Security Audit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:23 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate read-only OpenClaw audit skill, but it asks the agent to gather broad host details and may expose configuration secrets to the agent context.

Install only if you are comfortable letting the agent inspect host-level security posture. Prefer running it in a controlled session, ask it to limit checks to OpenClaw paths and non-secret config fields by default, and require explicit approval before whole-host enumeration or complete config-file reads.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: SKILL.md:43

Finding

Overly Broad Host Reconnaissance Exceeds the Minimum Scope of an OpenClaw Audit

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43-53, 64-68, and 110-124
Vulnerability Type: Excessive environment reconnaissance
Risk Level: Medium

Relevant code snippets:

text

### 0) Identify Environment
1. Determine OS and host context:
   - `uname -a`
   - `cat /etc/os-release`
   - `hostname`
2. Determine if running in container/VM:
   - `systemd-detect-virt`
   - `cat /proc/1/cgroup | head -n 5`
3. Determine working dir and user:
   - `pwd`
   - `whoami`

text

### 2) Network Exposure & Listening Services
1. List open ports:
   - `ss -tulpen`
2. Identify whether gateway ports are bound to **localhost only** or **public**.
3. Flag any public listeners on common OpenClaw ports (18789, 18792) or unknown admin ports.

text

### 8) File Permissions & Privilege Escalation Risks
1. Check for risky permissions on key dirs:
   - `ls -ld ~/.openclaw`
   - `ls -l ~/.openclaw | head -n 50`
2. Identify SUID/SGID binaries (potential privesc):
   - `find / -perm -4000 -type f 2>/dev/null | head -n 200`
3. Flag if OpenClaw runs as root or with unnecessary sudo.

### 9) Process & Persistence Indicators
1. Check for unexpected cron jobs:
   - `crontab -l`
   - `ls -la /etc/cron.* 2>/dev/null`
2. Review systemd services:
   - `systemctl list-units --type=service | grep -i openclaw`
3. Flag unknown services related to OpenClaw or skills.

Technical Analysis

The Skill is declared as a read-only OpenClaw security auditor, but its workflow includes broad host-level discovery. It enumerates host identity, virtualization details, execution context, all listening sockets, system-wide SUID executables, user cron entries, system cron directories, and services.

Some of this information can legitimately support an authorized security audit. However, system-wide SUID enumeration, unrestricted listener discovery, and general persistence i ...[truncated 2448 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict the default workflow to OpenClaw-specific resources:
   • Inspect only documented OpenClaw ports.
   • Query only OpenClaw process IDs and service units.
   • Limit file inspection to ~/.openclaw and explicitly configured OpenClaw paths.
2. Move system-wide checks such as SUID enumeration, all-listener discovery, cron inspection, and global service review into an optional extended audit.
3. Require explicit informed consent before running host-wide checks.
4. Explain which data each optional command collects and why it is necessary.
5. Filter and summarize results locally so unrelated host details do not enter the Agent context.
6. Avoid retaining raw command output in reports, telemetry, or conversation history.
7. Continue treating cron and service commands as read-only; never create, modify, enable, or disable persistence mechanisms without a separate remediation request and confirmation.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:70

Finding

OpenClaw Configuration May Be Read Without Preventing Secret Exposure to Agent Context

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 70-73
Vulnerability Type: Plaintext sensitive data exposure
Risk Level: Medium

Complete relevant code snippet:

text

### 3) Gateway Bind & Auth Configuration
1. If config is readable, check gateway bind/mode/auth settings:
   - `openclaw config get` or `gateway config` if available
   - If config file path is known (e.g., `~/.openclaw/config.json`), read it **read-only**.

Technical Analysis

The Skill directs the Agent to execute a general configuration command or read the complete OpenClaw configuration file. Such output may include authentication tokens, API keys, credentials, private endpoints, or other sensitive values.

Although the Skill states elsewhere that secrets must be redacted in the final report, report-time redaction occurs after command output has already been returned to the Agent. Consequently, plaintext secrets can still appear in tool output, the model context, terminal logs, telemetry, or retained conversation history.

Read-only access prevents modification but does not prevent disclosure. The least-privilege approach would query only the specific non-secret fields required to evaluate gateway binding, authentication mode, and proxy trust. If whole-file inspection is unavoidable, redaction must occur locally before content is returned to the Agent.

Attack Path

1. The user requests an OpenClaw security audit.
2. The Agent runs openclaw config get or reads ~/.openclaw/config.json.
3. The configuration output includes a token, credential, or another sensitive value.
4. The raw value enters the Agent context before final-report redaction is applied.
5. The value is retained in conversation history, tool logs, telemetry, or terminal output.
6. A party with access to those records, or a malicious component sharing the session context, retrieves the credential.
7. The exposed credential is used according ...[truncated 967 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not read or print the complete configuration by default.
2. Query only an allowlist of non-secret properties needed for the audit, such as:
   • Gateway bind address.
   • Authentication-enabled status.
   • Authentication method name without credential values.
   • Trusted proxy configuration.
   • Control UI exposure settings.
3. Perform local redaction before output reaches the Agent. Replace values for keys matching patterns such as token, secret, password, credential, apiKey, privateKey, and authorization.
4. Report only whether a secret is configured and whether its file permissions are safe; never report the value.
5. Require explicit user approval before any whole-file configuration inspection.
6. Disable command echoing where practical and avoid retaining raw configuration output in logs or transcripts.
7. If a secret is accidentally displayed, warn the user, remove it from retained records where possible, and recommend rotating the affected credential.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (6)

YARA rule 'privilege_escalation_tools': Privilege escalation tools and techniques [hacktools]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

entify world‑readable or group‑readable secret files:
   - `find ~/.openclaw -type f -perm -o+r -maxdepth 4 2>/dev/null | head -n 50`
3. Report only **paths**, never contents.

### 8) File Permissions & Privilege Escalation Risks
1. Check for risky permissions on key dirs:
   - `ls -ld ~/.openclaw`
   - `ls -l ~/.openclaw | head -n 50`
2. Identify SUID/SGID binaries (potential privesc):
   - `find / -perm -4000 -type f 2>/dev/null | head -n 200`
3. Flag if OpenClaw runs as root or with unnecessary sudo.

### 9) Process & Persistence Indicators
1. Check for unexpected cron jobs:
   - `crontab -l`
   - `ls -la /etc/cron.* 2>/dev/null`
2. Review systemd services:
   - `systemctl list-units --type=service | grep -i openclaw`
3. Flag unknown services related to OpenClaw or skills.

### 10) Logs & Audit Trails
1. Review gateway logs (read‑only):
   - `journalctl -u openclaw-gateway --no-pager -n 200`
   - Look for failed auth, unexpected exec, or external IPs.

## Common Findings & Fix

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

- **Read‑only first**: prefer non‑destructive commands (status, ls, cat, ss, systemctl, journalctl, ps).
- **No exfiltration**: never send secrets off the host. If you detect secrets, **redact** them in your report.
- **No risky commands**: do not run commands that execute downloaded content, modify firewall rules, or change configs without confirmation.
- **Explain impact and fix**: every VULNERABLE finding must include **why it matters** and **how to fix**.

## Required Output Format

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md

- Is `exec` enabled? Is approval required?
   - Are dangerous tools enabled (shell, browser, file I/O) without prompts?
2. Flag if:
   - `exec` runs without approvals in main session.
   - Tools can run on gateway/host with high privileges.

### 6) Skills & Supply‑Chain Risk Review

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

### 8) File Permissions & Privilege Escalation Risks
1. Check for risky permissions on key dirs:
   - `ls -ld ~/.openclaw`
   - `ls -l ~/.openclaw | head -n 50`
2. Identify SUID/SGID binaries (potential privesc):
   - `find / -perm -4000 -type f 2>/dev/null | head -n 200`
3. Flag if OpenClaw runs as root or with unnecessary sudo.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

### 9) Process & Persistence Indicators
1. Check for unexpected cron jobs:
   - `crontab -l`
   - `ls -la /etc/cron.* 2>/dev/null`
2. Review systemd services:
   - `systemctl list-units --type=service | grep -i openclaw`

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md

- **Publicly exposed gateway/UI** �?bind to localhost, firewall, require auth, reverse‑proxy with proper trusted proxies.
- **Old vulnerable versions** �?upgrade to latest release, rotate tokens, invalidate sessions.
- **Unsafe exec policy** �?require approvals, limit tools to sandbox, drop root privileges.
- **Plaintext secrets** �?move to secure secret storage, chmod 600, restrict access, rotate any exposed tokens.
- **Untrusted skills** �?remove, audit contents, only install from trusted authors.

## Report Completion

Static analysis

No suspicious patterns detected.