Skill Trust Decision
file-transfer-thru-local-workspace
The skill exposes Gateway credentials in install-time environment variables and systemd service files, contradicting its own security claim that credentials are not hardcoded. Undeclared credential reading from ~/.openclaw/openclaw.json and binding to 0.0.0.0 on all interfaces compound the risk.
Most direct threat evidence
01
User installs the skill via install.sh or openclaw skills install Entry · install.sh
02
install.sh reads ~/.openclaw/openclaw.json to extract gateway token/password using grep pattern matching Escalation · install.sh
03
install.sh embeds the credential as GATEWAY_AUTH_VALUE env var and creates systemd service file with it in plaintext Escalation · install.sh
Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
2 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
3 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 4 attack-chain steps and 3 severe findings.
Review
Dependencies and supply chain hygiene
1 dependency or supply-chain issues need attention.
Attack Chain
01
User installs the skill via install.sh or openclaw skills install
Entry · install.sh:1
02
install.sh reads ~/.openclaw/openclaw.json to extract gateway token/password using grep pattern matching
Escalation · install.sh:42
03
install.sh embeds the credential as GATEWAY_AUTH_VALUE env var and creates systemd service file with it in plaintext
Escalation · install.sh:51
04
Credential visible in process list (ps eww), systemd service file on disk, and nohup invocations — any local user or malware can read it
Impact · install.sh:68
What drove the risk score up
Credential exposure in install script +25
install.sh reads gateway token/password from ~/.openclaw/openclaw.json and passes it as GATEWAY_AUTH_VALUE env var, which ends up in process list and systemd service files
SKILL.md security claim violated +10
SKILL.md states '认证值不在技能包中硬编码' and '不在日志中明文显示', but the install script embeds the credential in systemd Environment= directive
Undeclared credential file access +10
Both install.sh and upload-server.js read ~/.openclaw/openclaw.json for gateway auth token/password — not declared in permissions or docs
Network exposure to all interfaces +5
Server listens on 0.0.0.0:15170 rather than localhost only, expanding attack surface if credentials are weak or missing
Most important evidence
High Credential Theft
Gateway credentials embedded in systemd service and process environment
install.sh reads the gateway token/password from ~/.openclaw/openclaw.json and embeds it in the GATEWAY_AUTH_VALUE environment variable, which appears in /etc/systemd/system/openclaw-upload.service and in process listings (ps eww). This violates SKILL.md's explicit claim that credentials are not stored in the skill package.
install.sh:68 Use a token file or secret manager instead of passing credentials as environment variables. Alternatively, have the Node.js server read the config file directly without shell-level exposure.
High Credential Theft
Undeclared credential file access
Both install.sh (lines 42-49) and upload-server.js (lines 31-38) read ~/.openclaw/openclaw.json to extract gateway.auth.token or gateway.auth.password. This is not declared in package.json permissions or SKILL.md capabilities.
install.sh:42 Declare filesystem:READ access to ~/.openclaw/ in the skill's permission model. Alternatively, read credentials only through a secure OS-level secret store.
High Doc Mismatch
SKILL.md security claim contradicted by implementation
SKILL.md explicitly states '✅ 认证值不在技能包中硬编码' and '✅ 认证值不在日志中明文显示'. However, install.sh embeds the gateway credential in a systemd service file (Environment=GATEWAY_AUTH_VALUE=...) which is stored on disk in plaintext.
SKILL.md:126 Update SKILL.md to honestly document that credentials are stored in systemd service environment variables and may appear in process listings.
Medium Priv Escalation
Service created with elevated privileges if run as root
install.sh runs as the current USER and creates a systemd service. If executed as root, the service runs as root, giving the web-accessible upload service root-level file access on the system.
install.sh:52 Do not run the upload service as root. Ensure the install script uses a non-privileged user (e.g., User=openclaw) for the systemd service.
Medium Sensitive Access
Hardcoded workspace path /home/admin
upload-server.js defaults WORKSPACE to '/home/admin/.openclaw/workspace' rather than using HOME environment variable. This could cause issues on non-admin systems and indicates a possible default/development artifact.
src/upload-server.js:13 Use process.env.HOME to construct the default path: `${process.env.HOME || '/home/admin'}/.openclaw/workspace`
Low Doc Mismatch
Security documentation references non-existent files
SKILL.md references SECURITY-AUDIT.md and docs/AUTH-COMPATIBILITY.md in its directory structure, but these files do not exist in the package.
SKILL.md:161 Include the referenced security audit documentation or remove the references.
Low Sensitive Access
Skill packages directory accessible via web UI
The skill browses and zips all installed skill packages under ~/.openclaw/workspace/skills/ via the web UI. While authenticated, this gives any web user read access to all installed skill code including their SKILL.md files and any secrets stored within.
src/upload-server.js:78 Limit skill browsing to explicitly authorized users or scopes. Document that users should not install sensitive credentials inside skill packages.
Declared capability vs actual capability
Filesystem Block
Declared WRITE:workspace
→ Inferred WRITE:workspace + READ:openclaw_config
install.sh:42-49 reads ~/.openclaw/openclaw.json; upload-server.js:31 reads ~/.openclaw/openclaw.json Shell Block
Declared NONE
→ Inferred WRITE:subprocess
install.sh:68-75 pipes credential as env var to nohup node; install.sh:51-66 creates systemd service with Environment=GATEWAY_AUTH_VALUE=${AUTH_VALUE} Network Pass
Declared listen
→ Inferred listen:all_interfaces
upload-server.js:337 server.listen(PORT, '0.0.0.0') Suspicious artifacts and egress
Medium External URL
http://127.0.0.1:15170/ SKILL.md:228
Medium External URL
https://clawhub.ai/user/chengwang86 skill-card.md:7
Medium External URL
https://clawhub.ai/chengwang86/file-transfer-thru-local-workspace skill-card.md:29
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| node (runtime) | >=14.0.0 | system | No | Runtime dependency; no npm packages installed |
| zip (system binary) | any | system | No | Used for skill package zipping; called via spawn |
File composition
9 files · 1951 lines
HTML 1 files · 688 linesJavaScript 1 files · 511 linesMarkdown 2 files · 431 linesShell 2 files · 183 linesJSON 3 files · 138 lines
Files of concern · 4
src/upload-server.js Hardcoded workspace path /home/admin · Skill packages directory accessible via web UI
SKILL.md SKILL.md security claim contradicted by implementation · Security documentation references non-existent files · http://127.0.0.1:15170/
install.sh Gateway credentials embedded in systemd service and process environment · Undeclared credential file access · Service created with elevated privileges if run as root
skill-card.md https://clawhub.ai/user/chengwang86 · https://clawhub.ai/chengwang86/file-transfer-thru-local-workspace
Other files · upload.html · clawhub.json · uninstall.sh · package.json · _meta.json
Security positives
File upload includes filename sanitization to prevent path traversal attacks
Authentication is enforced on all sensitive API endpoints (upload, delete, download, skill list)
Token-based authentication is used to prevent unauthorized file access
CORS headers are properly configured
No base64-encoded payloads, obfuscation, or suspicious execution patterns
No external network requests or data exfiltration observed
Uses system zip binary for packaging rather than pulling external tools
No reverse shell, C2 communication, or credential exfiltration to external servers