Security audit

Openclaw Production Deploy

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed production deployment guide, but it combines persistent service setup, broad network exposure, unpinned installs, and unsafe/incomplete scripts that users should review before use.

Review and repair the package before installing. Pin exact OpenClaw versions, avoid running unreviewed latest/default-branch code, default the web UI to localhost unless TLS and firewall allowlists are configured, protect token files with restrictive permissions, and replace the systemd installer with a dedicated gateway service that does not rerun the deployment script.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T08 · Insecure Dependencies

Warning

Location: scripts/deploy.js:217
Finding: Unpinned Third-Party Code Is Downloaded and Executed During Deployment
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/deploy.js:499
Finding: Predictable Temporary File Is Copied into a Privileged Systemd Location
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/deploy.js:298
Finding: Generated Authentication Token Is Stored Without Explicit Restrictive Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/deploy.js:350
Finding: Production Web Interface Is Exposed on All Network Interfaces over Plain HTTP
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/deploy.js:474
Finding: Systemd Service Executes the Interactive Deployment Script Instead of the Gateway
Content: View full analysis
``` It does not directly execute `openclaw gateway run`. The deployment script is interactive and asks the user whether deployment should proceed. Under systemd, it does not have a normal interactive terminal, so it may block, exit, or fail. Because `Restart=always` is configured, failures or clean exits can cause repeated execution every ten seconds. If the script were repaired and made noninteractive, this design could repeatedly rerun installation and configuration actions rather than only running the gateway. The unit also interpolates `process.env.USER`, `process.cwd()`, `process.execPath`, and `require.main.filename` without validating that they are suitable for a systemd unit. Paths containing spaces or systemd-significant characters may be parse ...[truncated 2203 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (32)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
node scripts/deploy.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
node scripts/step1-environment.js

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.
md
node scripts/step1-environment.js

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · docs/PRODUCTION-SETUP.md (reported line 142)May include surrounding context.
Windows服务配置

xml
 <service> <id>OpenClawGateway</id> <name>OpenClaw Gateway</name>

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The troubleshooting section instructs users to disable gateway authentication and restart the service, with only a brief parenthetical note, which is insufficient for a production guide. If applied on a reachable service, this can expose the dashboard and API to unauthorized access, data disclosure, and service abuse.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The generated Windows/Linux service definitions use process.execPath with require.main.filename, which points to the deployment script itself rather than the intended OpenClaw gateway/service binary. This can cause persistent execution of the installer logic at boot, leading to repeated privileged changes, unintended reinstall/reconfiguration loops, and a much larger execution surface than the advertised service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill directs users to run deployment and service-configuration scripts that can install software, register system services, and enable autostart, but it does not clearly warn that these actions will modify the host system. In an agent context, missing pre-execution warnings and confirmation requirements can lead to unintended persistent changes, especially on production machines.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The backup restore instructions tell the user to restore from a backup file but do not warn that restoration may overwrite current configuration or state. This can cause accidental loss of newer settings or data if used without validation, version checks, or a backup of the current state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The emergency recovery section includes a direct copy command that replaces the active config file with a backup, without warning that the current configuration will be overwritten. In production, this can immediately revert security settings, break environment-specific configuration, or discard recent operational changes.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · docs/PRODUCTION-SETUP.md (reported line 85)May include surrounding context.
md
# 或浏览器访问: http://localhost:18789 # 测试聊天功能 curl -X POST http://localhost:18789/api/chat \ -H "Authorization: Bearer YOUR_TOKEN" \ -H "Content-Type: application/json" \ -d '{"message": "你好，测试生产环境"}'

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The production config explicitly binds the gateway to 0.0.0.0, exposing the service to all network interfaces, while the surrounding guidance does not prominently warn that this increases attack surface. In a production setup guide, readers may copy this default directly, unintentionally making the chat/API endpoint reachable from untrusted LAN segments or port-forwarded environments.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · docs/PRODUCTION-SETUP.md (reported line 188)May include surrounding context.
macOS launchd服务

xml
 <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0">

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · docs/PRODUCTION-SETUP.md (reported line 190)May include surrounding context.
macOS launchd服务

xml
 <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0">

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · docs/PRODUCTION-SETUP.md (reported line 191)May include surrounding context.
macOS launchd服务

xml
 <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0">

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · docs/PRODUCTION-SETUP.md (reported line 211)May include surrounding context.
macOS launchd服务

xml
 <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0">

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/deploy.js (reported line 535)May include surrounding context.
js
#### macOS launchd服务 ```xml  <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0">

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · docs/PRODUCTION-SETUP.md (reported line 190)May include surrounding context.
xml
 <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/deploy.js (reported line 535)May include surrounding context.
js
```xml  <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> <dict> <key>Label</key>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 80% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · docs/PRODUCTION-SETUP.md (reported line 316)May include surrounding context.
md
# Linux: 检查systemd服务 systemctl status openclaw.service systemctl enable openclaw.service # 重新启用 # 检查启动依赖 # 确保网络服务在OpenClaw之前启动

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · docs/PRODUCTION-SETUP.md (reported line 350)May include surrounding context.
md
# 检查防火墙 # Windows: 允许端口18789通过防火墙 # Linux: sudo ufw allow 18789/tcp # 检查网络配置 ping [目标IP]

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/deploy.js (reported line 503)May include surrounding context.
js
# 检查防火墙 # Windows: 允许端口18789通过防火墙 # Linux: sudo ufw allow 18789/tcp # 检查网络配置 ping [目标IP]

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts/deploy.js (reported line 504)May include surrounding context.
js
# 检查防火墙 # Windows: 允许端口18789通过防火墙 # Linux: sudo ufw allow 18789/tcp # 检查网络配置 ping [目标IP]

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code file clearly warns that it will install to production and register a service, but its user-facing deployment summary does not explicitly disclose that it will write configuration files under the user's home directory, create service definitions, and enable automatic startup. Those are safety-relevant persistent changes, and SQP-2 applies because the script performs them later via fs.writeFileSync and service registration commands.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The script executes npx -y openclaw@latest without pinning to a specific version or verifying provenance. In a deployment script that may run with elevated privileges, this creates a supply-chain risk where a compromised or unexpected package version can be fetched and executed immediately.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The script copies a service file into /etc/systemd/system and runs sudo systemctl enable/start, which are privileged and persistence-related operations. Although earlier text mentions root privileges for service registration, there is no targeted confirmation or explicit user-facing warning immediately before these commands execute.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/step1-environment.js:479

Overview

A.I.G

T08 · Insecure Dependencies

T05 · Unauthorized Access and Privilege Escalation

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

Ae1

Ae1

Ae1

Hidden Instructions

Windows服务配置

Missing User Warnings

Intent-Code Divergence

Missing User Warnings

Missing User Warnings

Missing User Warnings

External Transmission

Missing User Warnings

Session Persistence

macOS launchd服务

Session Persistence

macOS launchd服务

Session Persistence

macOS launchd服务

Session Persistence

macOS launchd服务

Session Persistence

Session Persistence

Session Persistence

Session Persistence

Sudo/Root Execution

Sudo/Root Execution

Sudo/Root Execution

Missing User Warnings

Rp1

Missing User Warnings

Static analysis

Shell command execution detected (child_process).