ClawHub
Back to skill

Security audit

Security Audit

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only security-audit skill that inspects local OpenClaw settings and system indicators while explicitly limiting changes and secret exposure.

Install this only if you want an agent to run local security-audit commands on the target host. Expect it to inspect OpenClaw configuration, ports, processes, logs, permissions, and persistence indicators; review any external setup guide separately because it was not part of the local artifact.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (6)

YARA rule 'privilege_escalation_tools': Privilege escalation tools and techniques [hacktools]

High
Category
YARA Match
Content
entify world‑readable or group‑readable secret files:
   - `find ~/.openclaw -type f -perm -o+r -maxdepth 4 2>/dev/null | head -n 50`
3. Report only **paths**, never contents.

### 8) File Permissions & Privilege Escalation Risks
1. Check for risky permissions on key dirs:
   - `ls -ld ~/.openclaw`
   - `ls -l ~/.openclaw | head -n 50`
2. Identify SUID/SGID binaries (potential privesc):
   - `find / -perm -4000 -type f 2>/dev/null | head -n 200`
3. Flag if OpenClaw runs as root or with unnecessary sudo.

### 9) Process & Persistence Indicators
1. Check for unexpected cron jobs:
   - `crontab -l`
   - `ls -la /etc/cron.* 2>/dev/null`
2. Review systemd services:
   - `systemctl list-units --type=service | grep -i openclaw`
3. Flag unknown services related to OpenClaw or skills.

### 10) Logs & Audit Trails
1. Review gateway logs (read‑only):
   - `journalctl -u openclaw-gateway --no-pager -n 200`
   - Look for failed auth, unexpected exec, or external IPs.

## Common Findings & Fix
Confidence
75% confidence
Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- **Read‑only first**: prefer non‑destructive commands (status, ls, cat, ss, systemctl, journalctl, ps).
- **No exfiltration**: never send secrets off the host. If you detect secrets, **redact** them in your report.
- **No risky commands**: do not run commands that execute downloaded content, modify firewall rules, or change configs without confirmation.
- **Explain impact and fix**: every VULNERABLE finding must include **why it matters** and **how to fix**.

## Required Output Format
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- Is `exec` enabled? Is approval required?
   - Are dangerous tools enabled (shell, browser, file I/O) without prompts?
2. Flag if:
   - `exec` runs without approvals in main session.
   - Tools can run on gateway/host with high privileges.

### 6) Skills & Supply‑Chain Risk Review
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

File System Enumeration

Medium
Category
Data Exfiltration
Content
### 8) File Permissions & Privilege Escalation Risks
1. Check for risky permissions on key dirs:
   - `ls -ld ~/.openclaw`
   - `ls -l ~/.openclaw | head -n 50`
2. Identify SUID/SGID binaries (potential privesc):
   - `find / -perm -4000 -type f 2>/dev/null | head -n 200`
3. Flag if OpenClaw runs as root or with unnecessary sudo.
Confidence
60% confidence
Finding
Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Session Persistence

Medium
Category
Rogue Agent
Content
### 9) Process & Persistence Indicators
1. Check for unexpected cron jobs:
   - `crontab -l`
   - `ls -la /etc/cron.* 2>/dev/null`
2. Review systemd services:
   - `systemctl list-units --type=service | grep -i openclaw`
Confidence
85% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
- **Publicly exposed gateway/UI** �?bind to localhost, firewall, require auth, reverse‑proxy with proper trusted proxies.
- **Old vulnerable versions** �?upgrade to latest release, rotate tokens, invalidate sessions.
- **Unsafe exec policy** �?require approvals, limit tools to sandbox, drop root privileges.
- **Plaintext secrets** �?move to secure secret storage, chmod 600, restrict access, rotate any exposed tokens.
- **Untrusted skills** �?remove, audit contents, only install from trusted authors.

## Report Completion
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.