ClawHub
Back to skill

Security audit

OpenClaw Agent Clone

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent clone/export purpose, but importing a package can overwrite agent files, write outside the intended workspace, and auto-install package-selected skills without enough user control.

Only import packages from sources you fully trust, and review their identity, config, memory, and skill lists before use. This version should be treated as Review-worthy because a package can change future agent behavior, install additional skills, and potentially write unintended files under the importer user's permissions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
scripts/clone.py:153
Finding

Untrusted Clone Packages Can Replace Agent Identity and Operational Instructions

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
scripts/clone.py:180
Finding

Clone Packages Can Inject Persistent Attacker-Controlled Memory

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/clone.py:153
Finding

Package-Controlled Filenames Allow Arbitrary File Writes Through Path Traversal

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
scripts/clone.py:132
Finding

Untrusted Packages Can Trigger Installation of Attacker-Selected Skills

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger phrases include very generic terms like "export," "import," and especially "clone," which can overlap with normal user conversation and cause the skill to activate unintentionally. In this skill, accidental activation is more dangerous than usual because the skill can export sensitive agent configuration or import and apply external configuration, potentially leading to configuration tampering or unintended disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly states that it will "Auto-install missing skills" during import, but it does not present a strong warning that imported packages may introduce untrusted code, unsafe prompts, or malicious skill behavior. In context, this makes the issue more dangerous because the skill is designed to clone agent configuration from externally provided packages, creating a direct path for supply-chain style compromise through imported skills.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The export logic advertises filtered configuration export, but it also includes raw contents of identity, config, and optionally memory files with no sensitive-data scrubbing. Those files may contain secrets, personal data, prompts, or operational details, so users may share the generated package under a false assumption that sensitive content was sanitized.

Content

No source excerpt is available for this finding.

Tainted flow: 'filepath' from os.environ.get (line 171, credential/environment) → shutil.copy2 (file write)

Medium
Category
Data Flow
Confidence
65% confidence
Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/clone.py (reported line 120)May include surrounding context.

python
"""备份现有文件"""
    if filepath.exists():
        backup_path = filepath.with_suffix(filepath.suffix + '.bak')
        shutil.copy2(filepath, backup_path)
        return str(backup_path)
    return None

Tainted flow: 'filepath' from os.environ.get (line 171, credential/environment) → open (file write)

Medium
Category
Data Flow
Confidence
92% confidence
Finding

The import routine writes attacker-supplied content to filenames taken directly from the package's identity, config, and memory dictionaries, with no allowlist or path normalization. An attacker can supply keys like '../../.bashrc' or absolute paths to overwrite arbitrary files accessible to the process, causing configuration corruption, persistence, or code execution.

Content

Scanner excerpt · scripts/clone.py (reported line 127)May include surrounding context.

python
def write_file(filepath, content):
    """写入文件"""
    filepath.parent.mkdir(parents=True, exist_ok=True)
    with open(filepath, 'w', encoding='utf-8') as f:
        f.write(content)

def install_skill(slug):

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The import path executes external installation commands as part of processing untrusted package data, and does so without a prior explicit warning or confirmation. In this context, automatic execution materially increases risk because clone packages are intended to be shared, making supply-chain abuse straightforward.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
90% confidence
Finding

The import path installs skills from package-supplied slugs by invoking an external command without validating provenance, prompting the user, or restricting allowed identifiers. A crafted clone package can therefore trigger installation of untrusted or malicious skills, leading to arbitrary code execution in the broader skill installation pipeline.

Content

Scanner excerpt · scripts/clone.py (reported line 134)May include surrounding context.

python
"""安装skill"""
    import subprocess
    try:
        result = subprocess.run(
            ['skillhub', 'install', slug],
            capture_output=True,
            text=True,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Importing package content silently overwrites workspace files after only creating backups, with no preview, confirmation, or trust check. A malicious or mistaken package can replace agent identity and configuration files, altering behavior, sabotaging operation, or planting harmful instructions for later use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The optional memory import restores MEMORY.md directly from the package when a package-controlled flag is set, without clearly warning about personal-data replacement or behavioral effects. This can inject misleading memory/state, overwrite user data, or seed later prompt-manipulation through persisted memory content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The top-level natural-language description is presented only in Chinese, indicating a language-specific skill experience without any opt-in or alternative locale. The policy requires flagging language or locale constraints when the skill forces a specific language without user choice or documented justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.