Security audit

Openclaw Ledger

Security checks for vulnerabilities and agentic risk

Overview

This local audit-ledger skill is mostly purpose-aligned, but it overstates its tamper-detection guarantees and includes under-documented commands that can export or overwrite ledger data.

Install only if you want a local workspace change ledger and are comfortable with .ledger storing file names, hashes, timestamps, and user messages. Do not rely on it as forensic-grade tamper proofing against someone who can write to the workspace. Review or avoid the protect, restore, and export commands unless you explicitly want ledger replacement or full ledger disclosure.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/ledger.py:113
Finding: Unauthenticated Hash Chain Fails to Detect Rewritten or Truncated Audit History
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The protect flow automatically overwrites the active ledger with a frozen backup via shutil.copy2(clean, cp) after detecting tampering, without interactive confirmation, dry-run mode, or an explicit opt-in flag. In an agent context, this is a destructive state-changing action that can erase the current chain state, destroy forensic context, or let an attacker influence recovery behavior if backup selection is manipulated.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill is explicitly user-invocable and documents execution of a local Python script that reads workspace state, writes a tamper-evident ledger, and likely shells through the host runtime, yet it declares no permissions or allowed-tools scope. That creates an authorization gap: an agent platform may expose file, environment, or shell capabilities more broadly than intended, making it harder to enforce least privilege and increasing the chance of unsafe execution in sensitive workspaces.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The export command prints the full workspace path and the entire ledger contents, including file names, timestamps, messages, and snapshots, directly to stdout with no redaction or privacy warning. In agent environments, stdout is often captured by logs, orchestration systems, or upstream tools, so this can unintentionally disclose sensitive repository structure, operational history, and possibly user-provided messages.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.