claw-radio

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:15 PM UTC
• Version: 1.0.1

Overview

The skill is mostly coherent for running an AI radio station, but its setup can overwrite local Docker/SearxNG state and relies on mutable third-party installs.

Review the setup steps before installing. Use this only if you are comfortable installing Homebrew packages, Docker/Colima, media tools, and running a local SearxNG container. Check whether you already have a container named searxng or existing ~/.openclaw/searxng files, back them up first, and consider pinning the Docker image and CLI version before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party CLI and Container Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13 and 61-105
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

bash

brew install vossenwout/tap/claw-radio-cli

bash

docker run -d --name searxng -p 127.0.0.1:8888:8080 searxng/searxng:latest

bash

docker run -d \
  --name searxng \
  -p 127.0.0.1:8888:8080 \
  -v ~/.openclaw/searxng:/etc/searxng \
  searxng/searxng:latest

Technical Analysis

The skill instructs users to install its core CLI from a third-party Homebrew tap without specifying an audited version. It also pulls the SearxNG container through the mutable latest tag rather than an immutable image digest.

These dependency references can resolve to different artifacts over time without any modification to the reviewed skill. If the third-party tap, package release infrastructure, container registry account, or upstream artifact is compromised, an attacker can substitute malicious executable content. No checksum, image digest, signature verification, or explicit version constraint is provided.

The loopback-only port binding limits direct network exposure of SearxNG, but it does not mitigate execution of a compromised container image or Homebrew package on the local system.

Attack Path

1. An attacker compromises the third-party Homebrew tap, its release infrastructure, or the upstream container image.
2. The attacker publishes a modified CLI package or replaces the image referenced by searxng/searxng:latest.
3. A user follows the documented installation or bootstrap procedure.
4. Homebrew installs the substituted package, or Docker pulls and starts the substituted container image.
5. Malicious code executes with the permissions available to the installing user or inside the Docker environment.
6. The compromised component can manipulate radio commands and cues, access data available to i ...[truncated 756 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin claw-radio-cli to a specific reviewed version rather than accepting the current tap release implicitly.
2. Document the authoritative source repository and expected package checksum or signature.
3. Pin SearxNG by immutable image digest, for example:

   bash

   docker run ... searxng/searxng@sha256:REVIEWED_DIGEST
   

4. Establish a controlled dependency-update process that reviews release notes, source changes, signatures, and image provenance before changing pinned versions.
5. Enable signature and provenance verification where supported by the package and container ecosystems.
6. Run the container with additional hardening, including a non-root user, a read-only root filesystem, dropped Linux capabilities, resource limits, and the minimum required writable mounts.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:59

Finding

Unconditional Forced Deletion of an Existing Named Container

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59-61 and 100-105
Vulnerability Type: Unsafe destructive resource handling
Risk Level: Medium

Vulnerable Code

bash

# Start once without a mount so the container generates a valid settings.yml
docker rm -f searxng 2>/dev/null || true
docker run -d --name searxng -p 127.0.0.1:8888:8080 searxng/searxng:latest

bash

docker rm -f searxng
docker run -d \
  --name searxng \
  -p 127.0.0.1:8888:8080 \
  -v ~/.openclaw/searxng:/etc/searxng \
  searxng/searxng:latest

Technical Analysis

The bootstrap procedure forcibly stops and deletes any Docker container named searxng. It does not verify that the existing container was created by this skill, inspect its image or labels, determine whether it is serving another workload, or request user confirmation.

Container names are shared within a Docker daemon. An unrelated user-managed service can therefore occupy the same name. The first deletion command additionally suppresses errors and always reports shell success through 2>/dev/null || true, reducing visibility into unexpected conditions.

The earlier instruction to check whether SearxNG is healthy does not resolve this issue because the documented recovery branch replaces the named resource whenever the JSON preflight fails. A configuration mismatch, temporary outage, or unrelated service using the name can trigger destructive replacement.

Attack Path

1. A container named searxng already exists in the active Docker environment.
2. The JSON preflight fails because the service is temporarily unavailable, does not enable JSON output, or is not the container expected by the skill.
3. The user or agent follows the documented bootstrap procedure.
4. docker rm -f searxng forcibly stops and deletes the existing container without validating ownership.
5. The skill starts a replacement container under the same name.
6. Th ...[truncated 664 chars]

Remediation

View remediation

Remediation Suggestions

1. Use a project-specific container name, such as claw-radio-searxng, to reduce collisions.
2. Add ownership labels when creating the container:

   bash

   docker run -d \
     --name claw-radio-searxng \
     --label io.claw-radio.managed=true \
     ...
   

3. Before removal, inspect the container and verify its expected label, image, mounts, and ownership.
4. If an existing resource is not positively identified as skill-managed, stop and request explicit user confirmation rather than deleting it.
5. Avoid suppressing all deletion errors. Report whether the container was absent, inaccessible, or failed to stop.
6. Back up or explicitly identify persistent data before replacement.
7. Prefer updating or recreating resources through Docker Compose with a project-specific namespace and declarative ownership.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs the agent to forcibly remove a Docker container and modify persistent local configuration under ~/.openclaw/searxng without clearly warning the user that existing state may be overwritten or disrupted. In an agent setting, this can cause unintended environment changes, service interruption, or clobbering of an existing SearxNG setup the user relies on.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 82% confidence

Finding

The skill copies generated container configuration into a persistent home-directory path and later rewrites that file programmatically, creating durable state outside the immediate session. In agent environments this can unexpectedly persist configuration across runs, interfere with existing user data, and make rollback difficult if the generated settings are unsafe or incompatible.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

docker run -d --name searxng -p 127.0.0.1:8888:8080 searxng/searxng:latest

Copy generated config to a persistent location

mkdir -p ~/.openclaw/searxng docker cp searxng:/etc/searxng/settings.yml ~/.openclaw/searxng/settings.yml

text

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md

Persona rule:

- The agent should infer and invent the radio host persona from the user's requested station vibe.
- Do not ask the user to come up with the host character.
- Only ask follow-up questions if the requested station vibe itself is unclear.

Escalation rule:

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md

Persona rule:

- The agent should infer and invent the radio host persona from the user's requested station vibe.
- Do not ask the user to come up with the host character.
- Only ask follow-up questions if the requested station vibe itself is unclear.

Escalation rule:

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly encourages stereotype-based personas such as 'a gay german' or 'an alcohol cowboy,' which normalizes harmful caricatures and can drive the agent to generate discriminatory or harassing output. In deployment, this creates content-safety and reputational risk and may cause policy-violating behavior during normal use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill requires installing packages such as docker, colima, ffmpeg, yt-dlp, and tmux, which make significant changes to the local environment. The description does not include any explicit warning that the skill depends on installing and running system-level tooling and containers.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.