ClawHub
Back to skill

Security audit

Hey summon

Security checks for vulnerabilities and agentic risk

Overview

This skill mostly matches its human-help purpose, but it needs review because it can keep running in the background, use a local OpenClaw token, and accidentally publish local secrets through Git auto-sync.

Review before installing. Use only with a trusted HeySummon endpoint, prefer HTTPS for any non-local server, avoid sending secrets or sensitive conversation context, do not run auto-sync.sh until a restrictive .gitignore and staging allowlist are added, and treat .env, providers.json, .keys, .requests, watcher logs, and the OpenClaw gateway token as sensitive credentials.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/auto-sync.sh:10
Finding

Automatic Git synchronization can upload API keys, private keys, and request data

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/submit-request.sh:101
Finding

Questions and conversation context are transmitted without the claimed end-to-end encryption

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/add-provider.sh:12
Finding

API credentials can be sent to arbitrary or unencrypted endpoints

Content
View full analysis
[alias]" >&2 echo "" >&2 echo " api-key Client key (hs_cli_... or htl_...) linked to the provider" >&2 echo " alias Optional friendly name (default: provider name from platform)" >&2 exit 1 fi # Validate key prefix if [[ "$API_KEY" =~ ^htl_prov_ ]] || [[ "$API_KEY" =~ ^hs_prov_ ]]; then echo "❌ This is a provider key. You need a CLIENT key (hs_cli_... or htl_...)." >&2 exit 1 fi if [[ ! "$API_KEY" =~ ^hs_cli_ ]] && [[ ! "$API_KEY" =~ ^htl_ ]]; then echo "❌ Invalid key format. Must start with 'hs_cli_' or 'htl_'." >&2 exit 1 fi # Fetch provider info RESPONSE=$(curl -s "${BASE_URL}/api/v1/whoami" -H "x-api-key: ${API_KEY}") ``` Related credential-bearing requests also occur in: - `scripts/platform-watcher.sh:88`, where the API key authenticates the SSE connection. - `scripts/platform-watcher.sh:157-158`, where it authenticates message retrieval. - `scripts/submit-request.sh:101-110`, where the API key is included in the request body. - `scripts/submit-request.sh:135`, where it is sent in an HTTP header. ### Technical Analysis `HEYSUMMON_BASE_URL` is accepted without validating the scheme, hostname, certificate policy, or approved destination. The API key is subsequently transmitted to that endpoint. HTTP is safe from network interception only when it remains on a trusted loopback interface. The scripts do not enforce that restriction. A malicious `.env`, inherited environment variable, or configuration instruction can redirect credentials to an attacker-controlled server. Prefix validation ...[truncated 1096 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/platform-watcher.sh:23
Finding

Persistent watcher reads a high-value OpenClaw gateway token and invokes privileged local APIs

Content
View full analysis
/dev/null) if [ -z "$OPENCLAW_TOKEN" ]; then echo "ERROR: Could not read OpenClaw gateway token" >&2 exit 1 fi mkdir -p "$REQUESTS_DIR" # Deduplication SEEN_FILE="$SKILL_DIR/.seen-events.txt" touch "$SEEN_FILE" tail -500 "$SEEN_FILE" > "${SEEN_FILE}.tmp" 2>/dev/null && mv "${SEEN_FILE}.tmp" "$SEEN_FILE" send_notification() { local MSG="$1" if [ "$NOTIFY_MODE" = "file" ]; then local EVENTS_FILE="${HEYSUMMON_EVENTS_FILE:-$HOME/.heysummon/consumer-events.jsonl}" mkdir -p "$(dirname "$EVENTS_FILE")" local TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ") echo "{\"timestamp\":\"$TIMESTAMP\",\"message\":$(node -e "console.log(JSON.stringify(process.argv[1]))" "$MSG" 2>/dev/null)}" >> "$EVENTS_FILE" curl -s -X POST "http://127.0.0.1:${OPENCLAW_PORT}/cron/wake" \ -H "Authorization: Bearer ${OPENCLAW_TOKEN}" \ -H "Content-Type: application/json" \ -d "{\"text\":\"$MSG\",\"mode\":\"now\",\"agentId\":\"secondary\"}" \ >/dev/null 2>&1 else local PAYLOAD PAYLOAD=$(node -e "console.log(JSON.stringify({ tool:'message', args:{action:'send',message:process.argv[1],target:process.argv[2]} }))" "$MSG" "$NOTIFY_TARGET" 2>/dev/null) curl -s "http://127.0.0.1:${OPENCLAW_PORT}/tools/invoke" \ -H "Authorization: Bearer ${OPENCLAW_TOKEN}" \ -H "Content-Type: application/json" \ -d "$PAYLOAD" \ >/dev/null 2>&1 fi } ``` The process is persisted by `scripts/setup.sh:36-40`: ```bash if command -v pm2 &>/dev/null; then pm2 delete "$ ...[truncated 2178 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/crypto.mjs:23
Finding

Cryptographic private keys are created without explicit restrictive permissions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/submit-request.sh:31
Finding

Predictable shared temporary file permits symlink and race-condition attacks

Content
View full analysis
p.nameLower === search || p.providerName.toLowerCase() === search || p.name.toLowerCase().includes(search) || p.providerName.toLowerCase().includes(search) ); if (match) { console.log(match.apiKey); process.stderr.write(match.name); } " "$PROVIDERS_FILE" "$PROVIDER_NAME" 2>"/tmp/.heysummon-provider-match") RESOLVED_PROVIDER=$(cat /tmp/.heysummon-provider-match 2>/dev/null) rm -f /tmp/.heysummon-provider-match fi ``` ### Technical Analysis The script uses the fixed path `/tmp/.heysummon-provider-match` for temporary output. `/tmp` is normally shared among local users. Shell redirection follows symbolic links and truncates the destination before launching the Node.js process. Because the filename is predictable and shared across all invocations, an attacker can pre-create it as a symbolic link to another file writable by the victim. Concurrent executions can also overwrite or read each other's provider selection data. ### Attack Path 1. A local attacker predicts the fixed temporary path. 2. The attacker creates `/tmp/.heysummon-provider-match` as a symbolic link to a file writable by the victim. 3. The victim invokes `submit-request.sh` with a provider name. 4. Shell redirection opens and truncates the symlink target under the victim's permissions. 5. The Node.js process writes the resolved provider name to that target. 6. ...[truncated 779 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (37)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 102)May include surrounding context.

  1. Create .env file:
    bash
    cp .env.example .env
# Edit .env with your API key and platform URL

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 103)May include surrounding context.

  1. Create .env file:

    bash
    cp .env.example .env
# Edit .env with your API key and platform URL

  2. Register your first provider:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 327)May include surrounding context.

  1. Create .env file:

    bash
    cp .env.example .env
# Edit .env with your API key and platform URL

  2. Register your first provider:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 345)May include surrounding context.

  1. Create .env file:

    bash
    cp .env.example .env
# Edit .env with your API key and platform URL

  2. Register your first provider:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 400)May include surrounding context.

  1. Create .env file:

    bash
    cp .env.example .env
# Edit .env with your API key and platform URL

  2. Register your first provider:

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/add-provider.sh (reported line 38)May include surrounding context.

sh
fi

# Fetch provider info
RESPONSE=$(curl -s "${BASE_URL}/api/v1/whoami" -H "x-api-key: ${API_KEY}")
ERROR=$(echo "$RESPONSE" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{const j=JSON.parse(d);if(j.error)console.log(j.error)}catch(e){}})" 2>/dev/null)

if [ -n "$ERROR" ]; then

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/add-provider.sh (reported line 10)May include surrounding context.

sh
# List registered providers
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
SKILL_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
[ -f "$SKILL_DIR/.env" ] && set -a && source "$SKILL_DIR/.env" && set +a

PROVIDERS_FILE="${HEYSUMMON_PROVIDERS_FILE:-$SKILL_DIR/providers.json}"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/list-providers.sh (reported line 5)May include surrounding context.

sh
# List registered providers
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
SKILL_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
[ -f "$SKILL_DIR/.env" ] && set -a && source "$SKILL_DIR/.env" && set +a

PROVIDERS_FILE="${HEYSUMMON_PROVIDERS_FILE:-$SKILL_DIR/providers.json}"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/platform-watcher.sh (reported line 8)May include surrounding context.

sh
# List registered providers
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
SKILL_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
[ -f "$SKILL_DIR/.env" ] && set -a && source "$SKILL_DIR/.env" && set +a

PROVIDERS_FILE="${HEYSUMMON_PROVIDERS_FILE:-$SKILL_DIR/providers.json}"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/submit-request.sh (reported line 10)May include surrounding context.

sh
# List registered providers
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
SKILL_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
[ -f "$SKILL_DIR/.env" ] && set -a && source "$SKILL_DIR/.env" && set +a

PROVIDERS_FILE="${HEYSUMMON_PROVIDERS_FILE:-$SKILL_DIR/providers.json}"

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/platform-watcher.sh (reported line 45)May include surrounding context.

sh
mkdir -p "$(dirname "$EVENTS_FILE")"
    local TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
    echo "{\"timestamp\":\"$TIMESTAMP\",\"message\":$(node -e "console.log(JSON.stringify(process.argv[1]))" "$MSG" 2>/dev/null)}" >> "$EVENTS_FILE"
    curl -s -X POST "http://127.0.0.1:${OPENCLAW_PORT}/cron/wake" \
      -H "Authorization: Bearer ${OPENCLAW_TOKEN}" \
      -H "Content-Type: application/json" \
      -d "{\"text\":\"$MSG\",\"mode\":\"now\",\"agentId\":\"secondary\"}" \

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The script uses EVENT_REQ_ID derived from untrusted event JSON to build a filesystem path and passes it directly to rm -f. An attacker able to influence requestId could use path traversal values like ../../somefile to delete arbitrary files accessible to the current user, especially because no basename or character validation is enforced.

Content

Scanner excerpt · scripts/platform-watcher.sh (reported line 186)May include surrounding context.

sh
# Remove closed/expired requests
      EVENT_TYPE=$(echo "$data" | node -e "let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>{try{console.log(JSON.parse(d).type)}catch(e){}})" 2>/dev/null)
      if [ "$EVENT_TYPE" = "closed" ] && [ -n "$EVENT_REQ_ID" ]; then
        rm -f "$REQUESTS_DIR/$EVENT_REQ_ID"
      fi
    fi
  done < "$FIFO"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
95% confidence
Finding

The script uses a fixed path in /tmp for intermediate provider data, then reads and deletes it. Because /tmp is shared, another local user or process could pre-create or race this file, causing data spoofing, symlink attacks, or unintended file deletion depending on execution context.

Content

Scanner excerpt · scripts/submit-request.sh (reported line 50)May include surrounding context.

sh
}
  " "$PROVIDERS_FILE" "$PROVIDER_NAME" 2>"/tmp/.heysummon-provider-match")
  RESOLVED_PROVIDER=$(cat /tmp/.heysummon-provider-match 2>/dev/null)
  rm -f /tmp/.heysummon-provider-match
fi

# Fallback: if no provider specified or not found, use default from env

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README encourages submitting conversation context and routing notifications through external services, including a human-provider workflow, without a prominent privacy warning about sharing potentially sensitive prompts, messages, or identifiers outside the local agent environment. In a HITL skill, that omission increases the chance users will send secrets, regulated data, or internal context to third parties unintentionally.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The README makes a security claim that API keys are never passed as CLI arguments, but it also documents add-provider.sh "hs_cli_..." usage that places a live secret directly in the shell command line. Command-line arguments are commonly exposed through shell history, process listings, audit logs, and terminal recordings, so this inconsistency can cause credential disclosure.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 345)May include surrounding context.

  1. Restrict file permissions:
    bash
    chmod 600 .env
chmod 700 .keys/

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 346)May include surrounding context.

  1. Restrict file permissions:
    bash
    chmod 600 .env
chmod 700 .keys/

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script persists the supplied client API key directly into providers.json in plaintext, with no warning, permission hardening, or indication that this creates a local credential store. If that file is later read by other users, checked into source control, or exposed by backups/logging, the key can be reused to impersonate the client and access provider-linked functionality.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script comment claims it syncs only the heysummon skill, but git add -A stages all changes in the repository and the later commit/push publishes them. This mismatch is dangerous because operators may trust the narrower description and unintentionally upload unrelated files, secrets, or work-in-progress content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script automatically commits and pushes to origin main without any user warning, approval, or review step once changes are detected. In a skill context, this increases the chance of silently publishing unintended modifications or sensitive data, especially if run on a schedule as the comments suggest.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script writes private signing and encryption keys directly to disk using default filesystem permissions and without restricting access or warning the operator about secure storage. On multi-user systems or in permissive umask environments, this can expose long-term private keys to other local users or accidental inclusion in backups, logs, or repositories, compromising all encrypted communications and signatures.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script intentionally prints the first 12 characters of each stored provider API key to stdout. Even partial credential disclosure is sensitive because prefixes can aid key identification, correlation across systems, leakage into logs or screenshots, and reduce secrecy if other portions are exposed elsewhere.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The header presents the script as a passive SSE listener, but the implementation also fetches full message bodies and forwards notifications through a local tool gateway. That mismatch reduces informed consent and can cause operators to run a component with broader data access and transmission behavior than advertised.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script reads an unrelated OpenClaw gateway bearer token from the user's home directory and uses it to invoke a separate local tooling API, expanding the trust boundary beyond the stated SSE-watcher role. This creates a covert bridge between HeySummon event data and another privileged local service, so compromise or misuse of event content can trigger actions or expose data through an unrelated channel without explicit consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Reading a local gateway token from the user's OpenClaw config without a user-facing warning silently accesses sensitive credentials belonging to another system. Even if intended for convenience, this violates least surprise and can enable unauthorized use of a privileged local API under the user's identity.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
README.md:423