ClawHub
Back to skill

Security audit

OpenClaw Config Ops

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a careful OpenClaw configuration workflow, but its required plaintext change log can preserve sensitive config values such as credentials.

Review this skill before installing if your OpenClaw config contains API keys, tokens, passwords, private endpoints, or other secrets. Its confirmation and backup workflow is careful, but the required change log should redact sensitive values or avoid recording raw values before use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:165
Finding
Plaintext Configuration Change Logging May Expose Sensitive Values<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 165-176 **Vulnerability Type**: Plaintext storage of potentially sensitive configuration values **Risk Level**: Medium ### Vulnerable Code ```markdown Change log format (append to `~/.openclaw/workspace/logs/config-changes.log`): ``` ```text ## YYYY-MM-DDTHH:MM:SS+08:00 - action: add|modify|remove - target: config.key.path - old_value: <previous value or "N/A"> - new_value: <new value> - reason: <brief justification> - schema_verified: true - doc_source: <URL or "QMD:collection/doc-id"> - user_approved: true - backup: <backup file path> ``` ### Technical Analysis The skill requires every configuration change to be recorded in `~/.openclaw/workspace/logs/config-changes.log`, including the complete previous and new values. It does not require secret detection, redaction, restrictive file permissions, or exclusion of sensitive configuration paths. If a modified configuration value contains an API key, authentication token, password, private endpoint credential, or another secret, that value will be duplicated into a persistent plaintext log. Recording both `old_value` and `new_value` can expose current credentials as well as credentials that were rotated because they were suspected of compromise. This expands the sensitive-data footprint beyond `openclaw.json`. Security controls applied to the primary configuration file may not apply to a log under the workspace directory, which may be included in backups, support bundles, repository commits, synchronization systems, or broad workspace access. ### Attack Path 1. A user requests a legitimate change to a secret-bearing configuration value. 2. The skill follows the mandatory logging procedure after applying the change. 3. The complete previous and new secret values are appended to `~/.openclaw/workspace/logs/config-changes.log`. 4. A local user, process, plugin, backup service, or synchronization tool with access to the workspace log reads ...[truncated 877 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Never log raw values from secret-bearing fields. Record only the action, target path, timestamp, approval state, and validation result. 2. Introduce mandatory recursive redaction for fields whose names or schema annotations indicate sensitive content, including tokens, passwords, API keys, secrets, credentials, and private keys. 3. Replace raw values with safe metadata, such as: - `old_value: [REDACTED]` - `new_value: [REDACTED]` - A one-way fingerprint when change correlation is necessary - Type and presence information rather than content 4. Default to redaction when a field's sensitivity is uncertain. 5. Create the log directory and file with restrictive permissions, such as directory mode `0700` and file mode `0600`, and verify ownership before appending. 6. Prevent the log from being committed to source control or included in broadly accessible support bundles and synchronization workflows. 7. Document a retention and secure-deletion policy for historical change records. 8. Update the required log format so that sensitive values cannot be included accidentally, for example: ```text - old_value: [REDACTED] - new_value: [REDACTED] - value_changed: true ``` ]]>

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- ❌ **Modify config without logging** — every change must go to config-changes.log
- ❌ **Proceed after schema lookup failure** — STOP and report
- ❌ **Assume prior knowledge replaces verification** — "I've done this before" is not evidence
- ❌ **Skip user confirmation** — all Mode B operations require Step 4

## Documentation Quick Reference
Confidence
85% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.