution and network-exposure risk.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: Installing Tailscale via a remote shell pipeline combines arbitrary code execution risk with the addition of networking software on the host. That makes compromise impact especially serious because it can both run attacker-controlled code and alter remote connectivity on an infrastructure node.

Chaining Abuse

High

• Category: Tool Misuse

Content

# 4. Tailscale
if ! command -v tailscale >/dev/null 2>&1; then
    log "Installing Tailscale..."
    curl -fsSL https://tailscale.com/install.sh | sh
else
    log "Tailscale already installed."
fi

• Confidence: 98% confidence
• Finding: The Tailscale install flow chains a remote download into sh, immediately executing internet-fetched code on the host. Given that the script is provisioning infrastructure components, this presents a severe supply-chain and host-compromise risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises capabilities that imply file access and shell-like system actions, but it does not declare any explicit tool scope or permissions boundaries. For a skill that mentions provisioning, deployment, and scanning, the absence of scoped permissions increases the chance of overbroad execution and makes it harder for users or the platform to constrain risky operations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill description promotes autonomous network scanning and agent deployment without warning users that these actions can alter systems, touch third-party hosts, or violate local policy. Missing safety disclosures are dangerous in this context because the skill is framed as automation for a cluster, increasing the likelihood that users run it with elevated trust or broad network reach.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

The Hydra Mesh Evolver is a specialized skill for the OpenClaw Mesh. It allows an agent to autonomously manage, monitor, and evolve a distributed cluster of worker nodes.

## Features
- **Node Injection:** Automatically deploy OpenClaw agents to Windows, Mac, and Linux nodes.
- **Proxmox Telemetry:** Real-time hardware health and VM management.
- **Self-Evolution Loop:** Scans project files (`PROJECTS.md`) and proposes code fixes/resume-plans for stalled work.
- **ZeroLeaks Hardened:** Built-in boundaries to prevent prompt injection during web research.

• Confidence: 84% confidence
• Finding: Automatic deployment to Windows, Mac, and Linux nodes reflects autonomous decision-making over external systems without clear human approval checkpoints. In the context of node injection and cluster management, this is dangerous because it can propagate software broadly, cause unintended changes on multiple hosts, and amplify any mistake or misuse at scale.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The described self-evolution behavior scans project files and proposes fixes or resume plans, but the skill does not warn about potential file modifications, generated artifacts, or sensitive data exposure from local project context. In a development environment, this can lead to unintended changes, leakage of internal planning data, or unreviewed automation affecting source repositories.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill description claims orchestration for a self-healing AI swarm in a Proxmox context, which implies active infrastructure management or remediation. This file performs only local parsing of PROJECTS.md and MEMORY.md and prints JSON recommendations, with no Proxmox interaction, swarm control, or healing behavior.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: Describing the process as 'hardened onboarding' is misleading because the script relies on convenience installers fetched from the network and executed directly in the shell. This can cause users to lower their guard and trust unsafe installation practices that execute third-party code as root.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script performs package installation and system modification automatically, with no user confirmation or warning about privileged changes. This is dangerous because it can unexpectedly alter a host's software state, repositories, and dependencies when run in sensitive environments.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Adding a user to the docker group changes local privilege boundaries because docker group membership often grants root-equivalent control over the host. Doing this silently can create unexpected privilege escalation paths or weaken security assumptions for that account.

Context-Inappropriate Capability

Medium

• Confidence: 84% confidence
• Finding: Installing Tailscale adds network-overlay and remote-access capability that is not clearly justified by the stated skill description. On infrastructure hosts, this can materially expand the attack surface and create an unexpected management path if later authenticated, configured, or abused.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: A global npm install retrieves and executes package installation logic from the registry, potentially including lifecycle scripts, and changes system-wide tool availability. Without warning or version pinning, this can introduce supply-chain risk and non-reproducible host state.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file behavior does not match the declared Proxmox orchestration and self-healing swarm purpose; instead it performs a hard-coded scan of local IPs for SSH and a custom port. This mismatch is risky because deceptive or overstated functionality can hide unauthorized discovery behavior and make operators run reconnaissance code they did not intend to deploy.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: This script performs concurrent TCP reconnaissance across several hosts and ports, which is a network scanning capability. In the context of a supposedly Proxmox-native orchestration skill, undisclosed host discovery increases risk because it can enumerate internal systems, violate network policy, and serve as a precursor to lateral movement or follow-on compromise if embedded in an automation workflow.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: This tagline uses aggressive natural language that can conflict with organizational policy expectations for neutral, non-harm-oriented skill descriptions. Even if figurative, it presents the skill as a weaponization tool rather than an administrative or orchestration utility.

Static analysis

No suspicious patterns detected.