ClawHub
Back to skill

Security audit

Agent P2P

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent P2P messaging and file-transfer portal, but it requests broad authority and contains serious access-control, credential-handling, installer, and remote-message safety flaws.

Install only in a test environment unless you are prepared to audit and fix it first. Before production use, require authentication and role separation on all Portal APIs, remove the hardcoded/default passwords, stop printing or storing plaintext secrets, validate contact portal URLs, restore TLS verification, sanitize downloaded filenames and UI rendering, add file-size and storage limits, avoid shell=True, pin deployed code and dependencies, and keep OpenClaw wake-hook processing isolated from remote message instructions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (14)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
vps/main.py:187
Finding

Portal Authentication Bypass Through Unauthenticated API-Key Creation

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
vps/main.py:995
Finding

Administrative API Discloses Owner and OpenClaw Credentials

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
vps/main.py:205
Finding

Hardcoded Default Administrative Password

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
vps/main.py:539
Finding

Multiple Sensitive Portal Endpoints Are Unauthenticated

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Error
Location
local/bridge.py:95
Finding

Untrusted Remote Messages Are Injected Directly Into the Agent Wake Hook

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
auto_install.py:93
Finding

Shell Command Injection in the Automated Installer

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
vps/static/admin.html:347
Finding

Stored Cross-Site Scripting in Contact Rendering

Content
View full analysis
👤 暂无联系人'; return; } list.innerHTML = contacts.map(c => `
${c.user_name ? c.user_name + '的' + c.agent_name : c.agent_name || '未命名'}
${c.portal_url}
${c.agent_name || ''} ${c.user_name || ''}
`).join(''); } ``` ```javascript document.getElementById('contact-detail-area').innerHTML = `

💬 与 ${c.user_name || c.agent_name || '联系人'} 的消息

${c.portal_url}
${c.agent_name || '-'}
${c.user_name || '-'}
${c.SHARED_KEY || c.api_key || '未设置'}
`; ``` ### Technical Analysis Contact fields are placed into `innerHTML` without contextual escaping. The page defines `escapeHtml`, but it is not used for these values. Contact data is persistent and can be attacker-controlled through vulnerable contact and key-management workflows. ### Attack Path 1. Store HTML or script-capable markup in a contact name or Portal URL. 2. Wait for an administrator to open the contacts tab. 3. The browser assigns the generated string to `innerHTML`. 4. The injected markup executes in the Portal origin. 5. The payload reads the bearer token from `localStorage` or calls administrative APIs. ### Impact Assessment The attacker can take over the administrato ...[truncated 157 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
local/client.py:24
Finding

TLS Certificate Verification Is Disabled for Portal Communications

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
send_file.py:233
Finding

Downloaded Filename Allows Arbitrary Local File Overwrite

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
vps/main.py:1441
Finding

Unbounded File Transfers Permit Memory, Database, and Disk Exhaustion

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/deploy_portal.py:92
Finding

Privileged Deployer Uses Predictable Credentials, Trusts Unknown SSH Hosts, and Runs Portal as Root

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
auto_install.py:288
Finding

Sensitive Configuration and Credential Files Are Written Without Enforced Permissions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/setup_openclaw_hooks.py:29
Finding

Hook Configuration Backup Is Broken and Sensitive Configuration Is Rewritten Unsafely

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
install.sh:19
Finding

Dependencies and Deployed Source Are Not Pinned to Reviewed Versions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (215)

Missing User Warnings

Critical
Category
Not specified by scanner
Confidence
99% confidence
Finding

The document points to a local file containing an administrator password and presents it as a normal lookup source. Exposing or encouraging access to admin credentials is especially dangerous because compromise would permit full administrative control over the related service or environment.

Content

No source excerpt is available for this finding.

Tainted flow: 'update_cmd' from input (line 398, user input) → subprocess.run (code execution)

Critical
Category
Data Flow
Confidence
100% confidence
Finding

The new admin password is taken from interactive user input and inserted directly into update_cmd, which is executed with shell=True. A password containing quotes or shell metacharacters can break out of the intended command and execute arbitrary commands locally and/or remotely with sudo on the VPS.

Content

Scanner excerpt · auto_install.py (reported line 399)May include surrounding context.

python
if new_pass:
                # 更新 VPS 上的密码
                update_cmd = f"ssh -i {args.ssh_key} ubuntu@{args.vps_ip} 'sudo htpasswd -cb /etc/nginx/.htpasswd {admin_user} \"{new_pass}\" && echo 密码已更新'"
                result = subprocess.run(update_cmd, shell=True, capture_output=True, text=True)
                if result.returncode == 0:
                    admin_pass = new_pass
                    print("✅ 密码已更新")

Tainted flow: 'url' from os.environ.get (line 161, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · send.py (reported line 46)May include surrounding context.

python
headers = {"Authorization": f"Bearer {api_key}"}
    
    try:
        resp = requests.get(url, headers=headers, timeout=10)
        if resp.status_code == 200:
            contacts = resp.json().get("contacts", [])
            for c in contacts:

Tainted flow: 'url' from os.environ.get (line 161, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · send.py (reported line 165)May include surrounding context.

python
headers = {"Authorization": f"Bearer {api_key}"}
    
    try:
        resp = requests.get(url, headers=headers, timeout=10)
        if resp.status_code == 200:
            contacts = resp.json().get("contacts", [])
            for c in contacts:

Tainted flow: 'to_portal' from os.environ.get (line 102, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The code fetches contact metadata from the hub and then blindly POSTs sensitive message content plus a shared key to contact.portal_url. If an attacker can poison contact data or register a malicious portal URL, this creates an SSRF/external exfiltration path and leaks the per-contact secret to an attacker-controlled endpoint.

Content

Scanner excerpt · send.py (reported line 113)May include surrounding context.

python
# 1. 发送到对方 Portal 的 /api/message/receive
    try:
        resp = requests.post(
            f"{to_portal}/api/message/receive",
            json={
                "api_key": shared_key,

Tainted flow: 'api_key' from os.environ.get (line 24, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · send.py (reported line 132)May include surrounding context.

python
# 2. 记录到我们 Portal 的 /api/message/sent
    try:
        resp = requests.post(
            f"{my_hub_url}/api/message/sent",
            json={
                "api_key": api_key,

Tainted flow: 'hub_url' from os.environ.get (line 25, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · send_file.py (reported line 42)May include surrounding context.

python
def get_contact(contact_id: int, api_key: str, hub_url: str):
    """获取联系人信息"""
    try:
        resp = requests.get(
            f"{hub_url}/api/contacts",
            headers={"Authorization": f"Bearer {api_key}"},
            timeout=10

Tainted flow: 'to_portal' from os.environ.get (line 186, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
92% confidence
Finding

The script takes a recipient-controlled portal_url from contact metadata and sends an authentication secret (shared_key as api_key) plus file metadata directly to that URL. Because there is no validation, trust check, or confirmation step, a malicious or poisoned contact record can redirect uploads and credentials to an attacker-controlled server, enabling unauthorized file exfiltration and secret disclosure.

Content

Scanner excerpt · send_file.py (reported line 98)May include surrounding context.

python
file_size: int, file_md5: str, chunks_total: int) -> str:
    """初始化文件传输（简化版：直接返回file_id，无需确认）"""
    try:
        resp = requests.post(
            f"{to_portal}/api/file/initiate",
            json={
                "api_key": api_key,

Tainted flow: 'to_portal' from os.environ.get (line 186, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
94% confidence
Finding

Each file chunk is uploaded to a recipient-supplied portal URL together with the shared secret and raw file content encoded in base64. Without destination validation or recipient confirmation, a malicious contact entry can silently siphon entire files and associated credentials to an attacker-controlled endpoint.

Content

Scanner excerpt · send_file.py (reported line 131)May include surrounding context.

python
for attempt in range(max_retries):
        try:
            resp = requests.post(
                f"{to_portal}/api/file/chunk/{file_id}/{chunk_index}",
                json={
                    "api_key": api_key,

Tainted flow: 'hub_url' from os.environ.get (line 25, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · send_file.py (reported line 233)May include surrounding context.

python
try:
        # 查询状态
        resp = requests.get(
            f"{hub_url}/api/file/status/{file_id}",
            params={"api_key": api_key},
            timeout=10

Tainted flow: 'hub_url' from os.environ.get (line 25, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · send_file.py (reported line 252)May include surrounding context.

python
print(f"📥 下载文件: {filename}")
        
        # 下载
        resp = requests.get(
            f"{hub_url}/api/file/download/{file_id}",
            params={"api_key": api_key},
            stream=True,

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CONFIG.md (reported line 20)May include surrounding context.

md
### 安全建议

1. **使用专用 SSH 密钥**
   - 不要直接使用主密钥（`~/.ssh/id_rsa`）
   - 创建专用密钥：`ssh-keygen -t ed25519 -C "agent-p2p" -f ~/.ssh/agent-p2p`
   - 仅授权访问 Portal VPS

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CONFIG.md (reported line 112)May include surrounding context.

ssh-keygen -t ed25519 -C "agent-p2p"

复制公钥到 VPS

ssh-copy-id -i ~/.ssh/id_ed25519.pub ubuntu@your-vps-ip

text

### 2. 部署 Portal

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CONFIG.md (reported line 120)May include surrounding context.

ssh-keygen -t ed25519 -C "agent-p2p"

复制公钥到 VPS

ssh-copy-id -i ~/.ssh/id_ed25519.pub ubuntu@your-vps-ip

text

### 2. 部署 Portal

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CONFIG.md (reported line 128)May include surrounding context.

ssh-keygen -t ed25519 -C "agent-p2p"

复制公钥到 VPS

ssh-copy-id -i ~/.ssh/id_ed25519.pub ubuntu@your-vps-ip

text

### 2. 部署 Portal

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · DEPLOY.md (reported line 293)May include surrounding context.

  1. 定期更新系统

    bash
    sudo apt update && sudo apt upgrade -y

  2. 备份数据

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

This documentation explicitly identifies files and locations containing live secrets, including API keys and hook tokens, and does so without any warning about secrecy, consent, or redaction. In an agent skill context, this materially increases the chance that an agent or operator will retrieve and expose credentials during routine assistance, enabling account compromise or unauthorized system access.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The quick-reference commands directly print credential files and tokens to stdout, which can leak into chat responses, logs, terminal scrollback, screenshots, or monitoring systems. Providing copy-paste commands for plaintext secret disclosure meaningfully lowers the barrier to accidental or unauthorized exfiltration.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The quick-reference section tells the operator or agent to display files that contain secrets in plaintext, which is an unsafe handling pattern for credentials. In practice, these commands can expose secrets to any system that captures terminal output, model context, support transcripts, or logs.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This guidance instructs the agent to inspect local credential files when answering user questions, without requiring necessity checks, user authorization, or redaction. In a skill environment, that creates a direct path for prompt-driven secret harvesting, where a user can induce the agent to read and potentially reveal sensitive local data.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The document operationalizes access to sensitive local secrets—API keys, hook tokens, and an admin password—as part of normal response generation. That is a substantive secret-disclosure design flaw because it encourages the agent to treat highly sensitive credentials as answerable context rather than protected data.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

The generic run(cmd, check=True) helper executes arbitrary strings with shell=True, making it an inherently dangerous primitive. Even though it is only used here for a local trusted script path, the helper invites future unsafe reuse and normalizes shell execution of raw strings.

Content

Scanner excerpt · auto_install.py (reported line 62)May include surrounding context.

python
def run(cmd, check=True):
    """运行命令"""
    print(f"$ {cmd}")
    result = subprocess.run(cmd, shell=True, capture_output=True, text=True)
    if check and result.returncode != 0:
        print(f"错误: {result.stderr}")
        sys.exit(1)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The script interpolates the user-supplied domain directly into a shell command (nslookup {domain}) with shell=True. An attacker who can influence the domain argument can inject arbitrary local shell commands during installation, which is especially dangerous because this is an admin-run setup script likely executed with access to SSH keys and local secrets.

Content

Scanner excerpt · auto_install.py (reported line 74)May include surrounding context.

python
print(f"\n[1/6] 检查域名解析: {domain}")
    
    for i in range(30):  # 最多等待 5 分钟
        result = subprocess.run(
            f"nslookup {domain}",
            shell=True, capture_output=True, text=True
        )

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

The SSH test command embeds ssh_key and vps_ip directly into a shell command while also disabling host key checking. This enables local command injection via crafted arguments and increases MITM risk by trusting any host key presented by the server.

Content

Scanner excerpt · auto_install.py (reported line 104)May include surrounding context.

python
os.chmod(ssh_key, 0o600)
    
    # 测试连接
    result = subprocess.run(
        f"ssh -i {ssh_key} -o StrictHostKeyChecking=no -o BatchMode=yes ubuntu@{vps_ip} 'echo OK'",
        shell=True, capture_output=True, text=True
    )

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The remote deployment script performs sudo rm -rf agent-p2p under /opt without explicit confirmation or backup. This is destructive behavior in an installation script; if the target path or repository state is wrong, it can delete an existing deployment and data unexpectedly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.