ClawHub
Back to skill

Security audit

Openclaw Ref

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only OpenClaw reference skill that covers powerful admin features, but I found no hidden code, deception, or unexplained data exfiltration.

Install this only if you want a Chinese OpenClaw operations manual. Treat its examples as admin-level guidance: review and explicitly approve reset/uninstall/--force commands, shell or node exec, camera/screen/location access, plugin or hook installs, webhook delivery, credential changes, and reasoning/status broadcasts; prefer allowlists, pairing, environment-variable secrets, gateway tokens, sandboxing, audits, and backups.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (77)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
| `cli.md` | 所有 CLI 命令速查表 | 需要执行 openclaw 命令时 |

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documented camera, screen, canvas, and location commands enable collection of sensitive visual and geolocation data without any privacy, consent, or authorization warning. In a skill intended as an operational reference, presenting surveillance-capable commands as routine increases the risk of covert monitoring or accidental privacy violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

openclaw node run <command> is remote command execution and can directly alter or compromise a node, but the cheat sheet gives no warning about system impact, trust boundaries, or authorization requirements. This is especially dangerous because concise reference docs encourage direct copy/paste usage without context or safeguards.

Content

No source excerpt is available for this finding.

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · core/concepts.md (reported line 266)May include surrounding context.

md
1. Tooling — 工具列表+描述
2. Safety — 防护提醒
3. Skills — 可用Skills列表(按需加载)
4. OpenClaw Self-Update — config/update说明
5. Workspace — 工作目录
6. Documentation — 文档路径
7. Workspace Files — 引导文件注入

Self-Modification

High
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · core/concepts.md (reported line 284)May include surrounding context.

md
1. Tooling — 工具列表+描述
2. Safety — 防护提醒
3. Skills — 可用Skills列表(按需加载)
4. OpenClaw Self-Update — config/update说明
5. Workspace — 工作目录
6. Documentation — 文档路径
7. Workspace Files — 引导文件注入

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

tools.policy、elevated.mode、exec.approvals.mode 和 commands.bash 直接控制命令执行、提权与高危工具暴露，是最敏感的运行面之一。文档仅列出功能而无任何安全边界说明，容易诱导用户开启免审批执行、提权或 shell 命令，从而显著提升远程执行和主机破坏风险。

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The openclaw gateway --force command is documented as a normal option with only a brief note that it kills port-occupying processes. In a high-trust admin reference skill, this can lead users or downstream agents to terminate unrelated local services without adequate confirmation or scope checks, causing denial of service or accidental disruption.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · setup/install.md (reported line 57)May include surrounding context.

md
~/.openclaw/
├── openclaw.json              # 主配置
├── openclaw.json.bak          # 自动备份
├── .env                       # 全局环境变量
├── agents/
│   └── <agentId>/
│       ├── agent/

Privileged Container / Container Escape

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · setup/install.md (reported line 164)May include surrounding context.

md
### 注意事项
- WhatsApp需要持久化 `~/.openclaw/credentials/`
- 浏览器需要额外Chrome安装
- 使用 `--network host` 访问本地Ollama

## 更新

Chaining Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · tools/overview.md (reported line 50)May include surrounding context.

md
// 配置
tools: {
  exec: {
    host: "sandbox",           // sandbox|gateway|node
    security: "allowlist",     // deny|allowlist|full
    ask: "on-miss",            // off|on-miss|always
    node: "mac-1",             // 默认节点

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file presents the skill entirely in Chinese and states that all OpenClaw configuration, troubleshooting, and CLI operations must consult this document. This imposes a specific language/locale on users without indicating an option to use another language, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation explicitly describes automatic Telegram delivery and fallback to the main session's last routing target, which can cause messages to be sent to an unintended recipient if channel or destination fields are omitted or stale. In a scheduling/automation skill, this increases the risk of accidental disclosure of reminders, model outputs, operational data, or other sensitive content through an external messaging channel.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The documentation includes an includeReasoning option that would transmit the model's internal reasoning, but it does not clearly warn that reasoning may contain sensitive user data, hidden prompts, or other confidential context. In a heartbeat feature that proactively sends status to channels, this increases the chance of unintended disclosure to external recipients.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown documents external HTTP webhooks triggering work and includes payload templating with {{body}}, but does not warn that incoming data may be transmitted into agent sessions or forwarded to delivery channels. It also documents command logging and message delivery behavior elsewhere in the file without any privacy or data-handling caution, which fits missing user warnings for markdown files.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · automation/hooks-webhooks.md (reported line 182)May include surrounding context.

调用

bash
curl -X POST http://localhost:18789/hooks \
  -H "Authorization: Bearer shared-secret" \
  -H "Content-Type: application/json" \
  -d '{"text": "外部触发消息"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation instructs users to copy and place a Discord bot token directly into configuration examples, including an example literal token format, but does not warn that the token is a secret requiring protected storage, rotation, and exclusion from logs/version control. In an operational reference skill that users are expected to consult while editing config files, this omission increases the chance of credential leakage through pasted configs, screenshots, shell history, or repositories.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file presents all user-facing instructions and examples exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or justification is a reportable issue.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · channels/telegram.md (reported line 30)May include surrounding context.

md
### 获取用户ID
- 私信机器人 → `openclaw logs --follow` 查找 `from.id`
- 或: `curl "https://api.telegram.org/bot<token>/getUpdates"` 读 `message.from.id`

### 群组
- `groupPolicy`: `allowlist`(默认) | `open` | `disabled`

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

This markdown file applies to SQP-2, and it explicitly discloses a local credential path (creds.json) that likely contains authentication material. The surrounding documentation provides no caution about sensitivity, access control, backup exposure, or avoiding sharing this file, which is a missing user warning for behavior affecting account security and privacy.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The cheat sheet includes clearly destructive commands such as reset and uninstall with force/yes-style flags but provides no warning about irreversible data loss or service disruption. In a reference skill that users are told they must consult for configuration and troubleshooting, this omission increases the chance that an agent or user will invoke harmful commands casually.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

These commands manage channels, authentication, and logs, which can expose tokens, account state, and message contents, yet the documentation gives no privacy or credential-handling warning. That makes accidental disclosure or misuse more likely, especially when copied into automated workflows or used by agents with broad access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The slash command ! <cmd> enables host shell execution, which can affect the local system, access files, or run destructive payloads, yet the reference provides no safety warning. Given that this skill is meant to be consulted during operations, omission of guardrails can normalize unsafe shell use by users or agents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

该 markdown 文件整体以中文撰写，未见提供其他语言选项、用户选择机制，或说明这是面向特定中文环境/区域的限定文档。根据规则，强制特定语言且无用户选择或明确合理化说明，属于自然语言层面的语言/locale 策略问题。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

文档在 auth / logging 等敏感配置附近仅说明字段用途，没有提醒 API Key、认证资料和日志内容可能包含敏感数据，也没有提示错误配置会导致凭据泄露或扩大攻击面。作为“必须查阅”的参考手册，这种省略容易让用户直接复制不安全配置进入生产环境。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Telegram/Discord/WhatsApp/Signal 配置包含 bot token、webhook secret 和允许访问范围等高敏感字段，但文档没有明确警告这些值一旦泄露即可被第三方接管机器人、伪造请求或读取消息流量。缺少 allowed/admin 范围配置的安全建议，也可能导致机器人被过度暴露到非预期聊天对象。

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
channels/telegram.md:42