Security audit

Openclaw Egress

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local egress scanner, but it can also automatically rename skill directories and rewrite source files, with path-scoping weaknesses that warrant Review before installation.

Install only if you are comfortable with a security tool that can modify other skills. Prefer using scan, status, domains, and scan --skills-only first; avoid protect and block unless you have backups and have reviewed exactly which files will change. Do not pass untrusted skill names or paths to mutation commands.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/egress.py:341
Finding: Path Traversal Allows Source Files Outside the Skills Directory to Be Modified
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/egress.py:321
Finding: Regex-Based Automated Protection Can Corrupt or Disable Skill Source Code
Content: View full analysis
block by_file = {} for f in high: by_file.setdefault(f["file"], []).append(f) skill_cnt = 0 for rel, ffs in by_file.items(): ap = ws / rel if not ap.is_file() or ap.suffix not in CODE_SUFFIXES: continue cnt = _block_lines(ap, {ff["line"] - 1 for ff in ffs}) skill_cnt += cnt if skill_cnt: b_total += skill_cnt; b_list.append(skill) actions.append(f"BLOCKED: {skill} ({skill_cnt} line(s))") print(f" [BLOCK] {skill} — {skill_cnt} HIGH line(s) neutralized") ``` ### Technical Analysis Network findings are generated through line-oriented regular expressions rather than lan ...[truncated 2649 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is presented as an egress/DLP scanner, but it also includes active countermeasures that rename skill directories and rewrite other skills' source files. That exceeds a read-only detection role and gives the tool the ability to disable or tamper with unrelated code in the workspace, which is dangerous if triggered on false positives or used abusively.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill is user-invocable and documents execution of a local Python script over an arbitrary workspace path, but it does not declare any explicit tool scope such as permissions or allowed-tools. That means the effective capabilities are broader than what is transparently disclosed, including file access and shell execution, which increases the risk of unintended data exposure or misuse if the host agent grants broad defaults.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Workspace resolution and subsequent scanning logic enable enumeration of the full workspace, not just the target skills directory. For a skill whose stated purpose is agent-skill egress monitoring, this broad file access increases privacy and data-exposure risk by reading unrelated project files and metadata.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The protect flow automatically renames skill directories to quarantine them as soon as findings are classified as CRITICAL, with no confirmation step. In this context, false positives or overbroad pattern matches could disable legitimate skills and create an easy denial-of-service mechanism against the workspace.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The protection sweep automatically comments out lines in other skills and writes backup files without prior approval. Because the detection rules are heuristic and broad, this can silently alter legitimate code behavior, break skills, or be abused to tamper with the workspace under the guise of security scanning.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The docstring says the function comments out specific lines and returns a count blocked, but the implementation also copies the original file to a .bak backup and rewrites the entire file in place. That is an active side effect beyond what the documentation describes.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.