ClawHub
Back to skill

Security audit

Openclaw Vault

Security checks for vulnerabilities and agentic risk

Overview

This credential-auditing skill is mostly purpose-aligned, but it reads sensitive user-level files and includes under-documented remediation commands that can change or move files beyond what users would reasonably expect.

Review before installing. Use scan-only commands first, preferably in a constrained workspace. Avoid protect, fix-permissions, quarantine, and unquarantine until the package clearly documents them, adds explicit consent, blocks symlinks and path traversal, and requires opt-in before reading home-directory history or shell configuration files.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/vault.py:374
Finding
Workspace audit silently reads credential-bearing files from the user's home directory<![CDATA[ ## Vulnerability Details **File Location**: `scripts/vault.py:374-381`, `scripts/vault.py:414-417`, and `scripts/vault.py:627-636` **Vulnerability Type**: Least-privilege boundary violation and excessive credential access **Risk Level**: Medium ### Vulnerable Code ```python def check_shell_history(workspace): """Check shell history files for leaked credentials.""" findings = [] home = Path.home() history_files = [] for hname in SHELL_HISTORY_FILES: hpath = home / hname if hpath.is_file(): history_files.append(hpath) ``` ```python def check_git_config(workspace): """Check git config files for embedded credentials.""" findings = [] config_paths = [] ws_gitconfig = workspace / ".git" / "config" if ws_gitconfig.is_file(): config_paths.append(ws_gitconfig) global_gitconfig = Path.home() / ".gitconfig" if global_gitconfig.is_file(): config_paths.append(global_gitconfig) ``` ```python def check_shell_aliases(workspace): """Check shell RC files for aliases or functions containing credentials.""" findings = [] home = Path.home() rc_files = [ home / ".bashrc", home / ".zshrc", home / ".profile", home / ".bashfile", home / ".zprofile", ] for rcpath in rc_files: if not rcpath.is_file(): continue content = read_text_safe(rcpath) ``` ### Technical Analysis The `--workspace` option creates a reasonable expectation that inspection will remain within the selected workspace. However, the audit and exposure checks unconditionally inspect files in `Path.home()`. The affected sources include complete shell-history files, global Git configuration, and shell startup files. These can contain plaintext passwords, API tokens, authenticated repository URLs, private hostnames, command arguments, and aliases unrelated to the audited project. This behavior is broader than the minimum access necessary for a workspace ...[truncated 1554 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Make workspace-only inspection the default for every command. 2. Add an explicit option such as `--include-user-files` before reading home-directory histories, global Git configuration, or shell startup files. 3. Display the exact external paths that will be inspected and obtain clear user approval before opening them. 4. Keep host-level and workspace-level findings in separate report sections. 5. Avoid returning even masked fragments unless explicitly requested; report the pattern type and location by default. 6. Document the expanded host-level scan scope in `SKILL.md` and `README.md`. 7. Add tests verifying that supplying `--workspace` causes no reads outside the resolved workspace unless the explicit opt-in option is present. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/vault.py:1029
Finding
Untrusted quarantine metadata can restore and overwrite files outside the workspace<![CDATA[ ## Vulnerability Details **File Location**: `scripts/vault.py:1029-1048` and `scripts/vault.py:1065-1080` **Vulnerability Type**: Path traversal and arbitrary file overwrite **Risk Level**: High ### Vulnerable Code ```python for meta_file in sorted(qdir.glob("*.meta.json"), reverse=True): try: with open(meta_file, "r", encoding="utf-8") as f: meta = json.load(f) except (OSError, json.JSONDecodeError): continue orig = meta.get("original_path", "") qname = meta.get("quarantine_file", "") # Match by original path or by quarantine file name or by partial name if (orig == target_file or qname == target_file or orig.replace(os.sep, "__").replace("/", "__") == target_normalized or target_file in orig or target_file in qname): q_candidate = qdir / qname if q_candidate.is_file(): found_meta = meta found_qfile = q_candidate break ``` ```python original_path = workspace / found_meta["original_path"] # Ensure parent directory exists original_path.parent.mkdir(parents=True, exist_ok=True) if original_path.exists(): print(f"[WARNING] Original location already has a file: {found_meta['original_path']}") print(" The existing file will be overwritten.") print() try: shutil.move(str(found_qfile), str(original_path)) # Remove metadata file meta_path = qdir / f"{found_meta['quarantine_file']}.meta.json" if meta_path.is_file(): meta_path.unlink() except (OSError, PermissionError) as exc: print(f"[ERROR] Failed to restore: {exc}", file=sys.stderr) return 1 ``` ### Technical Analysis The `unquarantine` operation trusts `original_path` and `quarantine_file` values loaded from JSON metadata stored inside the workspace. No validation rejects absolute paths, parent-directory components, or resolved destinations outside the workspace. In Python path composition, an absolute r ...[truncated 2112 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Reject absolute `original_path` and `quarantine_file` values. 2. Resolve the workspace and destination before use, then enforce containment: ```python workspace_root = workspace.resolve() relative = Path(found_meta["original_path"]) if relative.is_absolute() or ".." in relative.parts: raise ValueError("Invalid quarantine destination") destination = (workspace_root / relative).resolve() if not destination.is_relative_to(workspace_root): raise ValueError("Destination escapes workspace") ``` 3. Apply equivalent containment validation to the quarantine payload and metadata paths. 4. Validate the JSON against a strict schema and reject missing, incorrectly typed, or unexpected fields. 5. Replace substring matching with exact matching against a unique quarantine identifier or canonical original path. 6. Refuse to overwrite an existing destination by default. Require an explicit `--force` option and user confirmation for replacement. 7. Create quarantine metadata with restrictive permissions and, where practical, include an integrity-protected identifier or digest. 8. Add tests for absolute paths, `../` traversal, symlink traversal, malformed metadata, ambiguous names, and existing destinations. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/vault.py:863
Finding
Under-documented remediation commands can modify or relocate SSH private keys and follow credential-named symlinks<![CDATA[ ## Vulnerability Details **File Location**: `scripts/vault.py:63-66`, `scripts/vault.py:863-938`, `scripts/vault.py:948-1000`, and `scripts/vault.py:1380-1500`; affected command documentation is absent from `SKILL.md:25-58` **Vulnerability Type**: Excessive file mutation privileges and unsafe symlink handling **Risk Level**: Medium ### Vulnerable Code ```python CREDENTIAL_FILES = { ".env", ".env.local", ".env.production", ".env.staging", ".env.development", ".env.test", ".env.ci", "credentials.json", "service-account.json", "secrets.json", ".npmrc", ".pypirc", ".netrc", ".pgpass", ".my.cnf", "id_rsa", "id_ed25519", "id_ecdsa", "id_dsa", "htpasswd", ".htpasswd", } ``` ```python def cmd_fix_permissions(workspace): """Auto-fix file permissions on credential files. Unix: chmod 600 (owner read/write only). Windows: icacls to restrict access to current user only. """ ... cred_files = collect_files( workspace, names=CREDENTIAL_FILES, extensions=CREDENTIAL_EXTENSIONS, ) ... for fpath in cred_files: rel = fpath.relative_to(workspace) if sys.platform == "win32": username = os.environ.get("USERNAME", os.environ.get("USER", "")) if not username: print(f" [SKIP] {rel} -- cannot determine current user") skipped += 1 continue try: subprocess.run( ["icacls", str(fpath), "/inheritance:r", "/grant:r", f"{username}:(R,W)"], capture_output=True, text=True, timeout=15, ) print(f" [FIXED] {rel} -- restricted to {username} (R,W)") fixed += 1 except (FileNotFoundError, subprocess.TimeoutExpired, OSError) as exc: print(f" [ERROR] {rel} -- {exc}") errors += 1 else: try: current_mode = fpath.stat().st_mod ...[truncated 4205 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Document every mutating command in `SKILL.md` and `README.md`, including its effects on SSH keys, certificates, environment files, and application credentials. 2. Keep scan-only behavior as the default. Require a clearly named remediation flag and explicit user consent before changing or moving files. 3. Present a dry-run plan listing every target and proposed action before applying modifications. 4. Require per-file confirmation or an explicit allowlist for SSH private keys and other high-impact credential types. 5. Reject symlinks before mutation: ```python if fpath.is_symlink(): print(f"[SKIP] {rel} -- symbolic links are not modified") continue ``` 6. Resolve every target and verify that it remains under `workspace.resolve()` before `chmod`, ACL changes, or moves. 7. On platforms that support it, use non-following file operations and verify inode identity immediately before mutation to reduce time-of-check/time-of-use risks. 8. Check the `icacls` return code and report the operation as successful only when the command exits successfully. 9. Make quarantine non-destructive by default, or require explicit confirmation before moving files used by authentication or deployment workflows. 10. Add tests covering SSH keys, symlinks to external files, concurrent path replacement, failed ACL commands, and remediation dry-run behavior. ]]>

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (68)

Credential Access

High
Category
Privilege Escalation
Content
## Why This Matters

Credentials don't just leak through source code. They leak through:
- **Permissions** — .env files readable by every user on the system
- **Shell history** — passwords and tokens visible in `.bash_history`
- **Git config** — credentials embedded in remote URLs
- **Config files** — hardcoded secrets in JSON/YAML/TOML/INI configs
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
## Why This Matters

Credentials don't just leak through source code. They leak through:
- **Permissions** — .env files readable by every user on the system
- **Shell history** — passwords and tokens visible in `.bash_history`
- **Git config** — credentials embedded in remote URLs
- **Config files** — hardcoded secrets in JSON/YAML/TOML/INI configs
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
## Why This Matters

Credentials don't just leak through source code. They leak through:
- **Permissions** — .env files readable by every user on the system
- **Shell history** — passwords and tokens visible in `.bash_history`
- **Git config** — credentials embedded in remote URLs
- **Config files** — hardcoded secrets in JSON/YAML/TOML/INI configs
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
## Why This Matters

Credentials don't just leak through source code. They leak through:
- **Permissions** — .env files readable by every user on the system
- **Shell history** — passwords and tokens visible in `.bash_history`
- **Git config** — credentials embedded in remote URLs
- **Config files** — hardcoded secrets in JSON/YAML/TOML/INI configs
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
## Why This Matters

Credentials don't just leak through source code. They leak through:
- **Permissions** — .env files readable by every user on the system
- **Shell history** — passwords and tokens visible in `.bash_history`
- **Git config** — credentials embedded in remote URLs
- **Config files** — hardcoded secrets in JSON/YAML/TOML/INI configs
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
## Why This Matters

Credentials don't just leak through source code. They leak through:
- **Permissions** — .env files readable by every user on the system
- **Shell history** — passwords and tokens visible in `.bash_history`
- **Git config** — credentials embedded in remote URLs
- **Config files** — hardcoded secrets in JSON/YAML/TOML/INI configs
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
## Why This Matters

Credentials don't just leak through source code. They leak through:
- **Permissions** — .env files readable by every user on the system
- **Shell history** — passwords and tokens visible in `.bash_history`
- **Git config** — credentials embedded in remote URLs
- **Config files** — hardcoded secrets in JSON/YAML/TOML/INI configs
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
## Why This Matters

Credentials don't just leak through source code. They leak through:
- **Permissions** — .env files readable by every user on the system
- **Shell history** — passwords and tokens visible in `.bash_history`
- **Git config** — credentials embedded in remote URLs
- **Config files** — hardcoded secrets in JSON/YAML/TOML/INI configs
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
## Why This Matters

Credentials don't just leak through source code. They leak through:
- **Permissions** — .env files readable by every user on the system
- **Shell history** — passwords and tokens visible in `.bash_history`
- **Git config** — credentials embedded in remote URLs
- **Config files** — hardcoded secrets in JSON/YAML/TOML/INI configs
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The skill reads shell history and shell configuration files from the user's home directory, which exceeds the stated workspace-scoped behavior and grants access to highly sensitive data outside the project. Those files commonly contain plaintext credentials, tokens, internal hostnames, and command history unrelated to the workspace, so this broadens data access significantly.

Credential Access

High
Category
Privilege Escalation
Content
# Credential file names
CREDENTIAL_FILES = {
    ".env", ".env.local", ".env.production", ".env.staging", ".env.development",
    ".env.test", ".env.ci",
    "credentials.json", "service-account.json", "secrets.json",
    ".npmrc", ".pypirc", ".netrc", ".pgpass", ".my.cnf",
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# Credential file names
CREDENTIAL_FILES = {
    ".env", ".env.local", ".env.production", ".env.staging", ".env.development",
    ".env.test", ".env.ci",
    "credentials.json", "service-account.json", "secrets.json",
    ".npmrc", ".pypirc", ".netrc", ".pgpass", ".my.cnf",
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# Credential file names
CREDENTIAL_FILES = {
    ".env", ".env.local", ".env.production", ".env.staging", ".env.development",
    ".env.test", ".env.ci",
    "credentials.json", "service-account.json", "secrets.json",
    ".npmrc", ".pypirc", ".netrc", ".pgpass", ".my.cnf",
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# Credential file names
CREDENTIAL_FILES = {
    ".env", ".env.local", ".env.production", ".env.staging", ".env.development",
    ".env.test", ".env.ci",
    "credentials.json", "service-account.json", "secrets.json",
    ".npmrc", ".pypirc", ".netrc", ".pgpass", ".my.cnf",
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# Credential file names
CREDENTIAL_FILES = {
    ".env", ".env.local", ".env.production", ".env.staging", ".env.development",
    ".env.test", ".env.ci",
    "credentials.json", "service-account.json", "secrets.json",
    ".npmrc", ".pypirc", ".netrc", ".pgpass", ".my.cnf",
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# Credential file names
CREDENTIAL_FILES = {
    ".env", ".env.local", ".env.production", ".env.staging", ".env.development",
    ".env.test", ".env.ci",
    "credentials.json", "service-account.json", "secrets.json",
    ".npmrc", ".pypirc", ".netrc", ".pgpass", ".my.cnf",
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# Credential file names
CREDENTIAL_FILES = {
    ".env", ".env.local", ".env.production", ".env.staging", ".env.development",
    ".env.test", ".env.ci",
    "credentials.json", "service-account.json", "secrets.json",
    ".npmrc", ".pypirc", ".netrc", ".pgpass", ".my.cnf",
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# Credential file names
CREDENTIAL_FILES = {
    ".env", ".env.local", ".env.production", ".env.staging", ".env.development",
    ".env.test", ".env.ci",
    "credentials.json", "service-account.json", "secrets.json",
    ".npmrc", ".pypirc", ".netrc", ".pgpass", ".my.cnf",
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# Credential file names
CREDENTIAL_FILES = {
    ".env", ".env.local", ".env.production", ".env.staging", ".env.development",
    ".env.test", ".env.ci",
    "credentials.json", "service-account.json", "secrets.json",
    ".npmrc", ".pypirc", ".netrc", ".pgpass", ".my.cnf",
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# Credential file names
CREDENTIAL_FILES = {
    ".env", ".env.local", ".env.production", ".env.staging", ".env.development",
    ".env.test", ".env.ci",
    "credentials.json", "service-account.json", "secrets.json",
    ".npmrc", ".pypirc", ".netrc", ".pgpass", ".my.cnf",
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# Credential file names
CREDENTIAL_FILES = {
    ".env", ".env.local", ".env.production", ".env.staging", ".env.development",
    ".env.test", ".env.ci",
    "credentials.json", "service-account.json", "secrets.json",
    ".npmrc", ".pypirc", ".netrc", ".pgpass", ".my.cnf",
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# Credential file names
CREDENTIAL_FILES = {
    ".env", ".env.local", ".env.production", ".env.staging", ".env.development",
    ".env.test", ".env.ci",
    "credentials.json", "service-account.json", "secrets.json",
    ".npmrc", ".pypirc", ".netrc", ".pgpass", ".my.cnf",
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# Credential file names
CREDENTIAL_FILES = {
    ".env", ".env.local", ".env.production", ".env.staging", ".env.development",
    ".env.test", ".env.ci",
    "credentials.json", "service-account.json", "secrets.json",
    ".npmrc", ".pypirc", ".netrc", ".pgpass", ".my.cnf",
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# Credential file names
CREDENTIAL_FILES = {
    ".env", ".env.local", ".env.production", ".env.staging", ".env.development",
    ".env.test", ".env.ci",
    "credentials.json", "service-account.json", "secrets.json",
    ".npmrc", ".pypirc", ".netrc", ".pgpass", ".my.cnf",
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# Credential file names
CREDENTIAL_FILES = {
    ".env", ".env.local", ".env.production", ".env.staging", ".env.development",
    ".env.test", ".env.ci",
    "credentials.json", "service-account.json", "secrets.json",
    ".npmrc", ".pypirc", ".netrc", ".pgpass", ".my.cnf",
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

No suspicious patterns detected.