T03 · Remote Payload Retrieval and Execution
Error
- Location
INSTALL.md:48- Finding
Unverified Remote Release Archives Are Downloaded and Installed
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw Security Configurator
Security checks for vulnerabilities and agentic risk
Overview
This skill appears to be a real OpenClaw security and token-monitoring tool, but it asks users to install persistent monitoring and handles logs, credentials, and downloaded code in ways that need careful review.
Review this before installing in a production or regulated environment. Prefer the ClawHub install path over the manual wget/tar flow unless releases are verified, do not enable the system-wide service until it is converted to a least-privilege user service, avoid running the monitor as root, and treat reports/log output as sensitive because they may include credential fragments or raw OpenClaw log lines.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T06 · System Persistence
Error
- Location
INSTALL.md:110- Finding
System-Wide Persistent Execution Exceeds the Required Privilege Scope
- Content
View full analysis
> ~/.openclaw/startup-scripts.sh ``` ```bash sudo tee /etc/systemd/system/openclaw-security-monitor.service << EOF [Unit] Description=OpenClaw Security Monitor After=openclaw.service Requires=openclaw.service [Service] Type=simple User=$USER WorkingDirectory=$(pwd) ExecStart=$(pwd)/scripts/token-monitor.sh start Restart=on-failure RestartSec=10 [Install] WantedBy=multi-user.target EOF sudo systemctl daemon-reload sudo systemctl enable openclaw-security-monitor sudo systemctl start openclaw-security-monitor ``` ### Technical Analysis Continuous token monitoring can legitimately require a long-running process, and the systemd integration is disclosed as optional. However, the documented procedure writes a unit into `/etc/systemd/system`, enables it across reboots, and separately proposes appending a command to an OpenClaw startup script. A system-wide service is not necessary for a monitor that runs as the current user and writes primarily under that user's home directory. A user-level systemd service would provide equivalent monitoring while avoiding root-owned persistence. The unit also declares `Type=simple` but invokes `token-monitor.sh start`, which backgrounds `monitor_loop` and exits. Systemd therefore supervises the launcher rather than the actual monitor. Combined with `Restart=on-failure`, this can produce incorrect service state, orphaned processes, or duplicate monitors. Because `WorkingDirectory` and `ExecStart` point into the mutable project directory, later replacement of the scripts—including through the unverified upgrade path—changes the code executed by the persistent service. ### Attack Path 1. An administrator follows the installation instructions and creates the system-wide uni ...[truncated 888 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/token-monitor.sh:148- Finding
Sensitive Credential Fragments and Raw Log Records Can Be Disclosed Through Output and Predictable Temporary Reports
- Content
View full analysis
/dev/null | \ grep -E "(tokens|token|cost|消耗|用量)" | \ tail -50) if [[ -z "$token_data" ]]; then token_data=$(grep -E "(tokens|token|cost|消耗|用量)" "$log_file" 2>/dev/null | tail -50) fi ``` Those records are written to a predictable shared temporary path: ```bash local analysis_file="/tmp/openclaw-token-analysis-$(date +%Y%m%d).txt" ``` Raw high-usage lines are retained and included in the report: ```bash if [[ $token_count -gt $ALERT_THRESHOLD ]]; then high_usage_count=$((high_usage_count + 1)) high_usage_requests+=("$line") fi ``` ```bash for ((i=0; i<${#high_usage_requests[@]}; i++)); do echo "$((i+1)). ${high_usage_requests[$i]}" done ``` ### Technical Analysis The security checker does not need to read or display any part of credential values to determine whether a variable is set. Revealing the first and last four characters weakens credential confidentiality and can assist correlation, identification, or brute-force attacks against short or partially known secrets. Terminal output may also be captured by CI logs, shell-session recording, support bundles, or monitoring systems. The token monitor collects entire journal or application-log lines even ...[truncated 2043 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/token-monitor.sh:51- Finding
Shell-Executable Configuration and Untrusted Global PID File Permit Code Execution or Process Manipulation
- Content
View full analysis
/var/run/openclaw-token-monitor.pid log "SUCCESS" "Monitor started, PID: $(cat /var/run/openclaw-token-monitor.pid)" ``` ```bash if [[ -f /var/run/openclaw-token-monitor.pid ]]; then local pid=$(cat /var/run/openclaw-token-monitor.pid) log "INFO" "Stopping monitor, PID: $pid" kill "$pid" 2>/dev/null rm -f /var/run/openclaw-token-monitor.pid log "SUCCESS" "Monitor stopped" fi ``` ```bash if [[ -f /var/run/openclaw-token-monitor.pid ]]; then local pid=$(cat /var/run/openclaw-token-monitor.pid) if kill -0 "$pid" 2>/dev/null; then log "SUCCESS" "Monitor is running, PID: $pid" else log "ERROR" "Monitor process does not exist" fi fi ``` ### Technical Analysis `source "$CONFIG_FILE"` evaluates the entire configuration as shell syntax. The file is therefore executable code rather than data. Any user or process that can modify, replace, or redirect the configuration file can execute arbitrary commands whenever any monitor command loads the configuration. The script does not validate file ownership, permissions, symlink status, or allowed keys before sourcing it. The PID file is placed under `/var/run`, even though the monitor is intended to run as a non-root user. This unnecessarily encourages elevated execution. The file is written non-atomically and is trusted without confirming that the PID belongs to an OpenClaw token-monitor process. ...[truncated 1628 chars]- Remediation
View remediation
/cmdline` or an equivalent identity marker. 8. Prefer direct process supervision by systemd so that a separate PID file is unnecessary. 9. Handle stale runtime state safely and never signal a process solely because its number appears in a file. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (35)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 86% confidence
- Finding
rm -rf openclaw-security-configurator/ is a forceful recursive deletion command. Although scoped to the skill directory in the documented flow, such commands are dangerous because a mistaken working directory or copy/paste error can delete unintended content without confirmation.
- Content
md # 删除技能目录 cd ~/.openclaw/skills/ rm -rf openclaw-security-configurator/ # 删除配置文件 (可选) # rm -rf ~/.openclaw/security/
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Even though commented out and marked optional, rm -rf ~/.openclaw/security/ is a destructive recursive delete that can permanently remove configuration and logs, including potentially important audit history. In a security-monitoring skill, deleting logs/config reduces forensic visibility and can mask misconfiguration or abuse.
- Content
md rm -rf openclaw-security-configurator/ # 删除配置文件 (可选) # rm -rf ~/.openclaw/security/ # 删除系统服务 (如果已安装) sudo systemctl stop openclaw-security-monitor
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Even though commented out and marked optional, rm -rf ~/.openclaw/security/ is a destructive recursive delete that can permanently remove configuration and logs, including potentially important audit history. In a security-monitoring skill, deleting logs/config reduces forensic visibility and can mask misconfiguration or abuse.
- Content
md rm -rf openclaw-security-configurator/ # 删除配置文件 (可选) # rm -rf ~/.openclaw/security/ # 删除系统服务 (如果已安装) sudo systemctl stop openclaw-security-monitor
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 85% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
删除系统服务 (如果已安装)
sudo systemctl stop openclaw-security-monitor sudo systemctl disable openclaw-security-monitor sudo rm /etc/systemd/system/openclaw-security-monitor.service sudo systemctl daemon-reload
text
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill is presented as a security configurator, but its documented behavior extends into token usage logging, alerting, and background monitoring/service management that are not clearly reflected in the top-level description. In a high-privilege admin context, this mismatch is dangerous because users may authorize broad tool access expecting only defensive checks, while the skill can also drive monitoring workflows and system-level service actions with operational and data-exposure implications.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Sourcing the configuration file executes arbitrary shell code in the script's privilege context, so anyone able to modify that file can achieve code execution. In the same tool, invoking ${EDITOR:-vi} also executes an environment-controlled command, which can be abused if the environment is attacker-influenced or the script is run with elevated privileges.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
sh local pid=$(cat /var/run/openclaw-token-monitor.pid) log "INFO" "停止监控服务，PID: $pid" kill "$pid" 2>/dev/null rm -f /var/run/openclaw-token-monitor.pid log "SUCCESS" "监控服务已停止" else log "WARNING" "未找到监控服务PID文件"
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The markdown explicitly states the product is '中文优先' while competitors are '英文为主', indicating a preferred enforced language/locale behavior. The file does not mention any user choice or opt-in for language selection, which conflicts with the policy requirement to avoid forcing a specific language without user consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document forces a specific language/locale for all users through its natural-language content. The policy allows locale constraints only when the skill offers user choice or clearly documents a justified regional limitation, neither of which is present here.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
步骤1: 下载技能包
bash # 创建技能目录 mkdir -p ~/.openclaw/skills/ cd ~/.openclaw/skills/ # 下载最新版本
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
系统服务配置 (可选)
bash # 创建systemd服务文件 sudo tee /etc/systemd/system/openclaw-security-monitor.service << EOF [Unit] Description=OpenClaw Security Monitor After=openclaw.service
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
系统服务配置 (可选)
bash # 创建systemd服务文件 sudo tee /etc/systemd/system/openclaw-security-monitor.service << EOF [Unit] Description=OpenClaw Security Monitor After=openclaw.service
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
系统服务配置 (可选)
bash # 创建systemd服务文件 sudo tee /etc/systemd/system/openclaw-security-monitor.service << EOF [Unit] Description=OpenClaw Security Monitor After=openclaw.service
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
系统服务配置 (可选)
bash # 创建systemd服务文件 sudo tee /etc/systemd/system/openclaw-security-monitor.service << EOF [Unit] Description=OpenClaw Security Monitor After=openclaw.service
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
系统服务配置 (可选)
bash # 创建systemd服务文件 sudo tee /etc/systemd/system/openclaw-security-monitor.service << EOF [Unit] Description=OpenClaw Security Monitor After=openclaw.service
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
系统服务配置 (可选)
bash # 创建systemd服务文件 sudo tee /etc/systemd/system/openclaw-security-monitor.service << EOF [Unit] Description=OpenClaw Security Monitor After=openclaw.service
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
系统服务配置 (可选)
bash # 创建systemd服务文件 sudo tee /etc/systemd/system/openclaw-security-monitor.service << EOF [Unit] Description=OpenClaw Security Monitor After=openclaw.service
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
systemctl enable establishes persistence by causing the monitoring service to start automatically on boot. In a high-privilege operational context, persistent background execution increases the blast radius if the referenced script is later compromised, replaced, or misconfigured.
- Content
启用并启动服务
sudo systemctl daemon-reload sudo systemctl enable openclaw-security-monitor sudo systemctl start openclaw-security-monitor
text
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md # rm -rf ~/.openclaw/security/ # 删除系统服务 (如果已安装) sudo systemctl stop openclaw-security-monitor sudo systemctl disable openclaw-security-monitor sudo rm /etc/systemd/system/openclaw-security-monitor.service sudo systemctl daemon-reload
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README advertises monitoring, logging, reporting, and webhook alerting, but does not clearly disclose what data may be collected, stored, or transmitted off-host. In a security-focused skill for enterprise and financial environments, undocumented telemetry or webhook export can lead to unintended exposure of usage metadata, configuration details, or sensitive operational information.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The feature comparison explicitly states '中文优先', and the overall README is written entirely in Chinese, which signals a language preference without an explicit opt-in or alternative language path. Under the policy, forcing or defaulting to a specific language without user choice can be a natural-language locale violation unless clearly justified and documented.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill instructs users to run security hardening actions with administrator privileges but does not clearly warn that these operations may change system configuration, affect availability, or alter OpenClaw behavior. In a security-themed skill, users are more likely to trust and execute such commands quickly, increasing the risk of unintended outages, lockouts, or unsafe changes on privileged systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Displaying masked credential values still discloses secret metadata, including prefix/suffix patterns and confirmation that specific providers are in use. In security-sensitive environments, that information can help attackers validate stolen secrets, correlate tokens across systems, or mine exposed console logs.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script prints masked fragments of sensitive environment variables and also surfaces token-related log content. Even partial secrets and usage logs can aid credential correlation, leak operational details into terminals, CI logs, shell history captures, or centralized logging systems, which is unnecessary for a security check tool.
- Content
Static analysis
Detected: suspicious.destructive_delete_command
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- INSTALL.md:174