ClawHub
Back to skill

Security audit

Openclaw Installer Cn

Security checks for vulnerabilities and agentic risk

Overview

This installation helper is mostly purpose-aligned, but it recommends high-impact repair commands that can change system permissions, execute remote code, and persist shell/config changes without enough scoping or confirmation.

Install only if you are comfortable reviewing each proposed shell command before execution. Do not allow automatic repair to run sudo, change /usr/local ownership, delete dependency files, modify ~/.zshrc, or pipe remote scripts into bash unless you have independently reviewed and approved the exact command and rollback plan.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:125
Finding

Remote NVM Installer Is Downloaded and Executed Without Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 125
Vulnerability Type: Remote payload retrieval and immediate shell execution
Risk Level: High

Vulnerable Code

bash
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash

Technical Analysis

The instruction streams a remote installation script directly into Bash. The downloaded content is not saved for inspection, and its checksum, digital signature, and provenance are not verified before execution. It also omits fail-closed curl options such as --fail, --show-error, and --location.

Although the URL points to the established nvm-sh/nvm GitHub repository and specifies a version tag, that does not eliminate the remote-code-execution risk. A Git tag is not equivalent to a locally verified immutable digest. The effective payload remains outside the audited Skill and could change or be compromised after this review.

Installing NVM may be relevant as an alternative to unsafe system-wide npm permissions, but immediate curl | bash execution is not the minimum privilege or safest mechanism necessary for installation diagnostics.

Attack Path

  1. An attacker compromises the referenced repository, release tag, maintainer account, hosting infrastructure, or another part of the remote delivery chain.
  2. The attacker changes the content returned for install.sh or causes malicious content to be served from the expected URL.
  3. A user follows the Skill's permission-error remediation instructions.
  4. curl streams the unverified response directly to Bash.
  5. Bash executes the attacker's commands with the privileges of the invoking user.
  6. The payload can access user files, credentials, development environments, and shell configuration, or establish user-level persistence.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. This can expose or modify files readable or writable by tha ...[truncated 476 chars]

Remediation
View remediation

Remediation Suggestions

  1. Do not pipe network responses directly into a shell.
  2. Pin the installer to an immutable, reviewed commit rather than relying only on a version tag.
  3. Download the installer to a newly created local file using fail-closed transport options.
  4. Verify a trusted SHA-256 digest or cryptographic signature obtained through an independent trusted channel.
  5. Review the downloaded script before execution and require explicit user confirmation.
  6. Run the installer as an unprivileged user and document the files it is expected to modify.
  7. Prefer an operating-system package manager or other verifiable installation mechanism where available.

A safer pattern is:

bash
curl --fail --show-error --location \
  --output /tmp/nvm-install.sh \
  "https://raw.githubusercontent.com/nvm-sh/nvm/<immutable-commit>/install.sh"

printf '%s  %s\n' '<trusted-sha256>' '/tmp/nvm-install.sh' | sha256sum --check
less /tmp/nvm-install.sh
bash /tmp/nvm-install.sh

The digest and immutable commit must come from a trusted, independently verified source. A temporary file should also be created securely and removed after use.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:120
Finding

Recursive Ownership Transfer Weakens Protection of Global Node Modules

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 120–121
Vulnerability Type: Excessive permission modification and violation of least privilege
Risk Level: High

Vulnerable Code

bash
# Fix npm permissions
sudo chown -R $(whoami) ~/.npm
sudo chown -R $(whoami) /usr/local/lib/node_modules

Technical Analysis

The instructions use elevated privileges to recursively transfer ownership of both the user's npm directory and the shared global Node.js module directory to the current user. In particular, changing all content under /usr/local/lib/node_modules makes system-wide executable package content writable by an unprivileged account.

This operation is substantially broader than necessary to diagnose or repair a specific OpenClaw installation. It does not identify the files with incorrect ownership, account for symlinks or shared installations, or preserve package-manager ownership boundaries. The unquoted $(whoami) expansion is also unnecessary; ownership should be derived and validated explicitly if a narrowly scoped repair is genuinely required.

Making global modules user-writable creates a trust-boundary failure. Any malicious process running as that user can subsequently alter global package code without requiring elevated privileges.

Attack Path

  1. The user follows the Skill's permission-repair instructions and authorizes sudo.
  2. The recursive chown makes /usr/local/lib/node_modules and its existing contents writable by that user.
  3. An attacker gains execution in the user's context through a malicious package, compromised development tool, or another user-level process.
  4. The attacker modifies a globally installed Node.js package or code used by a global command.
  5. Another user or a more privileged workflow invokes the affected global tool.
  6. The modified package code executes within that workflow's security context.

Impact Assessment

The immediate effect is loss of integrity for globally installe ...[truncated 587 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the recursive ownership change for /usr/local/lib/node_modules.
  2. Prefer a user-scoped Node.js installation through a securely installed version manager or configure npm with a user-owned prefix.
  3. Diagnose ownership problems first and repair only the specific files proven to have incorrect ownership.
  4. Preserve root or package-manager ownership for shared global package directories.
  5. Require explicit user confirmation before any sudo, recursive permission change, or ownership modification.
  6. Avoid following symbolic links and verify that every target resolves within the intended directory before changing ownership.
  7. If ~/.npm needs repair, limit the operation to entries that are incorrectly owned and use validated numeric identifiers, for example id -u and id -g, rather than applying an unconditional recursive change.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:111
Finding

Unpinned Global Packages Are Installed Through a Third-Party Registry

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 111–112
Vulnerability Type: Unverified and unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash
# Or use cnpm
npm install -g cnpm --registry=https://registry.npmmirror.com
cnpm install -g openclaw

Technical Analysis

The instructions globally install cnpm from a third-party npm mirror and then use it to globally install openclaw. Neither package is pinned to a reviewed version, and no expected integrity digest, signature, or package provenance is specified.

npm-compatible package installation may execute lifecycle scripts during installation. Consequently, installing a package is not merely a data download: a compromised package, registry response, mirror, maintainer account, or newly published version can cause attacker-controlled code to execute. Global installation also expands the effect by placing commands and package content into shared or broadly used locations.

Using a regional mirror may support the Skill's stated network-optimization purpose, but introducing an additional package manager and installing unpinned global packages exceeds what is necessary for basic diagnostics. It expands the supply-chain trust boundary without documenting integrity controls.

Attack Path

  1. An attacker compromises the third-party mirror, a package maintainer account, or the cnpm or openclaw package supply chain.
  2. The attacker publishes or serves a malicious package version or altered package metadata.
  3. Because no version is pinned, the installation resolves to the attacker-controlled release.
  4. npm or cnpm downloads the package and may execute its lifecycle scripts during installation.
  5. Malicious code runs with the invoking user's permissions and installs or modifies global tooling.
  6. Users later invoke the compromised globally installed command, providing an additional execution opportunity.

Impact Assessment

A malicious de ...[truncated 643 chars]

Remediation
View remediation

Remediation Suggestions

  1. Prefer the canonical npm registry unless a mirror is explicitly required and independently trusted.
  2. Pin every installed package to an exact, reviewed version rather than resolving the latest release.
  3. Verify package provenance, signatures, and integrity metadata before installation.
  4. Document the mirror's trust model and provide a way to compare package digests with the canonical registry.
  5. Avoid global installation where a project-local or user-local installation is sufficient.
  6. Review package lifecycle scripts before installation and consider an initial installation with scripts disabled:
bash
npm install --ignore-scripts --save-exact openclaw@<reviewed-version>
  1. If lifecycle scripts are required, inspect them and execute them only after provenance and integrity verification.
  2. Avoid installing an additional package manager solely to install OpenClaw when the existing npm client can perform a pinned, verified installation.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Chaining Abuse

High
Category
Tool Misuse
Confidence
99% confidence
Finding

Piping a remotely fetched script directly into bash is a classic high-risk pattern because it executes unverified network content immediately in the user's shell. In this skill's installation/repair context, novice users are likely to trust and run the command, making supply-chain compromise, MITM on a trusted endpoint, or upstream account compromise especially dangerous.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

sudo chown -R $(whoami) /usr/local/lib/node_modules

或使用 nvm 管理 Node

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash nvm install 20 nvm use 20

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The 'automatic repair' flow includes cache cleaning, dependency reinstallation, permission repair, and config updates without clearly warning that these actions may delete files, alter permissions, or change system-wide package behavior. In a troubleshooting skill, such undisclosed system-altering actions can cause data loss, break local development environments, or weaken the principle of least surprise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill states it will generate persistent files such as ~/.openclaw/config.json, ~/.zshrc entries, and startup scripts, but it does not warn the user that these changes modify long-lived local configuration. In an agent setting, silent persistence can surprise users, alter future shell behavior, and create hard-to-revert environment changes, especially when secrets and package registries are involved.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
94% confidence
Finding

The skill recommends running sudo chown recursively on ~/.npm, which normalizes privileged shell execution and encourages broad ownership changes. If executed incorrectly or adapted by an agent without careful scoping, recursive ownership changes can damage permissions, mask underlying privilege issues, and create opportunities for unsafe file access patterns.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

bash
# 修复 npm 权限
sudo chown -R $(whoami) ~/.npm
sudo chown -R $(whoami) /usr/local/lib/node_modules

# 或使用 nvm 管理 Node

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
96% confidence
Finding

The command sudo chown -R $(whoami) /usr/local/lib/node_modules modifies a system-wide directory with elevated privileges and can affect all Node global packages on the host. In an agent or novice-user context this is especially risky because it encourages broad privileged mutation of shared system state rather than a narrowly scoped, reversible fix.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

bash
# 修复 npm 权限
sudo chown -R $(whoami) ~/.npm
sudo chown -R $(whoami) /usr/local/lib/node_modules

# 或使用 nvm 管理 Node
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.0/install.sh | bash

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description explicitly positions the skill as a Chinese installation diagnostic and the document is entirely written in Chinese, but it does not state that the locale is optional or provide an opt-in choice. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
15% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

npm config get registry

测试 OpenClaw 源

curl -s -o /dev/null -w '%{http_code}' https://registry.npmjs.org/openclaw

text

### 检查安装

Static analysis

No suspicious patterns detected.