ClawHub
Back to skill

Security audit

API配额监控与手动切换

Security checks across malware telemetry and agentic risk

Overview

This skill openly checks OpenClaw status and can change the configured model/restart the gateway, which is powerful but aligned with its stated purpose.

Install only if you are comfortable letting the skill read local OpenClaw status files, edit openclaw.json, and restart the OpenClaw gateway. Run --confirm or --model only after an explicit decision to switch, avoid sudo/elevated execution, use trusted config/log paths, and add the optional cron job only if you want ongoing scheduled checks.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tainted flow: 'OPENCLAW_LOG' from os.environ.get (line 24, credential/environment) → subprocess.Popen (code execution)

Medium
Category
Data Flow
Content
# 重启Gateway（需要相应权限）
        subprocess.run(["pkill", "-f", "openclaw-gateway"], capture_output=True)
        time.sleep(2)
        subprocess.Popen(
            ["nohup", "openclaw", "gateway", "start"],
            stdout=open(OPENCLAW_LOG, "a"),
            stderr=subprocess.STDOUT
Confidence
89% confidence
Finding
`OPENCLAW_LOG` is derived from environment variables or CLI-controlled paths and is opened for append before being attached to the spawned process. If an attacker can influence the environment or arguments under a higher-privilege execution context, they may redirect writes to arbitrary files or abuse symlinks, causing file clobbering or privilege-boundary issues.

Tainted flow: 'LOG_FILE' from os.environ.get (line 22, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
print(log_msg)
    try:
        os.makedirs(os.path.dirname(LOG_FILE), exist_ok=True)
        with open(LOG_FILE, "a") as f:
            f.write(log_msg + "\n")
    except Exception:
        pass  # 日志写入失败不影响主流程
Confidence
88% confidence
Finding
`LOG_FILE` comes from `LOG_DIR`, which can be influenced externally, and the code blindly creates directories and appends to that path. In a privileged or multi-user environment, this can be abused for arbitrary file write, log poisoning, or overwriting sensitive files via symlink/path manipulation.

Tainted flow: 'CONFIG_FILE' from os.environ.get (line 21, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
config["agents"]["defaults"]["model"]["primary"] = model
        
        with open(CONFIG_FILE, "w") as f:
            json.dump(config, f, indent=2, ensure_ascii=False)
        
        log(f"已切换模型到: {model}")
Confidence
93% confidence
Finding
`CONFIG_FILE` is derived from `OPENCLAW_DIR` or `--config` and is opened for writing without validation. This enables arbitrary file overwrite if an attacker can control those values, which is especially dangerous because it modifies configuration and could corrupt or replace sensitive files when executed with more privileges than the attacker has.

Tainted flow: 'OPENCLAW_LOG' from os.environ.get (line 24, credential/environment) → open (file write)

Medium
Category
Data Flow
Content
time.sleep(2)
        subprocess.Popen(
            ["nohup", "openclaw", "gateway", "start"],
            stdout=open(OPENCLAW_LOG, "a"),
            stderr=subprocess.STDOUT
        )
Confidence
89% confidence
Finding
This is another instance of unvalidated file write using `OPENCLAW_LOG`, now directly in the child process stdout redirection. The same path-control issue applies: an attacker who controls the path can redirect process output into unintended files, potentially causing corruption, data exposure, or privileged file modification.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The docstring claims switching requires user confirmation, but the program exposes `--confirm` and `--model` paths that perform direct non-interactive changes. In an agent skill context, this mismatch is security-relevant because operators may believe the skill is safe and gated when it can actually modify config and restart services immediately.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
`ask_user_switch()` does not ask for or verify any user input; it only prints text and returns success. In a security-sensitive automation context, fake confirmation mechanisms can mislead higher-level systems into believing approval was obtained and can enable unauthorized operational changes.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger phrases are broad, generic, and closely match normal user requests about checking APIs or switching models. That can cause unintended activation of a skill that performs operational actions around configuration and service restarts, increasing the chance of accidental execution in unrelated conversations.

Session Persistence

Medium
Category
Rogue Agent
Content
如需定时自动检查，可配置 cron：
```bash
# 编辑 crontab
crontab -e

# 添加定时任务（每30分钟检查一次）
# 替换为实际路径
Confidence
90% confidence
Finding
The skill explicitly instructs users to install a cron job that repeatedly executes the monitoring script, creating persistence on the host. Even if framed as optional automation, persistent scheduled execution increases attack surface because a modified script or compromised skill directory would run automatically without fresh user review.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.