Security audit

Openclaw Mesh

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a disclosed P2P mesh tool, but its optional gateway and WAN admin features add credential, persistence, and exposure risks that need review before installation.

Install only if you need P2P mesh or gateway behavior. Keep the gateway bound to localhost unless you deliberately deploy it behind hardened TLS and authentication, set your own strong GATEWAY_ADMIN_TOKEN and PSK or TrustStore, avoid sending sensitive prompts or files to untrusted peers, and treat generated PSKs or browser-stored admin tokens as secrets that may need rotation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The documented purpose emphasizes local/LAN mesh connectivity with explicit consent, but the described behavior expands into a much broader remote service surface: public HTTP endpoints, WAN relay/server roles, API-key administration, persistent local databases, hardware/system inspection, and NAT/UPnP exposure. That mismatch is dangerous because users may authorize the skill expecting limited peer delegation while actually enabling a remotely reachable control plane and additional data collection/storage capabilities.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The architecture document describes a FastAPI gateway, API key issuance, external execution endpoints, and administrative node-control features that materially expand the capability surface beyond simple mesh connectivity. In a security review, undocumented or under-scoped control planes are dangerous because they normalize exposing remote execution and admin functionality that may not be expected by users evaluating a P2P mesh skill.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: Bitcoin payment verification and key-lifecycle logic are unrelated to the stated purpose of local/LAN/WAN mesh connectivity and introduce a monetization and entitlement subsystem with additional trust and attack surface. Even as documentation, this signals capability creep into billing and admin workflows that can expose users to unexpected network activity, secret management, and operational risk.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The code claims keys are validated without storing them in cleartext, but the schema still includes a plaintext `key` column, and lookup/update paths fall back to matching `key = ?`. That contradiction means API secrets may be stored or accepted in recoverable form, increasing the blast radius of database disclosure and weakening secret-handling guarantees in a networked mesh component that can expose local tools and remote delegation.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This code exposes a public-facing API key issuance service and hosted inference gateway that materially exceeds the declared skill purpose of connecting to local/LAN P2P meshes. That hidden expansion of capability increases attack surface, enables unauthorized service exposure, and can cause operators to unknowingly run an internet-reachable API broker that handles prompts, files, and tool outputs.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The file includes undocumented WAN administration, cluster status, metrics, OpenAI-compatible chat serving, and remote node activation features that go well beyond a mesh connector. In a security-sensitive agent skill, this kind of capability mismatch is dangerous because it can silently expose administrative control planes and data-bearing inference endpoints to networks the user did not intend to trust.

Description-Behavior Mismatch

Medium

Confidence: 88% confidence
Finding: When the node is exposed beyond localhost and no authentication material is configured, it silently generates a new PSK at runtime. This changes the security model from explicit operator-configured trust to implicit auto-provisioning, which can undermine consent and operational awareness in a mesh component that may expose prompts, files, tools, and delegated execution to remote peers.

Context-Inappropriate Capability

High

Confidence: 89% confidence
Finding: This script provides privileged API key lifecycle operations (create, revoke, inspect, list) that are not aligned with the stated purpose of a mesh-connection skill. In a skill that already handles remote peer connectivity and possible transmission of prompts, files, memory, and tool results, embedding local credential administration broadens the trust boundary and creates a high-risk capability that could be abused by an agent or operator to mint or revoke service access without clear justification.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The manifest describes peer mesh connectivity, but the code implements credential provisioning and revocation for OpenClawMesh API keys, which is a materially different and more sensitive function. This mismatch is dangerous because users or automated systems may grant the skill network-related permissions while overlooking that it can administer credentials, enabling unauthorized account creation, persistence, service abuse, or denial of service through revocation.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The document describes agent discovery, task delegation, skill sharing, and remote execution across LAN/WAN, but the risk to prompts, files, memory, tool outputs, and local resources is not prominently emphasized at the start of the operational flow. In this skill context, remote delegation is inherently sensitive because peers may receive and process user data or invoke exposed capabilities, so weak warnings increase the chance of unsafe deployment.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The gateway section advertises public inference access, free-key generation, and administrative WAN toggling without a prominent warning about the consequences of exposing a control plane and external execution interface. In a mesh agent environment, such features can lead to unauthorized use, privacy loss, data exfiltration, or node reconfiguration if operators enable them without fully understanding the risk.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The delegate/call paths transmit arbitrary task payloads to remote peers and automatically route execution across the mesh, but this file provides no enforcement point for explicit per-action user notice or consent before data leaves the local agent. In this skill's context, payloads may include prompts, files, memory, media, and tool results, so silent delegation can cause significant confidentiality and trust-boundary violations even if the feature is intended.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Starting mDNS discovery and supporting later health/skill introspection of LAN peers expands network visibility and can probe nearby nodes, yet this code contains no user-facing warning or runtime consent control at the point discovery is activated. In a P2P agent mesh, undisclosed scanning and enumeration are security-relevant because they reveal local network metadata and may connect the user to untrusted peers.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The distributed pipeline sends `prompt` and full activation state inside `current_activation`/`stage_payload` to remote nodes via `delegate_fn`, which can expose sensitive prompts, derived model state, and potentially intermediate data to peers on the mesh. In this skill’s context, remote delegation across LAN/WAN peers materially increases risk because peers may be less trusted, and the code shown has no in-function minimization, redaction, trust enforcement, or explicit runtime consent check before transmission.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The admin token is stored in localStorage, which is long-lived and readable by any JavaScript executing in the origin, including future XSS payloads or compromised same-origin content. In this portal, that token can authorize WAN exposure actions, so theft could let an attacker reconfigure the node for broader network access.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The code logs the auto-generated PSK in plaintext with a warning message. Any party with access to application logs, centralized logging backends, terminal history, or support bundles can recover the shared secret and authenticate as a trusted peer, gaining remote access to exposed mesh skills.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script sends user-provided payloads to remote mesh peers via delegate/call_stream without any inline confirmation, warning, or validation at the point of transmission. In this skill's context, remote traffic may include prompts, files, memory, media, and tool results, so invoking this helper can silently exfiltrate sensitive local data to LAN/WAN peers if the caller or user misunderstands where data is going.

Known Vulnerable Dependency: uvicorn — 4 advisory(ies): CVE-2020-7694 (Log injection in uvicorn); CVE-2020-7695 (HTTP response splitting in uvicorn); CVE-2020-7694 (This affects all versions of package uvicorn. The request logger provided by the) +1 more

High

Category: Supply Chain
Confidence: 88% confidence
Finding: This is a duplicate finding for the same uvicorn declaration and should be treated the same as the earlier result. Because this skill explicitly supports network-facing gateway functionality and peer communication, dependency weaknesses in the HTTP server component are more security-relevant than in a purely local-only package.

Known Vulnerable Dependency: uvicorn — 4 advisory(ies): CVE-2020-7694 (Log injection in uvicorn); CVE-2020-7695 (HTTP response splitting in uvicorn); CVE-2020-7694 (This affects all versions of package uvicorn. The request logger provided by the) +1 more

High

Category: Supply Chain
Confidence: 88% confidence
Finding: This is a duplicate finding for the same uvicorn declaration and should be treated the same as the earlier result. Because this skill explicitly supports network-facing gateway functionality and peer communication, dependency weaknesses in the HTTP server component are more security-relevant than in a purely local-only package.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.