Security Audit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:19 AM UTC
• Version: 2.0.0

Overview

The skill is a read-only OpenClaw security auditor, but its default workflow performs broad host reconnaissance that can expose sensitive system details.

Install only if you want a host-level security audit, not just an OpenClaw configuration check. Run it as an unprivileged user, review the broad enumeration commands before use, avoid storing raw output in shared logs or memory, and require explicit approval before any remediation commands are run.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:114

Finding

Overbroad Host Reconnaissance Exceeds the Minimum OpenClaw Audit Scope

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:43-53, SKILL.md:64-68, SKILL.md:102-129
Vulnerability Type: Excessive system enumeration and least-privilege boundary violation
Risk Level: Medium

Relevant Code

markdown

### 0) Identify Environment
1. Determine OS and host context:
   - `uname -a`
   - `cat /etc/os-release`
   - `hostname`
2. Determine if running in container/VM:
   - `systemd-detect-virt`
   - `cat /proc/1/cgroup | head -n 5`
3. Determine working dir and user:
   - `pwd`
   - `whoami`

markdown

### 2) Network Exposure & Listening Services
1. List open ports:
   - `ss -tulpen`
2. Identify whether gateway ports are bound to **localhost only** or **public**.
3. Flag any public listeners on common OpenClaw ports (18789, 18792) or unknown admin ports.

markdown

### 7) Credentials & Secret Storage
1. Check for plaintext secrets locations:
   - `~/.openclaw/` directories
   - `.env` files, token dumps, backups
2. Identify world-readable or group-readable secret files:
   - `find ~/.openclaw -type f -perm -o+r -maxdepth 4 2>/dev/null | head -n 50`
3. Report only **paths**, never contents.

### 8) File Permissions & Privilege Escalation Risks
1. Check for risky permissions on key dirs:
   - `ls -ld ~/.openclaw`
   - `ls -l ~/.openclaw | head -n 50`
2. Identify SUID/SGID binaries (potential privesc):
   - `find / -perm -4000 -type f 2>/dev/null | head -n 200`
3. Flag if OpenClaw runs as root or with unnecessary sudo.

### 9) Process & Persistence Indicators
1. Check for unexpected cron jobs:
   - `crontab -l`
   - `ls -la /etc/cron.* 2>/dev/null`
2. Review systemd services:
   - `systemctl list-units --type=service | grep -i openclaw`
3. Flag unknown services related to OpenClaw or skills.

### 10) Logs & Audit Trails
1. Review gateway logs (read-only):
   - `journalctl -u openclaw-gateway --no-pager
...[truncated 2790 chars]

Remediation

View remediation

Remediation Suggestions

1. Restrict the default workflow to OpenClaw-owned paths, known gateway ports, OpenClaw processes, and explicitly named OpenClaw services.
2. Move system-wide SUID, cron, listener, and service enumeration into a separate optional host-hardening phase.
3. Require explicit informed approval before executing host-wide checks, clearly listing the commands and data categories they may expose.
4. Replace find / -perm -4000 with a scoped search of OpenClaw installation paths unless a full host audit is explicitly requested.
5. Filter listener results to known OpenClaw ports and processes rather than returning all host listeners.
6. Continue reporting only secret-file paths, but redact usernames, home directories, external IP addresses, tokens, command-line credentials, and other sensitive values.
7. Avoid storing raw command output in reports or persistent agent memory; summarize only the evidence needed to support each finding.
8. Run the audit under a dedicated unprivileged account without unrestricted sudo, and document the minimum permissions required for each optional check.
9. Mark checks as UNKNOWN when the required data is inaccessible rather than requesting or assuming elevated privileges.
10. Retain the existing prohibition against modifying configuration, rotating keys, terminating processes, or performing remediation without explicit user approval.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (6)

YARA rule 'privilege_escalation_tools': Privilege escalation tools and techniques [hacktools]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md

entify world‑readable or group‑readable secret files:
   - `find ~/.openclaw -type f -perm -o+r -maxdepth 4 2>/dev/null | head -n 50`
3. Report only **paths**, never contents.

### 8) File Permissions & Privilege Escalation Risks
1. Check for risky permissions on key dirs:
   - `ls -ld ~/.openclaw`
   - `ls -l ~/.openclaw | head -n 50`
2. Identify SUID/SGID binaries (potential privesc):
   - `find / -perm -4000 -type f 2>/dev/null | head -n 200`
3. Flag if OpenClaw runs as root or with unnecessary sudo.

### 9) Process & Persistence Indicators
1. Check for unexpected cron jobs:
   - `crontab -l`
   - `ls -la /etc/cron.* 2>/dev/null`
2. Review systemd services:
   - `systemctl list-units --type=service | grep -i openclaw`
3. Flag unknown services related to OpenClaw or skills.

### 10) Logs & Audit Trails
1. Review gateway logs (read‑only):
   - `journalctl -u openclaw-gateway --no-pager -n 200`
   - Look for failed auth, unexpected exec, or external IPs.

## Common Findings & Fix

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

- **Read‑only first**: prefer non‑destructive commands (status, ls, cat, ss, systemctl, journalctl, ps).
- **No exfiltration**: never send secrets off the host. If you detect secrets, **redact** them in your report.
- **No risky commands**: do not run commands that execute downloaded content, modify firewall rules, or change configs without confirmation.
- **Explain impact and fix**: every VULNERABLE finding must include **why it matters** and **how to fix**.

## Required Output Format

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.

md

- Is `exec` enabled? Is approval required?
   - Are dangerous tools enabled (shell, browser, file I/O) without prompts?
2. Flag if:
   - `exec` runs without approvals in main session.
   - Tools can run on gateway/host with high privileges.

### 6) Skills & Supply‑Chain Risk Review

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md

### 8) File Permissions & Privilege Escalation Risks
1. Check for risky permissions on key dirs:
   - `ls -ld ~/.openclaw`
   - `ls -l ~/.openclaw | head -n 50`
2. Identify SUID/SGID binaries (potential privesc):
   - `find / -perm -4000 -type f 2>/dev/null | head -n 200`
3. Flag if OpenClaw runs as root or with unnecessary sudo.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.

md

### 9) Process & Persistence Indicators
1. Check for unexpected cron jobs:
   - `crontab -l`
   - `ls -la /etc/cron.* 2>/dev/null`
2. Review systemd services:
   - `systemctl list-units --type=service | grep -i openclaw`

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md

- **Publicly exposed gateway/UI** �?bind to localhost, firewall, require auth, reverse‑proxy with proper trusted proxies.
- **Old vulnerable versions** �?upgrade to latest release, rotate tokens, invalidate sessions.
- **Unsafe exec policy** �?require approvals, limit tools to sandbox, drop root privileges.
- **Plaintext secrets** �?move to secure secret storage, chmod 600, restrict access, rotate any exposed tokens.
- **Untrusted skills** �?remove, audit contents, only install from trusted authors.

## Report Completion

Static analysis

No suspicious patterns detected.