OpenClaw Safe Change Flow

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:34 AM UTC
• Version: 1.1.0

Overview

This is a coherent OpenClaw configuration-change helper, but its included safety script can leave partial config edits in place despite promising automatic rollback.

Review the included shell script before relying on it in production. It is not evidence of theft or intentional abuse, but users should treat it as a Review item because it changes OpenClaw configuration and service state and its automatic rollback does not cover all failure paths.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: safe-change.sh:61

Finding

Edit-script failure bypasses automatic configuration rollback

Content

View full analysis

/dev/null 2>&1 || true if command -v launchctl >/dev/null 2>&1; then launchctl kickstart -k "gui/$(id -u)/ai.openclaw.gateway.secondary" >/dev/null 2>&1 || true fi echo "[rollback] done" } ``` ### Technical Analysis The script enables Bash's immediate-exit behavior through `set -e`. It then executes the main and optional secondary edit scripts directly. If either delegated script exits with a nonzero status, `safe-change.sh` terminates immediately. The `rollback` function is defined only after the edit scripts are executed, and no `ERR`, `EXIT`, `INT`, or `TERM` trap is installed to restore the backups when execution terminates unexpectedly. Rollback is invoked only for explicit validation failures later in the script. Consequently, an edit script can partially modify an OpenClaw configuration file and then fail before validation. The modified configuration remains on disk even though a backup was successfully created. This contradicts the documented guarantee in `SKILL.md` that failures trigger automatic rollback. ### Attack Path 1. A user or automation process invokes `safe-change.sh` with a faulty or attacker-controlled edit script. 2. The runner creates a backup of the existing OpenClaw configuration. 3. The delegated edit script partially overwrites or corrupts `openclaw.json`. 4. The edit script exits with a nonzero status, ...[truncated 1209 chars]

Remediation

View remediation

/dev/null 2>&1 || true fi exit "$status" } trap 'rollback $?' ERR trap 'rollback 130' INT trap 'rollback 143' TERM rollback_required=1 bash "$MAIN_SCRIPT" if [[ -n "$SECONDARY_SCRIPT" ]]; then bash "$SECONDARY_SCRIPT" fi # Perform all validation here. rollback_required=0 trap - ERR INT TERM ``` The production implementation should also distinguish failures that occur before any configuration modification from failures requiring a service restart, avoiding unnecessary restarts where possible. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

## Required single-instance flow

1. **Backup first**
   - Create timestamped backup: `*.bak.safe-YYYYmmdd-HHMMSS`
2. **Make minimal edits**
   - Change only necessary keys
3. **Validate immediately**