OpenClaw Warden Pro

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:59 AM UTC
• Version: 1.0.1

Overview

This skill is a real local security tool, but it recommends automatic startup remediation that can overwrite workspace files or disable skills without review.

Install only if you are comfortable with a local tool that can overwrite monitored instruction/config files and rename skill directories. Do not enable the startup hook or heartbeat automation until restore paths are confined, symlinks are rejected, protect defaults to report-only, and destructive actions require explicit approval.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/integrity.py:616

Finding

Path Traversal Allows Restore Operations Outside the Workspace

Content

View full analysis

Remediation

View remediation

Path: relative = Path(user_path.replace("\\", "/")) if relative.is_absolute() or ".." in relative.parts: raise ValueError("Absolute paths and traversal are not allowed") root = root.resolve() candidate = (root / relative).resolve() if not candidate.is_relative_to(root): raise ValueError("Path escapes the authorized root") return candidate ``` - For `restore`, accept only relative paths already recorded in the integrity manifest. - Independently validate the snapshot source under `.integrity/snapshots` and the destination under the workspace. - Apply the same centralized validation to `accept`, `restore`, and `rollback`. - Revalidate paths immediately before writing to reduce time-of-check/time-of-use exposure. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/integrity.py:772

Finding

Symlink-Following Restore Can Overwrite External Files

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/integrity.py:770

Finding

Protection Sweep Unconditionally Reverts All Modified Critical Files

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Instruction Override

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · README.md (reported line 118)May include surrounding context.

md

- New untracked files

### Prompt Injection Patterns
- **Instruction override** — "ignore previous instructions", "you are now", "forget your instructions"
- **System prompt markers** — `<system>`, `[SYSTEM]`, `<<SYS>>`, `[INST]`
- **Markdown exfiltration** — Image tags with encoded data in URLs
- **Base64 payloads** — Large encoded blobs outside code blocks

Instruction Override

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · README.md (reported line 118)May include surrounding context.

md

- New untracked files

### Prompt Injection Patterns
- **Instruction override** — "ignore previous instructions", "you are now", "forget your instructions"
- **System prompt markers** — `<system>`, `[SYSTEM]`, `<<SYS>>`, `[INST]`
- **Markdown exfiltration** — Image tags with encoded data in URLs
- **Base64 payloads** — Large encoded blobs outside code blocks

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · README.md (reported line 118)May include surrounding context.

} }

text

### OpenClaw (heartbeat)

Add to HEARTBEAT.md:

• Run workspace integrity protection

text

### After Installing New Skills

Run `protect` to auto-quarantine skills that modified workspace files.

## What It Detects

### Integrity Violations
- Modified files (SHA-256 checksum comparison)
- Deleted files
- New untracked files

### Prompt Injection Patterns
- **Instruction override** — "ignore previous instructions", "you are now", "forget your instructions"
- **System prompt markers** — `<system>`, `[SYSTEM]`, `<<SYS>>`, `[INST]`
- **Markdown exfiltration** — Image tags with encoded data in URLs
- **Base64 payloads** — Large encoded blobs outside code blocks
- **Unicode manipulation** — Zero-width characters, RTL overrides, homoglyphs
- **HTML injection** — `<script>`, `<iframe>`, hidden elements
- **Shell injection** — `$(...)` subshell execution outside code blocks

## File Categories

| Category | Files | Alert Level |
|----------|-------|-------------|
| Crit

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The manifest markets the skill as a 'full workspace security suite' and emphasizes protection, but the documented behavior includes mutating trust state, writing baseline data into the workspace, and destructive countermeasures whose coverage is narrower than advertised. This mismatch is dangerous because users and agents may grant trust or auto-run the skill assuming comprehensive, defensive behavior when it can also alter the workspace and institutionalize a compromised state via baseline acceptance.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation recommends an automated 'protect' action that can restore files and quarantine skills, but it does not clearly warn that these are destructive workspace modifications that may remove legitimate changes or disable installed components. In a security-themed skill, silent auto-remediation is especially risky because users may assume it is always safe and corrective, even when detections are incomplete or mistaken.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The recommended SessionStart hook auto-executes remediation every session, enabling unsolicited file restoration and skill quarantine before the user reviews what changed. This is highly dangerous because startup automation amplifies any false positive, poisoned baseline, or adversarial configuration into repeated destructive actions across the workspace, effectively giving the skill persistent authority to rewrite security-sensitive files.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The restore command joins a user-supplied path directly with the workspace and copies snapshot content to that destination without verifying that the resolved destination remains inside the workspace. An attacker who can influence the filepath argument or convince an operator to use a traversal path like '../../target' may overwrite arbitrary files writable by the current user, which is especially dangerous in a security tool with destructive repair features.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Protect mode automatically restores files and quarantines skills based on pattern matches, without any confirmation gate, dry-run default, or trust boundary checks. In this skill context, that is more dangerous because the tool is positioned as an autonomous security layer; a false positive or manipulated baseline can trigger broad destructive changes to the workspace and disable skills automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README promotes automated restore, rollback, and quarantine actions but does not clearly warn users that these countermeasures can overwrite legitimate work, disable installed skills, or alter repository state. In a security automation tool, lack of explicit caution increases the chance of unsafe deployment and unintended destructive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The session-start hook configuration causes protective actions to run automatically on every session, yet the README does not warn that this may trigger restoration, rollback, or quarantine without per-run review. Auto-execution at startup makes accidental disruption more likely because the user may not realize state-changing actions are occurring implicitly.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill is explicitly user-invocable and documents shell commands that can read and write workspace files, restore snapshots, rename skill directories, and perform rollback operations, yet it declares no tool scope or allowed-tools constraints. That leaves a powerful, destructive skill under-bounded, increasing the chance an agent invokes filesystem and shell capabilities more broadly than users expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest uses broad activation language for a user-invocable skill with shell and file-write capabilities, making it easier for an agent to apply the skill in situations that do not justify destructive remediation. In context, this is more dangerous because the skill presents itself as a general security layer, which can bias users toward trusting broad invocation without understanding the side effects.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The accept command updates the manifest hash for a changed file but does not refresh the stored snapshot for categories that are supposed to be restorable. That means a malicious or accidental file change can be accepted into the baseline while restore still points to stale content, undermining the advertised integrity and recovery guarantees and potentially causing inconsistent or unsafe remediation behavior later.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/integrity.py (reported line 656)May include surrounding context.

python

sys.exit(1)

    # Check if file is tracked by git
    result = subprocess.run(
        ["git", "ls-files", rel],
        cwd=str(workspace),
        capture_output=True, text=True,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The rollback command runs 'git checkout HEAD -- ', which discards local changes to the target file. Although the module docstring mentions git rollback, this function itself provides no explicit pre-action warning or confirmation before carrying out an irreversible overwrite of user changes.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/integrity.py (reported line 666)May include surrounding context.

python

sys.exit(1)

    # Checkout from HEAD
    result = subprocess.run(
        ["git", "checkout", "HEAD", "--", rel],
        cwd=str(workspace),
        capture_output=True, text=True,

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The protect workflow claims to quarantine skills containing injections, but the implementation only quarantines when the injected file path matches skills//SKILL.md. If a malicious skill hides prompt injection in other monitored files or in unmonitored files associated with the skill, the tool may report protection while leaving the skill active, creating a false sense of security in a tool specifically marketed as an automatic defense layer.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/integrity.py (reported line 784)May include surrounding context.

python

git_dir = workspace / ".git"
            if git_dir.exists():
                import subprocess
                result = subprocess.run(
                    ["git", "checkout", "HEAD", "--", rel],
                    cwd=str(workspace),
                    capture_output=True, text=True,

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: README.md:118