Security audit

Openclaw Admin

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly fits OpenClaw administration, but it includes admin-context commands that can run unreviewed local or registry code.

Install only if you trust the OpenClaw workspace and understand that the skill may reveal local gateway configuration. Do not run the full health check unless `status.sh` is known and trusted, and prefer a pinned or locally installed restart command instead of unversioned `npx thepopebot`. Require explicit approval before any routing, cron, trigger, or gateway config changes.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:111
Finding: Execution of an Unverified Workspace Shell Script
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:160
Finding: Unpinned Third-Party Package Execution Through npx
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The activation section is broad enough to match generic admin and inspection requests, increasing the chance this high-privilege skill is invoked when a narrower or safer skill would be more appropriate. Because the skill exposes commands for reading gateway configuration, listing installed skills, and running diagnostics, over-triggering can lead to unnecessary access to sensitive local state.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill contains commands that inspect local configuration files, enumerate installed skills, call external tooling like ollama, and execute a local script bash ./status.sh, but it does not warn users that these actions may expose sensitive system or configuration data. In an admin-oriented skill, the absence of a user-facing warning makes inadvertent disclosure or unsafe execution more likely.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 85% confidence
Finding: The skill instructs users to restart the gateway with npx thepopebot, which fetches and executes a package without any version pinning. That creates a supply-chain risk: a newer, compromised, or typosquatted package could be executed in an administrative context on the local machine.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.