Reverse proxy from internet to open claw

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:16 AM UTC
• Version: 1.0.1

Overview

This skill is purpose-built to expose a local OpenClaw API to the internet, but it uses broad setup authority and shares a reusable bearer credential in ways users should review carefully.

Install only if you intentionally want this machine's OpenClaw API reachable through Tailscale Funnel. Treat ecto-credentials.json as a live remote-access secret: share it only with trusted recipients, rotate it after sharing, and avoid putting the package or ZIP in chats, cloud folders, logs, or repositories. Review the scripts first if you are uncomfortable with sudo service changes, automatic Homebrew installation, or process restarts.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/connect.sh:55

Finding

Unpinned Remote Installer Downloaded and Executed Directly

Content

View full analysis

/dev/null; then print_error "Homebrew not found. Installing..." /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" fi print_success "Homebrew ready" } ``` ### Technical Analysis The script downloads the current content of a mutable GitHub `HEAD` resource and immediately passes it to `/bin/bash`. It does not pin the installer to a reviewed commit, verify a cryptographic checksum or signature, save the response for inspection, or obtain separate user approval before execution. Although the URL belongs to the Homebrew GitHub organization, the effective code executed by this Skill can change after the Skill itself has been reviewed. Compromise of the upstream repository, maintainer credentials, hosting infrastructure, or delivery path could therefore turn a normal Skill invocation into arbitrary local code execution. Installing Homebrew is also not strictly necessary when the required tools are already available through another supported installation method. Automatically bootstrapping a package manager exceeds the minimum behavior needed to configure Tailscale and OpenClaw. ### Attack Path 1. An attacker compromises the upstream installer repository, a maintainer account, or the content-delivery path. 2. The attacker modifies the installer referenced by the mutable `HEAD` URL. 3. A user without Homebrew invokes `scripts/connect.sh`. 4. `curl` retrieves the attacker-controlled response. 5. Command substitution passes the response directly to `/bin/bash`. 6. The payload executes with the invoking user's privileges. 7. The installer or payload may exploit the subsequent administrative workflow or request ...[truncated 571 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/connect.sh:211

Finding

Gateway Password Written Through Predictable Files Without Enforced Private Permissions

Content

View full analysis

"${OPENCLAW_CONFIG}.tmp" && mv "${OPENCLAW_CONFIG}.tmp" "$OPENCLAW_CONFIG" fi ``` ### Technical Analysis The generated bearer password is inserted into a predictably named temporary file, `${OPENCLAW_CONFIG}.tmp`. The script does not set a restrictive `umask`, create the file with `mktemp`, check for symbolic links, or explicitly apply mode `0600` before moving it into place. Consequently, the temporary file's permissions depend on the caller's current umask. With a permissive umask or unsuitable permissions on the parent directory, another local account may be able to read the gateway password. A predictable path also creates avoidable link and file-replacement risks in a directory writable by an attacker. The backup operation creates another persistent copy of the OpenClaw configuration. Depending on the existing configuration and permissions, that backup may retain sensitive values indefinitely. This is inconsistent with the explicit `chmod 600` protection applied to `ecto-credentials.json`. ### Attack Path 1. The user runs `connect.sh` with a permissive umask, or the OpenClaw configuration directory is accessible to another local account. 2. The script writes the modified configur ...[truncated 1032 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/package-for-friend.sh:27

Finding

Shared Package Exports the Sole Gateway Bearer Credential in Plaintext

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/connect.sh:238

Finding

Broad SIGKILL Patterns Can Terminate Unrelated OpenClaw Processes

Content

View full analysis

/dev/null || true pkill -9 -f "openclaw-gateway" 2>/dev/null || true sleep 1 # Start gateway nohup openclaw gateway run --port $GATEWAY_PORT --force > "$GATEWAY_LOG" 2>&1 & ``` ### Technical Analysis The restart routine searches complete process command lines using broad regular expressions and immediately sends `SIGKILL`. It does not restrict the match to the exact gateway instance, executable path, user, PID, configuration, or listening port managed by this Skill. `SIGKILL` prevents the target process from flushing data, closing resources, or performing normal shutdown cleanup. The new gateway is then detached with `nohup`, but the Skill does not maintain a validated PID file or another reliable ownership record. The disconnect script disables Funnel while intentionally leaving the local gateway running, so process lifecycle management is incomplete. ### Attack Path 1. Another legitimate process has a command line matching `openclaw.*gateway` or `openclaw-gateway`. 2. The user runs the full setup or invokes `connect.sh --restart`. 3. `pkill -9 -f` matches both the intended gateway and unrelated matching processes owned by that user. 4. The operating system terminates each matched process immediately. 5. Affected services lose availability and cannot perform graceful cleanup, potentially leaving incomplete operations or corrupted state. Where a local attacker can influence another process's command line, the attacker may also cause the restart routine to terminate an unintended process, although normal user-level process permission boundaries still apply. ### Impact Assessment The primary impact is local ...[truncated 393 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (73)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README presents public exposure of OpenClaw through Tailscale Funnel as a simple one-command action and instructs users to share the resulting credentials, but it does not prominently warn that this makes the service internet-reachable and that the credentials are equivalent to remote API access. This omission is dangerous because users may unknowingly expose sensitive local capabilities or data to anyone possessing the token, with little understanding of the risk boundary they are crossing.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

The README tells users that remote-access credentials are stored in a local JSON file and frames that file as shareable for API access. A static bearer token saved in a file and intended for redistribution creates a high risk of credential leakage, token reuse, and unauthorized remote control of the exposed service if the file is copied, backed up insecurely, or forwarded beyond the intended recipient.

Content

Scanner excerpt · README.md (reported line 35)May include surrounding context.

After Setup

Your credentials are saved to ~/.openclaw/ecto-credentials.json:

json

{

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

This line explicitly instructs the user to share the credential file with another person. That is a direct recommendation to distribute a bearer token granting remote API access, which is dangerous because it bypasses identity-based access control and makes further uncontrolled sharing trivial.

Content

Scanner excerpt · README.md (reported line 79)May include surrounding context.

md

**Manual way:**

1. Run the setup script (if you haven't already)
2. Share `~/.openclaw/ecto-credentials.json` with them
3. Share `scripts/test-connection.sh` for easy testing

**For your friend (test the connection):**

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The test workflow normalizes possession of the credential file by third parties, reinforcing the insecure pattern of credential distribution. This increases the attack surface because anyone with the file can immediately validate and use access to the exposed instance.

Content

Scanner excerpt · README.md (reported line 85)May include surrounding context.

For your friend (test the connection):

bash

./test-connection.sh ecto-credentials.json

For your friend (manual way):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The documentation shows how to extract the URL and token directly from the shared credential file, making operational use of the secret straightforward for any recipient. In context, this is not just secret handling documentation; it facilitates use of redistributed bearer credentials for an internet-exposed service.

Content

Scanner excerpt · README.md (reported line 92)May include surrounding context.

bash

# Read credentials
URL=$(jq -r '.url' ecto-credentials.json)
TOKEN=$(jq -r '.token' ecto-credentials.json)

# Make a request

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This line continues the credential extraction pattern and directly operationalizes the shared secret for remote access. Combined with public exposure via Funnel, it lowers the barrier for any copied credential file to be used immediately from another machine or by an unintended recipient.

Content

Scanner excerpt · README.md (reported line 93)May include surrounding context.

bash

# Read credentials
URL=$(jq -r '.url' ecto-credentials.json)
TOKEN=$(jq -r '.token' ecto-credentials.json)

# Make a request
curl "$URL/v1/chat/completions" \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 102)May include surrounding context.

-d '{"messages":[{"role":"user","content":"Hello!"}]}'

text

**To regenerate access credentials:**
```bash
./scripts/connect.sh --regenerate-token

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A skill that claims to set up Funnel but instead uses shared credentials to test an already-exposed remote endpoint can mislead users into disclosing or reusing credentials for a service they did not configure. In this context, the mismatch is especially risky because users are expecting infrastructure setup, not secret reuse against external endpoints.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A skill that claims to set up Funnel but instead uses shared credentials to test an already-exposed remote endpoint can mislead users into disclosing or reusing credentials for a service they did not configure. In this context, the mismatch is especially risky because users are expecting infrastructure setup, not secret reuse against external endpoints.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A skill that claims to set up Funnel but instead uses shared credentials to test an already-exposed remote endpoint can mislead users into disclosing or reusing credentials for a service they did not configure. In this context, the mismatch is especially risky because users are expecting infrastructure setup, not secret reuse against external endpoints.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

A skill that claims to set up Funnel but instead uses shared credentials to test an already-exposed remote endpoint can mislead users into disclosing or reusing credentials for a service they did not configure. In this context, the mismatch is especially risky because users are expecting infrastructure setup, not secret reuse against external endpoints.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The documentation identifies a credential file path containing an auth token for API access, and related findings suggest tokens may be displayed or shared. In a skill whose purpose is public exposure, weak handling or disclosure of that file can directly enable unauthorized remote use of the exposed service.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md

- Check: `tailscale funnel status`

**Auth errors?**
- Token is in: `~/.openclaw/ecto-credentials.json`
- Regenerate with: `./scripts/connect.sh --regenerate-token`

**Gateway not responding?**

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill is explicitly designed to expose OpenClaw publicly via Tailscale Funnel, but it does not provide a strong, explicit warning about the security consequences before doing so. Public exposure of an API materially increases attack surface and can lead to unauthorized access, abuse, or data exposure if any configuration is incorrect or credentials leak.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The script creates and reuses a local credentials file containing a bearer token for a publicly exposed API, and also writes the same password into the OpenClaw config. Storing long-lived secrets in plaintext on disk increases the impact of local compromise, backups leakage, or accidental disclosure, especially because the service is made internet-accessible.

Content

Scanner excerpt · scripts/connect.sh (reported line 10)May include surrounding context.

sh

#######################################

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
CREDENTIALS_FILE="$HOME/.openclaw/ecto-credentials.json"
OPENCLAW_CONFIG="$HOME/.openclaw/openclaw.json"
GATEWAY_LOG="/tmp/openclaw-gateway.log"
GATEWAY_PORT=18789

Credential Access

High

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

This line directly copies the local OpenClaw credential file into a shareable output package, creating a second portable copy of an active bearer token. Because bearer tokens are sufficient for API access, any recipient or interceptor of the package can use the service until the token is rotated or revoked.

Content

Scanner excerpt · scripts/package-for-friend.sh (reported line 30)May include surrounding context.

sh

mkdir -p "$OUTPUT_DIR"

# Copy files
cp "$CREDENTIALS_FILE" "$OUTPUT_DIR/ecto-credentials.json"
cp "$SCRIPT_DIR/test-connection.sh" "$OUTPUT_DIR/test-connection.sh"
chmod +x "$OUTPUT_DIR/test-connection.sh"

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script copies the credential file into a shareable directory immediately, without any confirmation, summary of what is being exported, or warning that the resulting folder grants API access. That makes accidental credential disclosure much more likely, especially because the skill's purpose is external exposure and sharing with another person.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/package-for-friend.sh (reported line 9)May include surrounding context.

sh

# Ecto Connection Status Script
#######################################

CREDENTIALS_FILE="$HOME/.openclaw/ecto-credentials.json"
GATEWAY_PORT=18789

# Colors

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/package-for-friend.sh (reported line 50)May include surrounding context.

sh

# Ecto Connection Status Script
#######################################

CREDENTIALS_FILE="$HOME/.openclaw/ecto-credentials.json"
GATEWAY_PORT=18789

# Colors

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/package-for-friend.sh (reported line 57)May include surrounding context.

sh

# Ecto Connection Status Script
#######################################

CREDENTIALS_FILE="$HOME/.openclaw/ecto-credentials.json"
GATEWAY_PORT=18789

# Colors

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/package-for-friend.sh (reported line 58)May include surrounding context.

sh

# Ecto Connection Status Script
#######################################

CREDENTIALS_FILE="$HOME/.openclaw/ecto-credentials.json"
GATEWAY_PORT=18789

# Colors

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/package-for-friend.sh (reported line 73)May include surrounding context.

sh

# Ecto Connection Status Script
#######################################

CREDENTIALS_FILE="$HOME/.openclaw/ecto-credentials.json"
GATEWAY_PORT=18789

# Colors

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/package-for-friend.sh (reported line 74)May include surrounding context.

sh

# Ecto Connection Status Script
#######################################

CREDENTIALS_FILE="$HOME/.openclaw/ecto-credentials.json"
GATEWAY_PORT=18789

# Colors

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/package-for-friend.sh (reported line 142)May include surrounding context.

sh

# Ecto Connection Status Script
#######################################

CREDENTIALS_FILE="$HOME/.openclaw/ecto-credentials.json"
GATEWAY_PORT=18789

# Colors

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/status.sh (reported line 7)May include surrounding context.

sh

# Ecto Connection Status Script
#######################################

CREDENTIALS_FILE="$HOME/.openclaw/ecto-credentials.json"
GATEWAY_PORT=18789

# Colors

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test-connection.sh (reported line 16)May include surrounding context.

sh

# Ecto Connection Status Script
#######################################

CREDENTIALS_FILE="$HOME/.openclaw/ecto-credentials.json"
GATEWAY_PORT=18789

# Colors

Static analysis

No suspicious patterns detected.