T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:18- Finding
Hardcoded Privileged Credentials and Service Secrets
- Content
View full analysis
- Remediation
View remediation
Security audit
Aliyun Openclaw
Security checks for vulnerabilities and agentic risk
Overview
This skill appears to be a remote OpenClaw deployment guide, but it publishes live-looking root credentials and service secrets with broad remote-control configuration.
Do not install or publish this skill as-is. Treat the SSH password, gateway token, model API key, Tavily key, and Feishu secret as compromised and rotate them first. Replace real secrets with placeholders, disable root password login, restrict gateway binding/origins, pin packages and container images, and add explicit warnings or confirmations around destructive admin commands.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
remote_config.json:42- Finding
LAN-Exposed Gateway Permits Requests from Arbitrary Browser Origins
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
SKILL.md:47- Finding
Unpinned npm Packages Are Installed and Executed in the Runtime Container
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
SKILL.md:133- Finding
Mutable Latest Container Image Is Deployed with Sensitive Persistent Mounts
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (24)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The document exposes live-looking SSH credentials, a gateway token, and an API key directly in the skill. Anyone with access to the skill can use these secrets to access the remote server, gateway, and model provider account, enabling unauthorized administration, data exposure, service abuse, and lateral movement.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The skill instructs execution of a destructive shell command that deletes pairing state inside the container. In the context of a remote admin skill with hardcoded root access, this increases risk because operators or automated agents could reset trust relationships without sufficient safeguards, disrupting access control and potentially enabling re-pairing abuse.
- Content
bash # 清除旧配对（谨慎使用） docker exec openclaw sh -c 'rm -f /home/node/.openclaw/devices.json' docker restart openclaw
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The document directly embeds a live public IP, root username, plaintext SSH password, and a gateway token. Exposing active credentials in documentation enables unauthorized access to infrastructure and browser-control services, and the skill context makes this more dangerous because it gives an attacker everything needed to authenticate and operate the environment immediately.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
These instructions enable remote root administration over SSH, including package installation inside a container, process execution, and service management. In context, this is especially dangerous because the same document also exposes the credentials needed to perform those actions, turning the guide into an actionable path for full remote control.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file is presented as a skill document, but it operationalizes full remote administration: package installation, detached process startup, Docker lifecycle management, remote file sync, and deletion of pairing state. With no manifest-defined purpose or scope boundaries, these capabilities are broader than can be justified from an unknown-purpose skill context.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The skill instructs use of
npx @openclaw/browser-relaywithout pinning an exact package version. This creates a supply-chain risk because a future malicious or compromised package release could be fetched and executed on the remote server with elevated privileges.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ssh root@47.115.54.84 # 2. 创建配置目录 mkdir -p /opt/openclaw/{config,workspace,memory,skills,logs} # 3. 上传配置文件 (从本地) scp ~/.openclaw/workspace/skills/aliyun_openclaw/remote_config.json root@47.115.54.84:/opt/openclaw/config/openclaw.json
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
The deployment uses a mutable container reference ending in
:latest, which static analysis summarized at thedocker run -dline. Pulling or running mutable images allows unreviewed upstream changes to enter production, increasing the risk of compromised or breaking images being deployed to a root-managed remote host.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documented commands stop and remove the container without an explicit warning immediately adjacent to the commands about service downtime and potential operational impact. In an automation-oriented skill, users may execute these commands quickly, causing avoidable interruption or accidental removal of a running service.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 99% confidence
- Finding
The command explicitly pulls
openclaw:latest, a mutable tag. This exposes the environment to supply-chain compromise or unexpected behavior changes because the artifact retrieved in the future may differ from the one originally tested.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill documents deletion of
devices.json, which irreversibly clears pairing state, but the warning is too minimal for a destructive action affecting authentication relationships. This can force re-pairing, disrupt connected clients, and potentially create opportunities for unintended or unauthorized re-enrollment workflows.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The guide instructs users to kill processes and restart the relay without warning about disruption, terminated sessions, or potential interference with other users. In an operational environment this can cause avoidable denial of service or accidental interruption, especially since the actions are performed remotely against a shared service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The guide encourages screenshots, page interaction, and browser control without warning that page contents, authentication state, or personal data may be captured or manipulated. Because this skill is specifically about remote browser control, the omission is more dangerous than usual: it normalizes actions that can directly expose sensitive user information and active sessions.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
检查 SSH 隧道：
bash ps aux | grep "ssh.*18792" curl -s -o /dev/null -w "%{http_code}" http://localhost:18792/重新建立隧道：
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The skill documentation is entirely written in Chinese and does not indicate any language choice or opt-in. Under the policy, forcing a specific language without user choice can be a natural-language policy violation unless the locale restriction is clearly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
All headings, instructions, and user command examples are written exclusively in Chinese, including the chat prompts the user is expected to send. Because no language option, translation note, or documented locale constraint is provided, this can be a language/locale policy issue under the natural-language policy rule.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The config fixes the channel domain to "feishu", which implies a platform and locale-specific deployment context, but the file provides no indication that users can opt into or change that language/locale environment. Under the policy rule, locale-specific constraints should be optional or clearly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 2% confidence
- Finding
After reviewing the JSON manifest, there is no natural-language instruction, comment, or config value that forces a specific language or locale. Because SQP-3 is limited to natural-language policy violations such as forced language without opt-in, this file does not present a confident violation.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:45