Security audit

Openclaw Ref

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only OpenClaw reference skill that covers powerful admin features, but I found no hidden code, deception, or unexplained data exfiltration.

Install this only if you want a Chinese OpenClaw operations manual. Treat its examples as admin-level guidance: review and explicitly approve reset/uninstall/--force commands, shell or node exec, camera/screen/location access, plugin or hook installs, webhook delivery, credential changes, and reasoning/status broadcasts; prefer allowlists, pairing, environment-variable secrets, gateway tokens, sandboxing, audits, and backups.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (77)

Ae1

High

Category: analysis-evasion
Content: | `cli.md` | 所有 CLI 命令速查表 | 需要执行 openclaw 命令时 |
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Missing User Warnings

High

Confidence: 96% confidence
Finding: The documented camera, screen, canvas, and location commands enable collection of sensitive visual and geolocation data without any privacy, consent, or authorization warning. In a skill intended as an operational reference, presenting surveillance-capable commands as routine increases the risk of covert monitoring or accidental privacy violations.

Missing User Warnings

High

Confidence: 97% confidence
Finding: `openclaw node run <command>` is remote command execution and can directly alter or compromise a node, but the cheat sheet gives no warning about system impact, trust boundaries, or authorization requirements. This is especially dangerous because concise reference docs encourage direct copy/paste usage without context or safeguards.

Self-Modification

High

Category: Rogue Agent
Content: 1. Tooling — 工具列表+描述 2. Safety — 防护提醒 3. Skills — 可用Skills列表(按需加载) 4. OpenClaw Self-Update — config/update说明 5. Workspace — 工作目录 6. Documentation — 文档路径 7. Workspace Files — 引导文件注入
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Self-Modification

High

Category: Rogue Agent
Content: 1. Tooling — 工具列表+描述 2. Safety — 防护提醒 3. Skills — 可用Skills列表(按需加载) 4. OpenClaw Self-Update — config/update说明 5. Workspace — 工作目录 6. Documentation — 文档路径 7. Workspace Files — 引导文件注入
Confidence: 90% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Missing User Warnings

High

Confidence: 96% confidence
Finding: tools.policy、elevated.mode、exec.approvals.mode 和 commands.bash 直接控制命令执行、提权与高危工具暴露，是最敏感的运行面之一。文档仅列出功能而无任何安全边界说明，容易诱导用户开启免审批执行、提权或 shell 命令，从而显著提升远程执行和主机破坏风险。

Missing User Warnings

High

Confidence: 97% confidence
Finding: The `openclaw gateway --force` command is documented as a normal option with only a brief note that it kills port-occupying processes. In a high-trust admin reference skill, this can lead users or downstream agents to terminate unrelated local services without adequate confirmation or scope checks, causing denial of service or accidental disruption.

Credential Access

High

Category: Privilege Escalation
Content: ~/.openclaw/ ├── openclaw.json # 主配置 ├── openclaw.json.bak # 自动备份 ├── .env # 全局环境变量 ├── agents/ │ └── <agentId>/ │ ├── agent/
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Privileged Container / Container Escape

High

Category: Privilege Escalation
Content: ### 注意事项 - WhatsApp需要持久化 `~/.openclaw/credentials/` - 浏览器需要额外Chrome安装 - 使用 `--network host` 访问本地Ollama ## 更新
Confidence: 80% confidence
Finding: Potential security issue detected. Manual review is recommended.

Chaining Abuse

High

Category: Tool Misuse
Content: // 配置 tools: { exec: { host: "sandbox", // sandbox|gateway|node security: "allowlist", // deny|allowlist|full ask: "on-miss", // off|on-miss|always node: "mac-1", // 默认节点
Confidence: 70% confidence
Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: The file presents the skill entirely in Chinese and states that all OpenClaw configuration, troubleshooting, and CLI operations must consult this document. This imposes a specific language/locale on users without indicating an option to use another language, which matches the language-policy violation criteria.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation explicitly describes automatic Telegram delivery and fallback to the main session's last routing target, which can cause messages to be sent to an unintended recipient if channel or destination fields are omitted or stale. In a scheduling/automation skill, this increases the risk of accidental disclosure of reminders, model outputs, operational data, or other sensitive content through an external messaging channel.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The documentation includes an `includeReasoning` option that would transmit the model's internal reasoning, but it does not clearly warn that reasoning may contain sensitive user data, hidden prompts, or other confidential context. In a heartbeat feature that proactively sends status to channels, this increases the chance of unintended disclosure to external recipients.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: This markdown documents external HTTP webhooks triggering work and includes payload templating with `{{body}}`, but does not warn that incoming data may be transmitted into agent sessions or forwarded to delivery channels. It also documents command logging and message delivery behavior elsewhere in the file without any privacy or data-handling caution, which fits missing user warnings for markdown files.

External Transmission

Medium

Category: Data Exfiltration
Content: ### 调用 ```bash curl -X POST http://localhost:18789/hooks \ -H "Authorization: Bearer shared-secret" \ -H "Content-Type: application/json" \ -d '{"text": "外部触发消息"}'
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documentation instructs users to copy and place a Discord bot token directly into configuration examples, including an example literal token format, but does not warn that the token is a secret requiring protected storage, rotation, and exclusion from logs/version control. In an operational reference skill that users are expected to consult while editing config files, this omission increases the chance of credential leakage through pasted configs, screenshots, shell history, or repositories.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: This markdown file presents all user-facing instructions and examples exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or justification is a reportable issue.

External Transmission

Medium

Category: Data Exfiltration
Content: ### 获取用户ID - 私信机器人 → `openclaw logs --follow` 查找 `from.id` - 或: `curl "https://api.telegram.org/bot<token>/getUpdates"` 读 `message.from.id` ### 群组 - `groupPolicy`: `allowlist`(默认) | `open` | `disabled`
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: This markdown file applies to SQP-2, and it explicitly discloses a local credential path (`creds.json`) that likely contains authentication material. The surrounding documentation provides no caution about sensitivity, access control, backup exposure, or avoiding sharing this file, which is a missing user warning for behavior affecting account security and privacy.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The cheat sheet includes clearly destructive commands such as reset and uninstall with force/yes-style flags but provides no warning about irreversible data loss or service disruption. In a reference skill that users are told they must consult for configuration and troubleshooting, this omission increases the chance that an agent or user will invoke harmful commands casually.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: These commands manage channels, authentication, and logs, which can expose tokens, account state, and message contents, yet the documentation gives no privacy or credential-handling warning. That makes accidental disclosure or misuse more likely, especially when copied into automated workflows or used by agents with broad access.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The slash command `! <cmd>` enables host shell execution, which can affect the local system, access files, or run destructive payloads, yet the reference provides no safety warning. Given that this skill is meant to be consulted during operations, omission of guardrails can normalize unsafe shell use by users or agents.

Natural-Language Policy Violations

Medium

Confidence: 97% confidence
Finding: 该 markdown 文件整体以中文撰写，未见提供其他语言选项、用户选择机制，或说明这是面向特定中文环境/区域的限定文档。根据规则，强制特定语言且无用户选择或明确合理化说明，属于自然语言层面的语言/locale 策略问题。

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: 文档在 auth / logging 等敏感配置附近仅说明字段用途，没有提醒 API Key、认证资料和日志内容可能包含敏感数据，也没有提示错误配置会导致凭据泄露或扩大攻击面。作为“必须查阅”的参考手册，这种省略容易让用户直接复制不安全配置进入生产环境。

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: Telegram/Discord/WhatsApp/Signal 配置包含 bot token、webhook secret 和允许访问范围等高敏感字段，但文档没有明确警告这些值一旦泄露即可被第三方接管机器人、伪造请求或读取消息流量。缺少 allowed/admin 范围配置的安全建议，也可能导致机器人被过度暴露到非预期聊天对象。

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

Code: suspicious.prompt_injection_instructions
Location: channels/telegram.md:42