ClawHub
Back to skill

Security audit

Openclaw360

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local security-scanner skill, with the main caveat that installation fetches executable code from GitHub.

Before installing, review the referenced GitHub source at the pinned revision or install it in an isolated virtual environment. Be aware it will process prompts, tool parameters, outputs, Skill files, audit logs, and local backups when you ask it to run security checks.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Unverified Git Dependency Is Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:8-11 and duplicated at SKILL.md:17-20
Vulnerability Type: Supply-chain exposure through an externally retrieved Python package
Risk Level: Medium

Vulnerable Code

yaml
install:
  - name: "pip install (pinned commit)"
    command: "pip3 install git+https://github.com/milu-ai/openclaw360.git@5fd69db"
  - name: "pip install (venv, for Homebrew Python)"
    command: "python3 -m venv ~/.openclaw360-venv && ~/.openclaw360-venv/bin/pip install git+https://github.com/milu-ai/openclaw360.git@5fd69db"

The same installation commands are repeated in the metadata block:

yaml
metadata:
  clawdbot:
    install:
      - name: "pip install (pinned commit)"
        command: "pip3 install git+https://github.com/milu-ai/openclaw360.git@5fd69db"
      - name: "pip install (venv, for Homebrew Python)"
        command: "python3 -m venv ~/.openclaw360-venv && ~/.openclaw360-venv/bin/pip install git+https://github.com/milu-ai/openclaw360.git@5fd69db"

Technical Analysis

The Skill instructs users to install executable Python code directly from an external Git repository. The referenced implementation is not included in the audited project, which contains only SKILL.md; therefore, the downloaded package, its transitive dependencies, and its installation hooks could not be verified during this audit.

Pinning the source to 5fd69db reduces exposure to ordinary branch or tag changes, but this is only an abbreviated eight-character Git revision rather than a full commit identifier. The installation also lacks artifact-level cryptographic verification such as a wheel hash enforced by pip --require-hashes. During a VCS installation, pip retrieves the repository and may execute package build-backend or setup logic under the installing user's account.

This does not establish that the upstream package is malicious. It creates a supply-c ...[truncated 2061 chars]

Remediation
View remediation

Remediation Suggestions

  1. Include the complete executable implementation in the reviewed Skill artifact so its filesystem access, network behavior, logging, backup logic, and dependency graph can be audited together.
  2. If external installation remains necessary, publish a versioned wheel through a controlled package repository and provide a locked requirements file containing SHA-256 hashes.
  3. Require hash verification during installation, for example through pip install --require-hashes -r requirements.txt.
  4. Replace the abbreviated revision with the full 40-character Git commit identifier and document an independently verified expected source-tree or artifact digest.
  5. Pin and hash all build and runtime dependencies, including the build backend, to reduce transitive supply-chain exposure.
  6. Build the wheel in an isolated CI environment, generate provenance or attestations, and sign release artifacts using a verifiable release key.
  7. Install and run the scanner in a dedicated virtual environment with restricted filesystem permissions and no network access after installation.
  8. Require explicit user confirmation before scanning default or system-wide Skill directories, and enforce allowlisted scan roots in the implementation.
  9. Independently verify that the installed implementation does not access credential directories, start background services, perform automatic updates, or transmit inspected content.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

YARA rule 'agent_skill_remote_bootstrap_execution': Remote script or code download followed by execution/bootstrap installation [agent_skills]

High
Category
YARA Match
Confidence
89% confidence
Finding

Installing directly from a remote GitHub repository via pip executes an unreviewed build/install chain from a network source at install time, even when pinned to a commit. A pinned commit improves reproducibility but does not eliminate supply-chain risk, dependency confusion, or malicious setup/build logic in the fetched repository or its transitive dependencies.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
y scanning, and one-click backup & restore
version: 0.1.11
disable-model-invocation: true
homepage: https://github.com/milu-ai/openclaw360
install:
  - name: "pip install (pinned commit)"
    command: "pip3 install git+https://github.com/milu-ai/openclaw360.git@5fd69db"
  - name: "pip install (venv, for Homebrew Python)"
    command: "python3 -m venv ~/.openclaw360-venv && ~/.openclaw360-venv/bin/pip install git+https://github.com/milu-ai/openclaw360.git@5fd69db"
metadata:
  clawdbot:
    emoji: "🛡️"
    always: false
    source: https://github.com/milu-ai/openclaw360
    install:
      - name: "pip install (pinned commit)"
        command: "pip3 install git+https://github.com/milu-ai/openclaw360.git@5fd69db"
      - name: "pip install (venv, for Homebrew Python)"
        command: "python3 -m venv ~/.openclaw360-venv && ~/.openclaw360-venv/bin/pip install git+https://github.com/milu-ai/openclaw360.git@5fd69db"
    requires:
      bins: ["python3"]
      env: []
      config:

Scope Creep

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill states that writes are limited to ~/.openclaw360/, but its fallback install path creates ~/.openclaw360-venv outside that declared scope. This weakens user consent and transparency because installation performs filesystem modifications beyond the documented boundary, which can undermine trust and bypass policy expectations in constrained environments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The Data Handling section says all data is stored only under ~/.openclaw360/, but the installation instructions create and use ~/.openclaw360-venv outside that directory. This is dangerous because it creates undocumented persistent artifacts on disk, reducing transparency about what the skill installs and where code and packages are stored.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
## Permissions

- 需要 `python3`（3.10+）
- 不需要 sudo 权限

读取操作：
- 读取用户指定的文本输入（check-prompt、check-tool、check-output 命令的参数）

Scope Creep

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill claims it does not access other application data directories, yet later instructs scanning OpenClaw skill directories outside ~/.openclaw360/, including system installation paths. Even if read-only, this is still broader data access than disclosed and may expose metadata or contents from other applications without clear prior disclosure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
79% confidence
Finding

The Network Access section frames the skill as strictly local and bounded, while later instructions direct scan-skills to inspect /opt/homebrew/lib/node_modules/openclaw/skills/, which is outside the user-owned ~/.openclaw360/ area and broader than the earlier resource-boundary narrative. This is not just omitted detail: the documentation presents a constrained local-access story that later expands to additional application directories.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The language rules require the agent to use --lang zh for Chinese users and state that the entire reply must match the user's language. This imposes a locale/language behavior by policy without presenting it as an opt-in choice or clearly documenting a compliance-driven justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.