clawdbot-security-scanner 1.0.0

Security scanner for Clawdbot configuration and state.

Clawdbot Security Scanner

A comprehensive security auditing tool for Clawdbot installations. Includes detailed vulnerability report.

Quick start

To run the scanner use the commands below.

Option A: shell script

These scripts will install uv if it is missing.

• macOS / Linux:

  ./run-scanner.sh
  # or
  bash run-scanner.sh
  

• Windows (PowerShell):

  .\run-scanner.ps1
  # or (if execution policy blocks it)
  powershell -ExecutionPolicy Bypass -File .\run-scanner.ps1
  

Option B: run directly with uv

The scanner is Python-based and uses uv (it installs dependencies automatically).

1. Install uv (one-time): https://astral.sh/uv
2. Run the scanner:

   ./scan.py
   # Windows or non-executable script
   uv run scan.py
   

3. Common options:

   ./scan.py --config ~/.clawdbot/clawdbot.json
   ./scan.py --format pretty
   ./scan.py --format markdown
   ./scan.py --format json
   

Option C: run without cloning (pipx / uvx)

One-shot run (no install):

pipx run clawdbot-security-scanner
# or
uvx clawdbot-security-scanner

Install once (adds a clawdbot-security-scanner command):

pipx install clawdbot-security-scanner
clawdbot-security-scanner --config ~/.clawdbot/clawdbot.json
# alias
clawdbot-scan --config ~/.clawdbot/clawdbot.json

Report Metadata

• Report date: 2026-01-26
• Report version: 1.0
• Scanner: security-scanner/scan.py
• Checks: 37
• Method: Static analysis of configuration and state directory permissions
• Generated by: AI Agent (GPT-5.2 Codex, High)

Executive Summary

Overall risk rating: High. The scanner identifies multiple critical and high‑severity misconfigurations that can expose the gateway, bypass authentication, or allow command execution. The most severe risks are public exposure of the gateway or control plane, webhook signature bypass in voice integrations, and plaintext secrets in configuration files.

Top priority fixes (P0):

1. Disable Tailscale Funnel on gateways (gateway.tailscale.mode=funnel).
2. Ensure browser control is loopback‑bound or protected by a control token.
3. Remove plaintext secrets from config files (Nostr, Matrix, MS Teams, Voice‑call, Nextcloud Talk, Tlon).
4. Disable insecure Control UI auth (gateway.controlUi.allowInsecureAuth=true).
5. Ensure system.run is denied for nodes when the nodes tool is enabled.

Scope & Methodology

In scope:

• Clawdbot configuration (clawdbot.json) and related state directories.
• Authentication policies, tool allowlists/denylists, sandbox settings.
• Channel DM and group allowlist policy enforcement.
• Extension/plugin configuration (Matrix, Nostr, Voice, Teams, etc.).

Out of scope:

• Runtime network testing, active exploitation, fuzzing, or penetration testing.
• UI/UX security (CSRF/XSS) beyond config‑based flags.
• Infrastructure hardening (OS‑level ACLs beyond file perms in state dirs).

Methodology:

• Static review of security‑sensitive code paths.
• Configuration/permission checks encoded as deterministic scanner rules.
• Evidence collection via config and state directory inspection only.

Severity Model

Severity	Impact	Likelihood
Critical	Full compromise, public exposure, or unauthenticated control	High if misconfigured
High	Auth bypass, command execution, or credential exposure	Moderate‑high
Medium	Cross‑channel leakage, SSRF, or elevated access	Moderate
Low	Reduced isolation or unintended capability	Low‑moderate

Findings Index

Check ID	Title	Severity (on fail)	Scope
tailscale-serve-bypass	Tailscale Serve bypasses gateway token/password	Medium	Gateway Core & Authentication
tailscale-funnel	Gateway exposed via Tailscale Funnel	Critical	Gateway Core & Authentication
control-ui-insecure	Control UI allows insecure auth	High	Gateway Core & Authentication
plaintext-gateway	Plaintext gateway traffic on non-loopback	High	Gateway Core & Authentication
token-reuse	Gateway token reused across surfaces	Medium	Gateway Core & Authentication
secret-perms	Secrets stored on disk with loose perms	High	Gateway Core & Authentication
gateway-token-strength	Weak or short gateway token	Medium (High if missing)	Gateway Core & Authentication
device-token-rotation	Long-lived device auth tokens	Medium	Gateway Core & Authentication
dm-policy-open	Public DMs enabled (dmPolicy=open)	High	Channel DM Policies & Allowlists
allowfrom-wildcard	Wildcard allowFrom permits any sender	High	Channel DM Policies & Allowlists
group-dm-open	Group DMs enabled without allowlist	Medium	Channel DM Policies & Allowlists
group-allowlist-wildcard	Group allowlist wildcard opens group senders	High	Channel DM Policies & Allowlists
discord-group-allowlist-no-channels	Discord allowlist without channel restrictions	Medium	Channel DM Policies & Allowlists
dm-scope-main-multi	Shared DM session scope across multiple senders	Medium	Channel DM Policies & Allowlists
sandbox-mode-not-all	Sandbox disabled for main sessions	High	Agent Sandbox & Tool Isolation
tool-allowlist-plugin-only	Tool allowlist ignored (plugin-only entries)	Medium	Agent Sandbox & Tool Isolation
sandbox-image-auto-allow	Sandbox tool allowlist still permits image	Low	Agent Sandbox & Tool Isolation
browser-control-exposed	Browser control server exposed without token	Critical	Agent Sandbox & Tool Isolation
sandbox-host-browser-control	Sandbox can control host browser	High	Agent Sandbox & Tool Isolation
cron-system-event-injection	Cron tool can inject system events	High	Agent Sandbox & Tool Isolation
hooks-workspace-injection	Workspace hooks writable by agents	High	Agent Sandbox & Tool Isolation
extension-dm-policy-open	Extension channel DMs open (dmPolicy=open)	High	Plugin/Extension Security
extension-allowfrom-wildcard	Extension wildcard allowFrom permits any sender	High	Plugin/Extension Security
extension-group-policy-open	Extension channel groups open (groupPolicy=open)	Medium	Plugin/Extension Security
nostr-private-key-config	Nostr private key stored in config	Critical	Plugin/Extension Security
matrix-password-config	Matrix password stored in config	High	Plugin/Extension Security
msteams-app-password-config	MS Teams app password stored in config	High	Plugin/Extension Security
voice-call-skip-signature	Voice-call webhook signature verification skipped	Critical	Plugin/Extension Security
voice-call-inbound-open	Voice-call inbound policy open	High	Plugin/Extension Security
voice-call-credentials-config	Voice-call provider credentials in config	High	Plugin/Extension Security
voice-call-ngrok-free-tier	Voice-call ngrok free tier signature bypass	Medium	Plugin/Extension Security
nextcloud-talk-secret-config	Nextcloud Talk bot secret in config	Medium	Plugin/Extension Security
tlon-code-config	Tlon/Urbit access code in config	Medium	Plugin/Extension Security
whatsapp-creds-perms	WhatsApp Web credentials readable by other users	High	Web Interfaces, Nodes & Integrations
nodes-system-run	Nodes tool can invoke system.run	High	Web Interfaces, Nodes & Integrations
media-url-prefer	Media understanding prefers URL attachments	Medium	Web Interfaces, Nodes & Integrations
memory-lancedb-exposure	Memory (LanceDB) data shared across senders	Medium	Web Interfaces, Nodes & Integrations

---

Detailed Findings by Scope

Scope 1: Gateway Core & Authentication Security

Files Examined:

• src/gateway/server/
• src/gateway/server-methods/
• src/gateway/protocol/
• src/security/
• src/infra/device-auth-store.ts
• src/infra/device-pairing.ts
• src/infra/tls/
• src/infra/tailscale.ts
• src/infra/ssh-tunnel.ts
• src/config/ (auth-related schemas)

Research Questions:

• What happens with misconfigured gateway.auth.mode?
• Are there bypass paths when gateway.bind is not loopback?
• How does Tailscale Serve/Funnel auth interact with password requirements?
• Device pairing token security and expiration
• TLS certificate validation gaps

Findings (expand for details):

Tailscale Serve identity bypass (`tailscale-serve-bypass`) — Medium

• Misconfiguration: gateway.tailscale.mode=serve with gateway.auth.allowTailscale=true
• Attack vector: Tailnet users (or local header spoofing) can authenticate without the gateway token/password.
• Root cause: Serve mode accepts Tailscale identity headers as auth when allowTailscale=true, skipping shared auth.
• Mitigation: Set gateway.auth.allowTailscale=false or disable Tailscale Serve.

Gateway exposed via Tailscale Funnel (`tailscale-funnel`) — Critical

• Misconfiguration: gateway.tailscale.mode=funnel
• Attack vector: Public internet access; brute-force risk on shared password.
• Root cause: Funnel publishes the gateway to the public internet with shared auth.
• Mitigation: Prefer tailscale.mode=serve or set a strong password and restrict access.

Control UI insecure auth (`control-ui-insecure`) — High

• Misconfiguration: gateway.controlUi.allowInsecureAuth=true
• Attack vector: Token-only auth over HTTP can be intercepted; device identity is skipped.
• Root cause: Insecure auth bypasses device identity checks and relies on HTTP token only.
• Mitigation: Disable allowInsecureAuth or serve Control UI over HTTPS.

Plaintext gateway traffic (`plaintext-gateway`) — High

• Misconfiguration: gateway.bind != loopback with gateway.tls.enabled=false and/or gateway.remote.url uses ws://
• Attack vector: Network sniffing/MITM captures tokens/passwords or hijacks sessions.
• Root cause: Non-loopback gateway traffic is sent without TLS.
• Mitigation: Enable TLS for LAN binds and use wss:// for remote gateways.

Gateway token reused across surfaces (`token-reuse`) — Medium

• Misconfiguration: gateway.auth.token equals hooks.token or browser.controlToken
• Attack vector: Compromise of hooks or browser control token grants gateway access.
• Root cause: Shared secret reused across trust boundaries.
• Mitigation: Use distinct tokens per surface.

Secrets stored on disk with loose perms (`secret-perms`) — High

• Misconfiguration: clawdbot.json or backups are group/world readable, writable, or symlinked
• Attack vector: Local users read/modify gateway secrets or auth config.
• Root cause: Secrets stored on disk without strict permissions.
• Mitigation: chmod 600 on clawdbot.json and tighten backup perms.

Weak or short gateway token (`gateway-token-strength`) — Medium (High if missing)

• Misconfiguration: gateway.auth.mode=token with missing token or token length < 24
• Attack vector: Missing/short tokens are easier to brute-force or fail to enforce auth.
• Root cause: Token mode relies on a shared secret; short or missing tokens reduce security.
• Mitigation: Generate a long random token (24+ chars) or set env-based token.

Long-lived device auth tokens (`device-token-rotation`) — Medium

• Misconfiguration: Device token last rotated > 90 days ago
• Attack vector: Stolen device tokens remain valid indefinitely.
• Root cause: Device tokens lack expiration unless manually rotated/revoked.
• Mitigation: Rotate or revoke old device tokens.

---

Scope 2: Channel DM Policies & Allowlists

Files Examined:

• src/channels/
• src/channels/allowlists/
• src/pairing/
• src/routing/
• src/telegram/ (bot/, monitor/)
• src/discord/ (monitor/)
• src/slack/ (http/, monitor/)
• src/signal/ (monitor/)
• src/imessage/ (monitor/)
• src/whatsapp/
• src/config/sessions/

Research Questions:

• What happens when dmPolicy="open" + allowFrom=["*"]?
• Pairing code brute-force potential
• Group allowlist bypass scenarios
• Cross-channel routing leaks
• requireMention bypass in groups

Findings (expand for details):

Public DMs enabled (`dm-policy-open`) — High

• Misconfiguration: channels.<channel>.dmPolicy=open or channels.<channel>.dm.policy=open
• Attack vector: Any sender can DM the bot; pairing/allowlist bypass with routing hijack risk.
• Root cause: DM policy bypasses pairing/allowlist and updates last‑route on the shared session key.
• Mitigation: Use dmPolicy=pairing or dmPolicy=allowlist with explicit allowFrom.

Wildcard allowFrom permits any sender (`allowfrom-wildcard`) — High

• Misconfiguration: allowFrom contains *
• Attack vector: Allowlists match everyone; authorization bypass and control-command bypass.
• Root cause: For Slack/Discord/Telegram/iMessage/Signal, allowFrom is also used for command authorization, so any group sender can issue control commands and bypass requireMention via resolveMentionGatingWithBypass.
• Mitigation: Remove *, use explicit sender IDs/handles, and keep group allowlists separate.

Group DMs enabled without allowlist (`group-dm-open`) — Medium

• Misconfiguration: Slack/Discord dm.groupEnabled=true with empty or wildcard groupChannels
• Attack vector: Any Slack/Discord group DM can trigger the bot without filtering.
• Root cause: Group DMs are only filtered when groupChannels is set.
• Mitigation: Define explicit dm.groupChannels or disable groupEnabled.

Group allowlist wildcard opens senders (`group-allowlist-wildcard`) — High

• Misconfiguration: groupPolicy=allowlist with wildcard groupAllowFrom or fallback wildcard allowFrom
• Attack vector: Any group sender can reach the bot despite allowlist mode.
• Root cause: Group allowlist falls back to allowFrom; a wildcard negates sender filtering.
• Mitigation: Set explicit groupAllowFrom (no *) or intentionally use groupPolicy=open.

Discord allowlist without channel restrictions (`discord-group-allowlist-no-channels`) — Medium

• Misconfiguration: channels.discord.guilds.<id> missing channels allowlist
• Attack vector: All channels in the allowlisted guild become eligible.
• Root cause: Discord allowlist policy only applies when per‑channel lists are configured.
• Mitigation: Add explicit channel allowlists under guilds.<id>.channels.

Shared DM session scope (`dm-scope-main-multi`) — Medium

• Misconfiguration: session.dmScope=main with multiple allowFrom entries
• Attack vector: Multiple DM senders share a session, enabling cross-channel reply leaks.
• Root cause: DM routing uses a single session key in main scope.
• Mitigation: Use dmScope=per-peer or per-channel-peer and limit allowlists.

---

Scope 3: Agent Sandbox, Tools & Command Execution

Files Examined:

• src/agents/sandbox/
• src/agents/tools/
• src/infra/exec-safety.ts
• src/infra/exec-approvals.ts
• src/browser/
• src/browser/routes/
• src/cron/
• src/cron/isolated-agent/
• src/process/
• src/hooks/
• src/hooks/bundled/

Research Questions:

• Sandbox escape when sandbox.mode is misconfigured
• Tool allowlist/denylist bypass scenarios
• Browser CDP control exposure
• Cron job injection with elevated privileges
• Hook injection vectors
• system.run permission escalation via nodes

Findings (expand for details):

Sandbox disabled for main sessions (`sandbox-mode-not-all`) — High

• Misconfiguration: sandbox.mode=off or non-main for any agent
• Attack vector: Untrusted prompts run tools on the host via the main session.
• Root cause: Main session uses host tools when sandbox is off or only applies to non‑main sessions.
• Mitigation: Set agents.defaults.sandbox.mode=all for untrusted workloads.

Tool allowlist ignored (plugin-only entries) (`tool-allowlist-plugin-only`) — Medium

• Misconfiguration: tools.allow / agents.*.tools.allow contains only plugin/unknown entries
• Attack vector: Core tools remain available because plugin-only allowlists are stripped.
• Root cause: Clawdbot drops allowlists without any core tool or group.
• Mitigation: Include at least one core tool/group or add explicit deny rules.

Sandbox allowlist still permits image (`sandbox-image-auto-allow`) — Low

• Misconfiguration: Sandbox allowlist set without image and image not denied
• Attack vector: image tool is auto-added unless explicitly denied.
• Root cause: Sandbox policy includes image by default.
• Mitigation: Add image to tools.sandbox.tools.deny or include it explicitly.

Browser control server exposed without token (`browser-control-exposed`) — Critical

• Misconfiguration: browser.controlUrl bound to non-loopback with no browser.controlToken
• Attack vector: Remote clients can drive CDP sessions.
• Root cause: Browser control server lacks authentication without a control token.
• Mitigation: Bind to loopback or set browser.controlToken and firewall access.

Sandbox can control host browser (`sandbox-host-browser-control`) — High

• Misconfiguration: sandbox.browser.allowHostControl=true with sandbox active
• Attack vector: Sandboxed sessions can drive the host browser (cookies, tabs, auth).
• Root cause: allowHostControl routes sandbox tool calls to the host control server.
• Mitigation: Set allowHostControl=false or restrict browser tools for untrusted sessions.

Cron tool can inject system events (`cron-system-event-injection`) — High

• Misconfiguration: cron.enabled=true and cron tool allowed by policy
• Attack vector: Cron jobs enqueue systemEvent payloads into main session (system role).
• Root cause: Cron supports systemEvent injection when tool is allowed.
• Mitigation: Disable cron or deny the cron tool for untrusted sessions.

Workspace hooks writable by agents (`hooks-workspace-injection`) — High

• Misconfiguration: hooks.internal.enabled=true with writable workspace access
• Attack vector: Agents can write hook handlers and gain host code execution.
• Root cause: Internal hooks dynamically load handler code from workspace/extraDirs.
• Mitigation: Set workspaceAccess=ro/none for untrusted agents or disable internal hooks.

---

Scope 4: Plugin/Extension Channel Security

Files Examined:

• extensions/msteams/src/
• extensions/matrix/src/
• extensions/zalo/src/
• extensions/zalouser/src/
• extensions/bluebubbles/src/
• extensions/voice-call/src/
• extensions/nostr/src/
• extensions/mattermost/src/
• extensions/nextcloud-talk/src/
• extensions/tlon/src/
• src/plugins/
• src/plugins/runtime/

Research Questions:

• Extension-specific allowlist implementations - are they consistent/secure?
• OAuth token storage and rotation in extensions
• Voice-call authentication (Twilio/Plivo credentials exposure)
• Matrix homeserver trust model vulnerabilities
• Nostr private key exposure risks
• Plugin isolation and cross-plugin data access
• Extension credential storage patterns

Findings (expand for details):

Extension DMs open (`extension-dm-policy-open`) — High

• Misconfiguration: Extension dmPolicy=open
• Attack vector: Any sender can DM the bot via extension channel.
• Root cause: Extension DM policy bypasses pairing/allowlist the same as core channels.
• Mitigation: Use dmPolicy=pairing or dmPolicy=allowlist with explicit allowFrom.

Extension wildcard allowFrom (`extension-allowfrom-wildcard`) — High

• Misconfiguration: Extension allowFrom contains *
• Attack vector: Extension DM allowlists match everyone; authorization bypassed.
• Root cause: Wildcard allowlists match all senders.
• Mitigation: Replace * with explicit sender IDs/handles.

Extension group policy open (`extension-group-policy-open`) — Medium

• Misconfiguration: Extension groupPolicy=open
• Attack vector: Any group/room can trigger the bot.
• Root cause: Group policies allow all rooms when set to open.
• Mitigation: Use groupPolicy=allowlist with explicit group IDs.

Nostr private key in config (`nostr-private-key-config`) — Critical

• Misconfiguration: channels.nostr.privateKey plaintext
• Attack vector: Local file read exposes Nostr identity; attacker can impersonate.
• Root cause: Secret stored directly in config file.
• Mitigation: Use env reference: privateKey: "${NOSTR_PRIVATE_KEY}".

Matrix password in config (`matrix-password-config`) — High

• Misconfiguration: channels.matrix.password plaintext
• Attack vector: Local file read exposes Matrix credentials for account takeover.
• Root cause: Password stored directly in config file.
• Mitigation: Use env reference or access token.

MS Teams app password in config (`msteams-app-password-config`) — High

• Misconfiguration: channels.msteams.appPassword plaintext
• Attack vector: Local file read exposes Azure AD client secret.
• Root cause: App password stored directly in config file.
• Mitigation: Use env reference: appPassword: "${MSTEAMS_APP_PASSWORD}".

Voice-call signature verification skipped (`voice-call-skip-signature`) — Critical

• Misconfiguration: voice-call.skipSignatureVerification=true
• Attack vector: Attacker can forge Twilio/Plivo webhooks to inject fake calls/transcripts.
• Root cause: Signature verification is explicitly bypassed.
• Mitigation: Set skipSignatureVerification=false.

Voice-call inbound policy open (`voice-call-inbound-open`) — High

• Misconfiguration: voice-call.inboundPolicy=open
• Attack vector: Any phone number can call the bot.
• Root cause: Inbound policy allows any caller.
• Mitigation: Use inboundPolicy=allowlist or disable inbound calls.

Voice-call credentials in config (`voice-call-credentials-config`) — High

• Misconfiguration: Provider auth tokens stored in plaintext (Twilio/Plivo/Telnyx)
• Attack vector: Local file read exposes telephony credentials (billing/call control).
• Root cause: Secrets stored directly in config.
• Mitigation: Use env references for provider credentials.

Voice-call ngrok free-tier bypass (`voice-call-ngrok-free-tier`) — Medium

• Misconfiguration: tunnel.provider=ngrok with allowNgrokFreeTier=true
• Attack vector: Signature verification failures are silently allowed on ngrok URLs.
• Root cause: Free‑tier setting allows signature failures.
• Mitigation: Set allowNgrokFreeTier=false or use paid tier with custom domain.

Nextcloud Talk secret in config (`nextcloud-talk-secret-config`) — Medium

• Misconfiguration: channels.nextcloud-talk.botSecret plaintext
• Attack vector: Local file read exposes webhook signing secret.
• Root cause: Bot secret stored directly in config.
• Mitigation: Use env ref or botSecretFile.

Tlon/Urbit access code in config (`tlon-code-config`) — Medium

• Misconfiguration: channels.tlon.code plaintext
• Attack vector: Local file read exposes Urbit ship access code.
• Root cause: Access code stored directly in config.
• Mitigation: Use env reference: code: "${TLON_CODE}".

---

Scope 5: Web Interfaces, Nodes & External Integrations

Files Examined:

• src/web/
• src/web/inbound/
• src/web/auto-reply/
• src/node-host/
• src/providers/
• src/media/
• src/media-understanding/
• src/infra/net/ssrf.ts
• extensions/google-antigravity-auth/
• extensions/google-gemini-cli-auth/
• extensions/qwen-portal-auth/
• extensions/copilot-proxy/
• extensions/memory-lancedb/

Research Questions:

• WebChat authentication and session hijacking risks
• Control UI CSRF/XSS vectors
• Node protocol command injection
• SSRF protection gaps in media fetching
• OAuth redirect URI validation
• Credential storage in ~/.clawdbot/credentials/
• Memory extension data exposure

Findings (expand for details):

WhatsApp credentials readable by other users (`whatsapp-creds-perms`) — High

• Misconfiguration: WhatsApp authDir/creds.json are group/world readable/writable or symlinked
• Attack vector: Local users can copy creds.json to hijack WhatsApp Web sessions.
• Root cause: WhatsApp session state is stored on disk without enforced perms.
• Mitigation: chmod 700 on auth dirs and chmod 600 on creds.json.

Nodes tool can invoke `system.run` (`nodes-system-run`) — High

• Misconfiguration: gateway.nodes.denyCommands missing system.run while nodes tool allowed
• Attack vector: Remote node invoke can execute arbitrary commands on paired nodes.
• Root cause: Node command policy allows system.run unless explicitly denied.
• Mitigation: Add system.run to gateway.nodes.denyCommands or deny the nodes tool.

Media URL SSRF exposure (`media-url-prefer`) — Medium

• Misconfiguration: tools.media.<capability>.attachments.prefer=url with media understanding enabled
• Attack vector: Gateway fetches untrusted URLs; SSRF to internal services.
• Root cause: URL attachments are fetched without strict host validation in some paths.
• Mitigation: Prefer file/path attachments or disable URL preference.

Memory (LanceDB) exposure across senders (`memory-lancedb-exposure`) — Medium

• Misconfiguration: memory-lancedb autoCapture/autoRecall enabled with multiple DM senders allowed
• Attack vector: One sender can access memories captured from other senders/groups.
• Root cause: LanceDB stores a shared DB; auto‑recall does not isolate senders.
• Mitigation: Limit allowlists to a single owner or disable autoCapture/autoRecall.

---

Appendix A: Running the Scanner

# Run the scanner from the repo (default: pretty output in a TTY; markdown when piped)
./security-scanner/scan.py

# Specify config file
./security-scanner/scan.py --config ~/.clawdbot/clawdbot.json

# Choose an output format
./security-scanner/scan.py --format pretty
./security-scanner/scan.py --format markdown
./security-scanner/scan.py --format json

# Run without cloning (PyPI)
pipx run clawdbot-security-scanner
uvx clawdbot-security-scanner

Appendix B: Validation / Tests

./security-scanner/test.py

This script runs representative configurations and asserts that expected failures are detected for each check.