T06 · System Persistence
Error
- Location
SKILL.md:56- Finding
Installation of a Persistent System Daemon
- Content
View full analysis
- Remediation
View remediation
Security audit
openclaw-relation
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly an OpenClaw documentation reference, but it defaults users toward a mutable global install and persistent daemon while describing sensitive remote/device automation with limited safety guidance.
Review carefully before installing. Prefer a pinned OpenClaw version, understand what daemon/service will be installed and how to remove it, restrict gateway and webhook access to trusted users/networks, and only enable camera, location, audio, or remote-control features with explicit consent and logging.
Vulnerability Patterns
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:50- Finding
Unpinned Global npm Package Installation
- Content
View full analysis
- Remediation
View remediation
`. 2. Publish and verify cryptographic integrity information or package signatures through a documented trusted process. 3. Avoid global installation where possible. Prefer a project-local dependency with a committed lockfile and a controlled execution command. 4. Review and lock the complete transitive dependency graph before recommending installation. 5. Document the expected npm publisher identity and provide a procedure for verifying package provenance. 6. Consider disabling npm lifecycle scripts during initial acquisition where functionality permits, then explicitly review any required scripts before execution. 7. Run installation in an isolated, non-privileged environment and do not recommend elevated installation. 8. Separate package installation from daemon registration so users can inspect and test the pinned package before granting it persistent execution. 9. Establish an update policy that requires review and integrity verification before changing the documented version. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The natural-language instructions and description are presented in Chinese only, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. This can violate language or locale policy when a skill imposes a language without user opt-in.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger description says the skill will automatically activate for general OpenClaw-related questions, which is broad enough to cause unintended invocation outside narrowly scoped user intent. Overly broad activation can route conversations to this skill when a more appropriate tool or a plain response should be used, increasing the chance of undesired actions, misleading answers, or exposure of operational guidance in the wrong context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README documents remote access and device-location/camera capabilities without adjacent warnings about privacy, consent, network exposure, or abuse potential. In a skill that may guide agent behavior, normalizing these capabilities without safeguards can lead users to enable invasive features or expose the gateway remotely with insufficient understanding of the risks.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Automation Features
Cron Jobs
Schedule periodic tasks:
bash openclaw cron create "0 9 * * *" "Good morning"
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
Schedule periodic tasks:
bash openclaw cron create "0 9 * * *" "Good morning"Heartbeat
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Documenting webhooks and hooks that execute scripts without warning about arbitrary command execution can mislead users into wiring untrusted events directly to local actions. Because this product bridges external chat/events to automation, the omission increases the chance of destructive or attacker-triggered script execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Reset and uninstall commands are listed as routine operations without warning that they may delete configuration, sessions, paired channels, or stored data. In agent and gateway tooling, such omissions can cause accidental destructive actions and loss of audit or recovery information.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
An automatic trigger for broadly defined 'OpenClaw-related questions' can cause the skill to activate in contexts where it was not intended, increasing the chance that powerful operational guidance is surfaced unnecessarily. In systems that can manage gateways, channels, nodes, and automation, over-broad activation expands exposure to risky instructions and sensitive operational workflows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill documents privacy- and system-sensitive capabilities such as remote camera capture, location access, audio recording, webhooks, hooks, and remote gateway exposure, but it does not pair these features with explicit warnings about consent, authentication, least privilege, or audit requirements. In a skill that serves as a knowledge base and operational guide, this omission can normalize risky deployment patterns and lead users to enable invasive or remotely reachable features without understanding the security implications.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
定期执行任务：
bash openclaw cron create "0 9 * * *" "早上好"Heartbeat
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
定期执行任务:
bash openclaw cron create "0 9 * * *" "早上好"Heartbeat
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
Node Capabilities
Pair mobile devices to extend functionality:
bash openclaw nodes pair
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
Node Capabilities
Pair mobile devices to extend functionality:
bash openclaw nodes pair
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file is an English README, but its official documentation link points specifically to the
zh-CNlocale. This creates a language/locale constraint without user opt-in or an alternative language option, which fits the natural-language policy concern for forced locale.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The description and homepage explicitly present the skill as Chinese-language documentation (including a zh-CN locale URL), and the file content is written entirely in Chinese without indicating that other languages are available by user choice. This can violate language/locale policy when a skill imposes one locale without opt-in or justification.
- Content
Static analysis
No suspicious patterns detected.