中文 EN
开始可信审查
安全决策报告

file-transfer-thru-local-workspace

The skill exposes Gateway credentials in install-time environment variables and systemd service files, contradicting its own security claim that credentials are not hardcoded. Undeclared credential reading from ~/.openclaw/openclaw.json and binding to 0.0.0.0 on all interfaces compound the risk.

安装决策优先 来源: ClawHub 扫描时间: 2026/7/28
文件 9
IOC 3
越权项 2
发现 7
最直接的威胁证据
01
User installs the skill via install.sh or openclaw skills install 初始入口 · install.sh
02
install.sh reads ~/.openclaw/openclaw.json to extract gateway token/password using grep pattern matching 权限提升 · install.sh
03
install.sh embeds the credential as GATEWAY_AUTH_VALUE env var and creates systemd service file with it in plaintext 权限提升 · install.sh

为什么得出这个结论

2/4 个维度触发
阻止
声明与实际能力

发现 2 项声明之外的能力或越权行为。

复核
隐藏执行与外联

提取到 3 个一般风险产物，需要结合上下文判断。

阻止
攻击链与高危发现

报告包含 4 步攻击链，另有 3 项高危或严重发现。

复核
依赖与供应链卫生

发现 1 项需要关注的依赖或供应链线索。

攻击链

01
User installs the skill via install.sh or openclaw skills install

初始入口 · install.sh:1

02
install.sh reads ~/.openclaw/openclaw.json to extract gateway token/password using grep pattern matching

权限提升 · install.sh:42

03
install.sh embeds the credential as GATEWAY_AUTH_VALUE env var and creates systemd service file with it in plaintext

权限提升 · install.sh:51

04
Credential visible in process list (ps eww), systemd service file on disk, and nohup invocations — any local user or malware can read it

最终危害 · install.sh:68

风险分是怎么被拉高的

Credential exposure in install script +25

install.sh reads gateway token/password from ~/.openclaw/openclaw.json and passes it as GATEWAY_AUTH_VALUE env var, which ends up in process list and systemd service files

SKILL.md security claim violated +10

SKILL.md states '认证值不在技能包中硬编码' and '不在日志中明文显示', but the install script embeds the credential in systemd Environment= directive

Undeclared credential file access +10

Both install.sh and upload-server.js read ~/.openclaw/openclaw.json for gateway auth token/password — not declared in permissions or docs

Network exposure to all interfaces +5

Server listens on 0.0.0.0:15170 rather than localhost only, expanding attack surface if credentials are weak or missing

最关键的证据

高危 凭证窃取

Gateway credentials embedded in systemd service and process environment

install.sh reads the gateway token/password from ~/.openclaw/openclaw.json and embeds it in the GATEWAY_AUTH_VALUE environment variable, which appears in /etc/systemd/system/openclaw-upload.service and in process listings (ps eww). This violates SKILL.md's explicit claim that credentials are not stored in the skill package.

install.sh:68
Use a token file or secret manager instead of passing credentials as environment variables. Alternatively, have the Node.js server read the config file directly without shell-level exposure.
高危 凭证窃取

Undeclared credential file access

Both install.sh (lines 42-49) and upload-server.js (lines 31-38) read ~/.openclaw/openclaw.json to extract gateway.auth.token or gateway.auth.password. This is not declared in package.json permissions or SKILL.md capabilities.

install.sh:42
Declare filesystem:READ access to ~/.openclaw/ in the skill's permission model. Alternatively, read credentials only through a secure OS-level secret store.
高危 文档欺骗

SKILL.md security claim contradicted by implementation

SKILL.md explicitly states '✅ 认证值不在技能包中硬编码' and '✅ 认证值不在日志中明文显示'. However, install.sh embeds the gateway credential in a systemd service file (Environment=GATEWAY_AUTH_VALUE=...) which is stored on disk in plaintext.

SKILL.md:126
Update SKILL.md to honestly document that credentials are stored in systemd service environment variables and may appear in process listings.
中危 权限提升

Service created with elevated privileges if run as root

install.sh runs as the current USER and creates a systemd service. If executed as root, the service runs as root, giving the web-accessible upload service root-level file access on the system.

install.sh:52
Do not run the upload service as root. Ensure the install script uses a non-privileged user (e.g., User=openclaw) for the systemd service.
中危 敏感访问

Hardcoded workspace path /home/admin

upload-server.js defaults WORKSPACE to '/home/admin/.openclaw/workspace' rather than using HOME environment variable. This could cause issues on non-admin systems and indicates a possible default/development artifact.

src/upload-server.js:13
Use process.env.HOME to construct the default path: `${process.env.HOME || '/home/admin'}/.openclaw/workspace`
低危 文档欺骗

Security documentation references non-existent files

SKILL.md references SECURITY-AUDIT.md and docs/AUTH-COMPATIBILITY.md in its directory structure, but these files do not exist in the package.

SKILL.md:161
Include the referenced security audit documentation or remove the references.
低危 敏感访问

Skill packages directory accessible via web UI

The skill browses and zips all installed skill packages under ~/.openclaw/workspace/skills/ via the web UI. While authenticated, this gives any web user read access to all installed skill code including their SKILL.md files and any secrets stored within.

src/upload-server.js:78
Limit skill browsing to explicitly authorized users or scopes. Document that users should not install sensitive credentials inside skill packages.

声明能力 vs 实际能力

文件系统 阻止
声明 WRITE:workspace
→
推断 WRITE:workspace + READ:openclaw_config
install.sh:42-49 reads ~/.openclaw/openclaw.json; upload-server.js:31 reads ~/.openclaw/openclaw.json
命令执行 阻止
声明 NONE
→
推断 WRITE:subprocess
install.sh:68-75 pipes credential as env var to nohup node; install.sh:51-66 creates systemd service with Environment=GATEWAY_AUTH_VALUE=${AUTH_VALUE}
网络访问 通过
声明 listen
→
推断 listen:all_interfaces
upload-server.js:337 server.listen(PORT, '0.0.0.0')

可疑产物与外联

中危 外部 URL
http://127.0.0.1:15170/

SKILL.md:228

中危 外部 URL
https://clawhub.ai/user/chengwang86

skill-card.md:7

中危 外部 URL
https://clawhub.ai/chengwang86/file-transfer-thru-local-workspace

skill-card.md:29

依赖与供应链

包名版本来源漏洞备注
node (runtime) >=14.0.0 system 否 Runtime dependency; no npm packages installed
zip (system binary) any system 否 Used for skill package zipping; called via spawn

文件构成

9 个文件 · 1951 行
HTML 1 个文件 · 688 行JavaScript 1 个文件 · 511 行Markdown 2 个文件 · 431 行Shell 2 个文件 · 183 行JSON 3 个文件 · 138 行
需关注文件 · 4
src/upload-server.js JavaScript · 511 行
Hardcoded workspace path /home/admin · Skill packages directory accessible via web UI
SKILL.md Markdown · 389 行
SKILL.md security claim contradicted by implementation · Security documentation references non-existent files · http://127.0.0.1:15170/
install.sh Shell · 138 行
Gateway credentials embedded in systemd service and process environment · Undeclared credential file access · Service created with elevated privileges if run as root
skill-card.md Markdown · 42 行
https://clawhub.ai/user/chengwang86 · https://clawhub.ai/chengwang86/file-transfer-thru-local-workspace
其他文件 · upload.html · clawhub.json · uninstall.sh · package.json · _meta.json

安全亮点

File upload includes filename sanitization to prevent path traversal attacks
Authentication is enforced on all sensitive API endpoints (upload, delete, download, skill list)
Token-based authentication is used to prevent unauthorized file access
CORS headers are properly configured
No base64-encoded payloads, obfuscation, or suspicious execution patterns
No external network requests or data exfiltration observed
Uses system zip binary for packaging rather than pulling external tools
No reverse shell, C2 communication, or credential exfiltration to external servers