T08 · Insecure Dependencies
Warning
- Location
SKILL.md:134- Finding
Unpinned npm Package Execution and Privileged Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
reinstall-openclaw
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its reinstall purpose, but it asks users to run powerful cleanup and install commands that could delete sensitive OpenClaw data or execute unverified npm code with elevated privileges.
Install only if you are comfortable reviewing and adapting the commands. Before running it, make an encrypted verified backup, avoid sudo npm and @latest where possible, use a trusted pinned OpenClaw version or verified local binary, inspect what will be restored, and prefer renaming old directories over immediately deleting them.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:88- Finding
Unsafe Destructive Cleanup and Broad Process Termination
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (27)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 93% confidence
- Finding
The broader pattern match on
rm -rf ~reflects that home-directory-rooted recursive deletions are inherently hazardous even when the suffix narrows scope. In shell documentation, such commands deserve special care because small edits, variable expansion issues, or formatting mistakes can widen deletion scope dramatically.- Content
sudo npm uninstall -g openclaw
Remove any remaining .openclaw directories
rm -rf ~/.openclaw rm -rf ~/.openclaw-dev
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 93% confidence
- Finding
The broader pattern match on
rm -rf ~reflects that home-directory-rooted recursive deletions are inherently hazardous even when the suffix narrows scope. In shell documentation, such commands deserve special care because small edits, variable expansion issues, or formatting mistakes can widen deletion scope dramatically.- Content
sudo npm uninstall -g openclaw
Remove any remaining .openclaw directories
rm -rf ~/.openclaw rm -rf ~/.openclaw-dev
text
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 92% confidence
- Finding
Even though the intended target is
~/.openclaw-dev, the use ofrm -rfunder the home directory falls into a class of commands with high misuse potential. In a skill designed for broad user execution, destructive shell commands are more dangerous because many users will copy them verbatim without validating the target.- Content
Remove any remaining .openclaw directories
rm -rf ~/.openclaw rm -rf ~/.openclaw-dev
text ### Step 6: Install Latest OpenClaw
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 92% confidence
- Finding
Even though the intended target is
~/.openclaw-dev, the use ofrm -rfunder the home directory falls into a class of commands with high misuse potential. In a skill designed for broad user execution, destructive shell commands are more dangerous because many users will copy them verbatim without validating the target.- Content
Remove any remaining .openclaw directories
rm -rf ~/.openclaw rm -rf ~/.openclaw-dev
text ### Step 6: Install Latest OpenClaw
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The skill repeatedly instructs users to run
npx openclawwithout pinning a specific package version.npxmay fetch and execute the latest published package, so a compromised or malicious upstream release could result in arbitrary code execution during uninstall, doctor, gateway, or status operations.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 91% confidence
- Finding
The skill explicitly preserves and restores full user state including credentials, devices, memory databases, agents, and installed skills. While persistence is the purpose of a reinstall backup, from a security perspective it also preserves potentially compromised sessions, stale tokens, malicious skills, and unauthorized paired-device state across the reinstall.
- Content
Step 2: Backup All User Data
Create a complete backup of all user configurations:
bash # Create backup directory with timestamp
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The backup guidance copies
~/.openclaw, which the document explicitly says contains tokens, API keys, credentials, paired-device data, and memory files, yet it does not warn that the backup itself becomes a high-value secret bundle. Recommending cloud or external storage without encryption guidance increases the chance of credential disclosure and account compromise.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
This invocation uses
npx openclawwithout a pinned version, allowing execution of whatever version npm resolves at runtime. In a reinstall workflow, that expands trust to the package registry during a sensitive maintenance operation and can lead to arbitrary code execution if the package or dependency chain is compromised.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill documents destructive uninstall and
rm -rfcleanup steps, but the warnings are not explicit enough about irreversible loss if the backup is incomplete, corrupt, or restores incorrectly. In a workflow that touches credentials, memory databases, skills, and workspace data, this can cause permanent loss or partial state corruption.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
An unpinned
npx openclawcommand in an uninstall step can execute unexpected code from a newly published package version. Because this command is part of a privileged maintenance path and may be run by administrators, the blast radius includes deletion, persistence changes, and credential exposure.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
This unpinned
npx openclawusage relies on live package resolution, which can execute attacker-controlled code if the npm package is hijacked or replaced. Since it occurs during uninstall guidance, users may run it assuming it is safe while granting it broad access to local state.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 87% confidence
- Finding
The use of
sudo npm uninstall -g openclawrequires elevated privileges and can magnify the impact of mistakes or malicious package lifecycle behavior. Although common in system-wide package management, recommending privileged npm operations in a skill increases risk, especially in a document already relying on registry-fetched packages.- Content
md npm cache clean --force # Remove old OpenClaw npm package if still exists sudo npm uninstall -g openclaw # Remove any remaining .openclaw directories rm -rf ~/.openclaw
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
sudo npm install -g openclaw@latestcombines root privileges with installation of the latest available registry package, creating a strong supply-chain and privilege-escalation risk. A compromised or typo-squatted package executed during installation could run arbitrary code as root.- Content
bash # Install globally sudo npm install -g openclaw@latest # Verify installation npx openclaw --version
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
The verification command uses
npx openclawwithout pinning, which can trigger download and execution of an unexpected version even immediately after installation. That undermines trust in the reinstall process and creates an avoidable supply-chain execution point.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
cp -r ~/openclaw-backup-YYYYMMDD/* ~/.openclaw/
Set correct permissions
chmod 700 ~/.openclaw
text ### Step 8: Run Health Check and Fix
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
cp -r ~/openclaw-backup-YYYYMMDD/* ~/.openclaw/
Set correct permissions
chmod 700 ~/.openclaw
text ### Step 8: Run Health Check and Fix
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
cp -r ~/openclaw-backup-YYYYMMDD/* ~/.openclaw/
Set correct permissions
chmod 700 ~/.openclaw
text ### Step 8: Run Health Check and Fix
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
cp -r ~/openclaw-backup-YYYYMMDD/* ~/.openclaw/
Set correct permissions
chmod 700 ~/.openclaw
text ### Step 8: Run Health Check and Fix
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Running
npx openclaw doctor --fixwithout version pinning allows arbitrary code execution through package resolution at runtime. The--fixbehavior also suggests state-changing actions, making compromise potentially more damaging than a read-only check.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
Starting the gateway via unpinned
npx openclawcan execute a malicious package version and establish persistence or network exposure. Because this command launches a service, compromise could result in long-lived unauthorized access or credential harvesting.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The health check command uses
npx openclawwithout version pinning, creating another supply-chain execution point. Even though it sounds diagnostic, the command still grants code execution in the user's environment if npm resolves a malicious package.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The status command is also unpinned and may fetch and run an untrusted package version. While the immediate action is informational, compromise still enables arbitrary code execution in a context where sensitive config and credentials are present.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The one-liner backup script automates persistence of all OpenClaw state into a timestamped archive, which can carry forward sensitive sessions and previously compromised configuration. In a reinstall context, this makes cleanup less effective if the original environment was tampered with.
- Content
Complete One-Liner Backup Script
Run this before uninstalling to create a timestamped backup:
bash # Create automatic backup
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The troubleshooting stop command again uses unpinned
npx openclaw, exposing users to the same package-resolution risk during incident handling. Security-sensitive recovery steps are especially dangerous places to introduce unauthenticated remote code execution paths.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The force-start troubleshooting command uses unpinned
npx openclaw, which may execute a malicious version precisely when the user is bypassing safeguards with--force. That combination increases the risk of unsafe state changes and persistence.- Content