OpenClaw Security Audit

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:56 PM UTC
• Version: 0.1.0

Overview

This is a coherent OpenClaw security checker, but it can print part or all of a local authentication token during its audit output.

Review before installing if your OpenClaw config may contain real gateway tokens. Run it only in a private terminal, avoid CI or shared logs, and rotate any short/default token that may have been printed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/audit.cjs:55

Finding

Authentication Token Disclosure in Audit Output

Content

View full analysis

Vulnerability Details

File Location: scripts/audit.cjs, lines 55–59 and 108
Vulnerability Type: Sensitive credential exposure through terminal and log output
Risk Level: Medium

Vulnerable Code

js

if (token.length < 32 || isDefault) {
  const masked = token.length > 8 ? token.slice(0, 8) + '...' : token || '(空)';
  findings.push({
    key: 'gateway.auth.token',
    current: masked,
    suggested: '至少 32 位强随机字符串',
    reason: 'Token 过短或为默认值，存在认证风险',
    action: '请手动生成并替换为至少 32 位的强随机 token'
  });
}

The resulting value is later printed:

js

console.log(`     当前值: ${item.current}`);

Technical Analysis

The script reads gateway.auth.token from ~/.openclaw/openclaw.json and includes part or all of that credential in an audit finding. Tokens longer than eight characters disclose their first eight characters, while tokens containing eight or fewer characters are disclosed completely.

Displaying credential material is unnecessary for determining whether the token is weak. Audit output may be retained in shell history captures, CI/CD logs, support bundles, terminal recordings, or centralized monitoring systems. This expands access to the token beyond users authorized to read the original configuration file.

Attack Path

1. An OpenClaw installation is configured with a weak or default authentication token.
2. An operator invokes node scripts/audit.cjs.
3. The script reads the token from ~/.openclaw/openclaw.json.
4. Because the token is short or recognized as a default, the script stores either the complete token or its first eight characters in a finding.
5. printFindings() writes that value to standard output.
6. A user or service able to access captured audit output obtains the token or a useful token prefix.
7. If the complete token was exposed, an attacker may attempt direct authentication. If only a prefix was exposed, the attacker may use it to reduce the search space for guessing or brute-force attacks.

...[truncated 624 chars]

Remediation

View remediation

Remediation Suggestions

• Never include token characters in findings or diagnostic output.
• Replace the current value with a non-sensitive status such as "(configured but weak)".
• Avoid reporting exact token length unless operationally necessary.
• Ensure future logging and exception paths do not serialize the configuration object or authentication values.
• Treat existing audit logs as potentially sensitive. Restrict access and remove retained output containing exposed tokens where appropriate.
• Rotate any token that may already have been printed to shared terminals, CI/CD logs, support bundles, or centralized logging systems.

A safer implementation would be:

js

if (token.length < 32 || isDefault) {
  findings.push({
    key: 'gateway.auth.token',
    current: '(configured but weak)',
    suggested: 'At least 32 cryptographically random characters',
    reason: 'The token is too short or uses a default value',
    action: 'Generate and install a strong random token without printing it'
  });
}

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The header comments explicitly state the script only performs read-only configuration checks and does not take additional actions, but later it invokes external commands including openclaw security audit --deep. This mismatch is dangerous because users may trust and run the tool under the assumption it is passive, while it actually executes another program whose behavior may be broader, side-effecting, or influenced by the local environment/PATH.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/audit.cjs:148