baton 安全扫描报告 — 低风险 | ClawSafe

20 /100

baton

Baton — AI orchestrator for OpenClaw. Routes every request to subagents. Never does work itself.

A legitimate OpenClaw AI orchestrator with no malicious behavior; the primary finding is that filesystem WRITE permissions are not declared in SKILL.md metadata despite the install script and task-manager performing file writes to ~/.openclaw.

技能名称baton

分析耗时49.2s

引擎pi

✓

可以安装

Add filesystem:WRITE to the declared permissions in SKILL.md metadata to align with the install script and task-manager file write operations.

安全发现 2 项

严重性	安全发现	位置
低危	Filesystem WRITE not declared in permissions The SKILL.md metadata declares read:config, read:agents, exec:scripts, read:env but install.sh performs filesystem writes (BOOT.md, AGENTS.md, baton directory creation) and task-manager.js writes task files. This is a doc-to-code mismatch. `permissions: [read:config, read:agents, exec:scripts, read:env]` → Add filesystem:WRITE to metadata permissions. The writes are legitimate (orchestrator state management in ~/.openclaw) but should be declared.	`SKILL.md:1`
提示	execSync runs openclaw CLI commands probe-limits.js uses execSync to run 'openclaw models list --json' and 'openclaw models status --json'. This is shell execution but scoped to the OpenClaw ecosystem CLI. `execSync('openclaw models list --json 2>/dev/null', {encoding:'utf8', timeout:30000})` → Covered by exec:scripts permission. Consider declaring shell:WRITE explicitly if execSync is considered shell access.	`scripts/probe-limits.js:87`

资源类型	声明权限	推断权限	状态	证据
文件系统	`NONE`	`READ`	✓ 一致	probe-limits.js reads openclaw.json, agents/<id>/agent/models.json; task-manager…
文件系统	`NONE`	`WRITE`	✗ 越权	install.sh writes BOOT.md and AGENTS.md; task-manager.js writes task/archive/tem…
命令执行	`NONE`	`WRITE`	✓ 一致	probe-limits.js line 87: execSync('openclaw models list --json'); install.sh lin…
网络访问	`NONE`	`READ`	✓ 一致	probe-limits.js probeProvider() makes HTTP GET to provider rate-limit APIs using…
环境变量	`READ`	`READ`	✓ 一致	resolveApiKey() reads env vars for API keys, used only for provider limit querie…

目录结构

13 文件 · 79.2 KB · 1963 行

JavaScript 2f · 1103L Markdown 8f · 701L Shell 1f · 118L JSON 2f · 41L

├─ ▾ 📁 references

│ ├─ 📝 model-profiles.md Markdown 37L · 1.3 KB

│ ├─ 📝 onboarding-guide.md Markdown 111L · 3.4 KB

│ ├─ 📝 orchestration.md Markdown 266L · 9.1 KB

│ ├─ 📝 resilience.md Markdown 80L · 2.9 KB

│ ├─ 📝 task-schema.md Markdown 65L · 2.7 KB

│ └─ 📝 task-types.md Markdown 24L · 946 B

├─ ▾ 📁 scripts

│ ├─ 🔧 install.sh Shell 118L · 5.1 KB

│ ├─ 📜 probe-limits.js JavaScript 412L · 21.9 KB

│ ├─ 📋 provider-probes.json JSON 32L · 1.7 KB

│ └─ 📜 task-manager.js JavaScript 691L · 23.7 KB

├─ 📝 BOOT.md Markdown 26L · 1.5 KB

├─ 📋 package.json JSON 9L · 185 B

└─ 📝 SKILL.md Markdown 92L · 4.8 KB

安全亮点

✓ API keys are resolved from environment or config and used only for provider rate-limit API queries — never exfiltrated

✓ Comprehensive output sanitisation (sanitiseOutput) redacts apiKey, token, secret, password fields before any stdout output

✓ Consent flow in BOOT.md step 2 requires user approval before any config scanning or script execution

✓ No base64 decoding, no eval(), no reverse shells, no direct IP exfiltration

✓ All filesystem writes are scoped to ~/.openclaw/ which is the intended state directory for this orchestrator

✓ No access to ~/.ssh, ~/.aws, .env, or other sensitive credential paths

✓ No hidden functionality — all scripts are documented, readable, and their purposes are clear

✓ Data-driven probe configuration via provider-probes.json — no hardcoded API endpoints or values