OpenClaw Model Switch & Rescue

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:07 PM UTC
• Version: 2.0.0

Overview

This skill is an OpenClaw recovery guide, but it asks users to perform high-impact server administration with root access, mutable package execution, process killing, and state deletion.

Review before installing or using this skill on real infrastructure. Prefer a dedicated non-root admin account, pinned and verified OpenClaw binaries, backups before changing or deleting config/state files, and systemd or exact PID-based restart commands instead of broad process matching. There is no evidence of deception or exfiltration in the artifact, but the documented recovery procedure carries high operational risk if followed literally.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:24

Finding

Root SSH Access Violates Least-Privilege Boundaries

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:67

Finding

Unpinned npx Commands Can Retrieve and Execute Mutable Third-Party Code

Content

View full analysis

/tmp/gateway.log 2>&1 & ``` ```bash npx openclaw node run --host --port ``` ### Technical Analysis The workflow invokes the `openclaw` package through `npx` without specifying a package version, integrity hash, lockfile, approved registry, or verified local executable. Depending on the local environment and npm configuration, `npx` can resolve and download a package from a configured package registry when the command is not already installed. The code ultimately executed is therefore not fully represented by the reviewed skill and may change after the audit. Registry compromise, account takeover of the package publisher, malicious registry configuration, or an unsafe future package release could cause arbitrary package or lifecycle code to run. The impact is especially severe when these commands are executed from the root SSH session recommended earlier in the document. ### Attack Path 1. The expected `openclaw` executable is absent from the local project or executable search path. 2. An operator runs one of the documented `npx openclaw` commands. 3. `npx` resolves the unpinned package through the configured npm registry. 4. The registry supplies a compromised, substituted, or unexpectedly changed package version. 5. `npx` downloads and executes package-controlled code. 6. That code runs with the privileges of the operator, potentially root under the documented connection procedure. ### Impact Assessment A malicious resolved package could execute arbitrary commands with the invoking account's privileges. Under the documented root workflow, this could result in complete server compromise, including theft of API credentials and SSH material, modification of OpenClaw configuration, tampering with serv ...[truncated 71 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:64

Finding

Broad Command-Line Process Matching Can Terminate Unrelated Services

Content

View full analysis

/tmp/gateway.log 2>&1 & ``` ### Technical Analysis The `pkill -f` option matches the supplied pattern against each process's complete command line rather than a validated process identifier or exact executable. Any process whose command line contains `openclaw-gateway` may be terminated, including unrelated monitoring commands, wrapper scripts, administrative sessions, or other gateway instances. Because the skill also instructs the operator to connect as root, the command can signal processes owned by any user. The instruction does not verify the matched processes, constrain the process owner, use a service-specific PID file, or confirm that the executable is the intended gateway binary. ### Attack Path 1. A legitimate unrelated process has `openclaw-gateway` in its command-line arguments, or an attacker causes a target process command line to contain that string. 2. An operator follows the fallback restart procedure. 3. `pkill -f openclaw-gateway` matches all qualifying command lines. 4. The operating system sends the termination signal to every process the privileged operator is permitted to signal. 5. Unrelated processes or multiple gateway instances are stopped, causing service disruption. ### Impact Assessment The immediate impact is denial of service through unintended process termination. When executed as root, the affected scope can include processes belonging to all users. The command does not itself grant new privileges, but it can disrupt unrelated applications, monitoring components, or production gateway instances on the host. ]]>

Remediation

View remediation

/exe` against the exact approved binary path rather than matching arbitrary command-line text. - Run the gateway under a dedicated service account and ensure any fallback command can signal only that account's processes. - If pattern matching is unavoidable, enumerate and display candidate processes first, require operator confirmation, and use stricter matching constraints. - Add shutdown verification and a timeout before launching the replacement process. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

| 变量 | 说明 | 示例值 |
|------|------|--------|
| CENTRAL_IP | 中央服务器 IP | 从配置文件获取 |
| SSH_KEY | SSH 私钥路径 | ~/.ssh/id_ed25519 |
| API_KEY | 模型 API Key | 从平台获取 |

## 实施步骤

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

The skill instructs deletion of ~/.openclaw/node.json to force re-pairing. Although not obviously malicious, deleting state files is a destructive action that can break node identity, sever trust relationships, or cause accidental mispairing if run on the wrong host; the context increases risk because the skill is aimed at recovery under pressure.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

bash

# 删除旧的配对信息
rm ~/.openclaw/node.json

# 重新启动节点
cd ~/.openclaw

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

优先使用 systemd：

bash

sudo systemctl restart openclaw-gateway

如无 systemd：

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.

bash

cd ~/.openclaw
pkill -f openclaw-gateway
nohup npx openclaw gateway > /tmp/gateway.log 2>&1 &

5. 验证

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The skill instructs users to launch npx openclaw gateway without pinning an exact package version. npx may fetch the latest package from the registry at execution time, creating supply-chain risk and making behavior non-deterministic if a compromised or breaking release is published. In a rescue/admin workflow run on a central node, that risk is more sensitive because the command is executed in an operational environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The node recovery step uses npx openclaw node run without a pinned version. This allows unreviewed code to be downloaded and executed during incident recovery, which is especially risky because the command reconnects infrastructure components and may run with elevated access to node configuration.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.

md

1. **始终备份**：修改配置前先备份
2. **验证 IP**：确认目标服务器 IP 正确
3. **检查 Key**：API Key 只在本地使用，勿上传
4. **最小权限**：使用 sudo 而非 root 登录
5. **监控日志**：查看 `/tmp/gateway.log` 排查问题

## 相关文件