Moltbot Security

Security hardening for AI agents - Moltbot, OpenClaw, Cursor, Claude. Lock down gateway, fix permissions, auth, firewalls. Essential for vibe-coding setups.

This is a practical hardening checklist, but before running anything: 1) Verify the origin — the registry metadata lists no known homepage while package.json points to a GitHub repo; inspect that repo and its author. 2) Don’t blindly run curl | sh commands — fetch and review the scripts first. 3) Back up ~/.openclaw and any config files before editing or running auto-fix commands. 4) Confirm the 'openclaw' CLI is legitimate and from a trusted source before using --fix or audit commands. 5) Be cautious exporting tokens in shells; use a secrets store if possible. If you want, I can: fetch and summarize the referenced GitHub repo (if publicly available), list the exact commands the guide recommends to run so you can review them, or suggest safer step-by-step commands to audit without applying automatic fixes.

Type: OpenClaw Skill Name: moltbot-security Version: 1.0.3 The skill's stated purpose is security hardening, which is benign. However, the `SKILL.md` file instructs the AI agent to execute several powerful system commands, including `curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -`. While intended for a legitimate Node.js update from a known source, this pattern of piping a remote script to `bash` with root privileges represents a significant supply chain risk and a potential Remote Code Execution (RCE) vulnerability if the remote source were compromised. This falls under 'risky capabilities without clear malicious intent' as per the classification guidelines, making the skill suspicious.