ClawHub
Back to skill

Security audit

Openclaw Agent Builder

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only OpenClaw agent-building skill whose file and configuration guidance is coherent with its stated purpose.

Before installing, review any generated agent configuration that enables hooks, heartbeat checks, memory, or session cleanup, since those settings can affect what the agent runs, remembers, or deletes. The skill itself is documentation-only and does not automatically perform those actions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Session Persistence

Medium
Category
Rogue Agent
Content
1. **创建工作空间**
   ```bash
   mkdir -p ~/openclaw-workspaces/<agent-name>
   cd ~/openclaw-workspaces/<agent-name>
   openclaw setup --workspace .
   ```
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
In the session management section, the markdown instructs users to run `openclaw sessions delete <sessionId>` but does not warn that this removes stored conversation history. For markdown files, destructive operations that can affect user data should be accompanied by a warning about impact or irreversibility.

Session Persistence

Medium
Category
Rogue Agent
Content
### 每日记忆

```bash
mkdir -p ~/.openclaw/workspace/memory
touch ~/.openclaw/workspace/memory/$(date +%Y-%m-%d).md
```
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Low
Confidence
82% confidence
Finding
The document presents the skill guidance in Chinese and later shows `语言：中文` as the user language example, but it does not indicate that language is configurable or that the skill is intentionally limited to a Chinese-language audience. This can conflict with a language/locale policy requiring user choice or explicit justification for a fixed locale.

Static analysis

No suspicious patterns detected.