Security audit

Config Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill openly tracks OpenClaw configuration files, but it automatically creates Git history for sensitive workspace and home-directory files without enough user control or safeguards.

Review this before installing if your OpenClaw files may contain credentials, private endpoints, personal data, or sensitive agent instructions. Install only if you intentionally want automatic Git history for these files, and consider disabling it or narrowing the tracked file list before use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: config-tracker.js:31
Finding: Automatic Git Versioning Persistently Retains Sensitive Configuration and Agent Data
Content: View full analysis
path.join(workspacePath, f)); const existingWorkspaceFiles = await Promise.all( workspaceFiles.map(async (f) => ({ path: f, exists: await fileExists(f) })) ); const validWorkspaceFiles = existingWorkspaceFiles .filter(f => f.exists) .map(f => f.path); if (validWorkspaceFiles.length > 0) { // Ensure git repo exists for workspace await initGitRepo(workspacePath, this.config); const changedWorkspaceFiles = await hasChanges(workspacePath, validWorkspaceFiles); if (changedWorkspaceFiles.length > 0) { await commitChanges(workspacePath, changedWorkspaceFiles, this.config); } } // 2. Track openclaw.json const openclawConfigPath = expandTilde(this.config.openclawConfig); const openclawDir = path.dirname(openclawConfigPath); if (await fileExists(openclawConfigPath)) { // Ensure git repo exists for ~/.openclaw/ await initGitRepo(openclawDir, this.config); const changedConfigFiles = await hasChanges(openclawDir, [openclawConfigPath]); if (changedConfigFiles.length > 0) { await commitChanges(openclawDir, changedConfigFiles, this.config); } } } ``` ### Technical Analys ...[truncated 2302 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: config-tracker.js:228
Finding: Automatic Commits Include Unrelated Changes Already Present in the Shared Git Index
Content: View full analysis
0) { message += "\n\n" + changeSummaries.map(s => `${s.path} (${s.stats}): ${s.description}` ).join("\n"); } await gitRun(repoDir, ["commit", "-m", message], { name: config.gitUserName, email: config.gitUserEmail }); log.info(`Committed: ${message.split("\n")[0]}`); log.debug(`Full commit message:\n${message}`); } catch (error) { log.error("Error committing changes:", error); } } ``` ### Technical Analysis The plugin limits its `git add` operation to selected files, but the subsequent `git commit` operation is not limited to those paths. A normal Git commit records the complete state of the shared index, including changes staged before the plugin ran. The unrestricted `git status --porcelain` check also examines the overall repository rather than confirming that only the intended paths are staged. The generated summary covers the plugin-selected files, so un ...[truncated 1762 chars]
Remediation: View remediation
-- `, after verifying behavior for new and deleted files. 3. Insert `--` before user-configurable path arguments to clearly separate options from paths: ```js await gitRun(repoDir, ["add", "--", ...files], gitConfig); ``` 4. Inspect staged paths with `git diff --cached --name-only -- ` and abort if the intended staged set cannot be isolated. 5. Preserve and restore the original index if temporary manipulation is unavoidable, including robust cleanup in a `finally` block. 6. Add integration tests in which unrelated changes are staged before the hook runs and verify that those changes remain staged but uncommitted afterward. 7. Ensure the commit summary is derived from the exact tree content being committed, rather than only from the plugin's expected file list. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The plugin monitors and commits changes to ~/.openclaw/openclaw.json in the user's home directory, outside the active workspace. Tracking and persisting changes in a home-directory config broadens scope beyond the project boundary and may capture sensitive configuration, tokens, endpoints, or personal settings into a local Git history without clear consent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The tracked file list includes highly sensitive natural-language files such as USER.md, SOUL.md, MEMORY.md, and IDENTITY.md, and the skill says these are automatically committed whenever they change. This creates a strong data retention and disclosure risk because personal data, agent memory, internal instructions, or secrets can be durably stored in Git history and later exposed through logs, backups, sync, or repository sharing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly states it will automatically initialize Git repositories and create commits on every conversation turn via a hook, without any described user confirmation or prominent warning about persistent history changes. This is dangerous because it silently mutates repository state and creates durable audit/history records that may capture sensitive configuration or prompt-related changes users did not intend to retain.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill automatically initializes a Git repository in the workspace and creates commits without explicit user approval. Even if intended for backup/auditing, silently modifying repository state is security-relevant because it changes user files, creates history the user did not request, and may interfere with existing workflows or compliance expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill performs automatic staging and commits during a before_prompt_build hook, meaning normal conversation activity can trigger filesystem and repository modifications with no user confirmation. This hidden side effect is dangerous because it violates user expectations, can repeatedly alter local state, and may preserve sensitive content in commit history where deletion is harder.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest registers a before_prompt_build hook, which runs automatically on a broad and sensitive lifecycle event before every prompt is assembled. In the context of a skill described as tracking and committing configuration and markdown changes, this creates a meaningful security risk because the hook can observe or act on workspace and configuration state without an explicit per-use trigger, increasing the chance of unintended data collection or automatic git operations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The package description is written entirely in Chinese ("自动追踪并提交...") with no indication that language choice is optional or that the skill is region-specific. This can violate language/locale policy because it imposes a specific language in user-facing metadata without documented opt-in or justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest description says the skill will automatically track and commit OpenClaw configuration files and key markdown files, but it does not define clear trigger boundaries, file scope, or activation constraints. In a hook-based skill running before prompt build, vague scope can enable unexpected collection or modification of sensitive repository content, increasing the risk of unauthorized commits or overbroad file handling.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The description is written in Chinese and appears to prescribe behavior without any indication of user language preference or opt-in. Forcing or assuming a specific language can reduce transparency for users and reviewers, making it harder to understand that the skill auto-tracks and commits files, which indirectly increases security risk by obscuring impactful behavior.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The natural-language instructions and warnings in this skill are presented only in Chinese. This can violate a language/locale policy when the skill does not offer the user a language choice or document that the locale restriction is intentional and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The top-level natural-language description is written entirely in Chinese and presents the skill behavior and trigger timing in that language without offering a language choice or documenting a locale-specific justification. This can violate language/locale policy when a skill imposes a specific language absent user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description is written only in Chinese (自动追踪并提交...) with no indication that the skill is region-specific or that users can choose their language or locale. This can violate language/locale policy expectations when a skill implicitly enforces a specific language without opt-in.
Content: No source excerpt is available for this finding.