ClawHub
Back to skill

Security audit

OpenClaw Config Ops

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a careful OpenClaw configuration workflow, but its required plaintext change log can preserve sensitive config values such as credentials.

Review this skill before installing if your OpenClaw config contains API keys, tokens, passwords, private endpoints, or other secrets. Its confirmation and backup workflow is careful, but the required change log should redact sensitive values or avoid recording raw values before use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:165
Finding

Plaintext Configuration Change Logging May Expose Sensitive Values

Content
View full analysis
- new_value: - reason: - schema_verified: true - doc_source: - user_approved: true - backup: ``` ### Technical Analysis The skill requires every configuration change to be recorded in `~/.openclaw/workspace/logs/config-changes.log`, including the complete previous and new values. It does not require secret detection, redaction, restrictive file permissions, or exclusion of sensitive configuration paths. If a modified configuration value contains an API key, authentication token, password, private endpoint credential, or another secret, that value will be duplicated into a persistent plaintext log. Recording both `old_value` and `new_value` can expose current credentials as well as credentials that were rotated because they were suspected of compromise. This expands the sensitive-data footprint beyond `openclaw.json`. Security controls applied to the primary configuration file may not apply to a log under the workspace directory, which may be included in backups, support bundles, repository commits, synchronization systems, or broad workspace access. ### Attack Path 1. A user requests a legitimate change to a secret-bearing configuration value. 2. The skill follows the mandatory logging procedure after applying the change. 3. The complete previous and new secret values are appended to `~/.openclaw/workspace/logs/config-changes.log`. 4. A local user, process, plugin, backup service, or synchronization tool with access to the workspace log reads ...[truncated 877 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.

md
- ❌ **Modify config without logging** — every change must go to config-changes.log
- ❌ **Proceed after schema lookup failure** — STOP and report
- ❌ **Assume prior knowledge replaces verification** — "I've done this before" is not evidence
- ❌ **Skip user confirmation** — all Mode B operations require Step 4

## Documentation Quick Reference