OpenClaw Master Ops

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:59 AM UTC
• Version: 1.1.0

Overview

This skill is not clearly malicious, but it gives broad OpenClaw admin guidance including destructive commands, cron automation, secrets/session operations, and a self-update publishing workflow that deserve manual review before use.

Install only if you want a broad OpenClaw administration skill and are comfortable reviewing commands before execution. Treat reset, repair, secrets, session, config, cron, plugin/skill update, and publish commands as manual approval actions, and do not let release-tracker output directly edit or republish the skill without independent human review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description presents this as a comprehensive OpenClaw operations skill for many operational tasks. The supplied code chunk does not implement those capabilities; it only provides release/version tracking and breaking-change detection using SQLite, local docs, GitHub API access, and JSON export. The release-tracking portion mentioned in the description is represented accurately, but it is only one small subset of the claimed functionality. Therefore the declared purpose materially overstates the skill’s actual behavior.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The instruction to 'Edit SKILL.md based on breaking changes' couples external release data to changes in the skill's own operational behavior. In agent environments this is dangerous because it creates a pathway for indirect prompt/instruction poisoning and persistent modification of future behavior.

Content

Scanner excerpt · SKILL.md (reported line 555)May include surrounding context.

md

1. **Run sync** — `python3 scripts/release-tracker.py sync`
2. **Check breaking** — `python3 scripts/release-tracker.py breaking`
3. **Review skill updates** — `python3 scripts/release-tracker.py skill-update`
4. **Update skill if needed** — Edit SKILL.md based on breaking changes
5. **Republish** — `clawhub publish ... --version 1.X.0 --changelog "Updated for OpenClaw <version>"`

### Breaking Change Detection

Self-Modification

High

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The instruction to 'Edit SKILL.md based on breaking changes' couples external release data to changes in the skill's own operational behavior. In agent environments this is dangerous because it creates a pathway for indirect prompt/instruction poisoning and persistent modification of future behavior.

Content

Scanner excerpt · SKILL.md (reported line 555)May include surrounding context.

md

1. **Run sync** — `python3 scripts/release-tracker.py sync`
2. **Check breaking** — `python3 scripts/release-tracker.py breaking`
3. **Review skill updates** — `python3 scripts/release-tracker.py skill-update`
4. **Update skill if needed** — Edit SKILL.md based on breaking changes
5. **Republish** — `clawhub publish ... --version 1.X.0 --changelog "Updated for OpenClaw <version>"`

### Breaking Change Detection

Self-Modification

High

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The document instructs the agent/operator to update the skill when version changes are detected, creating a self-modification workflow. In an agent skill context, any content that encourages modifying the skill based on external release data increases the risk of prompt/knowledge poisoning, persistence of bad instructions, and unauthorized behavioral changes if the update process is automated or insufficiently reviewed.

Content

Scanner excerpt · references/release-tracking.md (reported line 105)May include surrounding context.

Release Tracking

• Run release-tracker.py skill-update if OpenClaw updated
• Review breaking changes if any
• Update skill knowledge for affected topics

text

## Skill Update Workflow

Self-Modification

High

• Category: Rogue Agent
• Confidence: 96% confidence

Finding

This section explicitly tells the operator to edit SKILL.md and the references directory in response to detected changes. In a skill package, that is direct self-modification guidance, which is dangerous because externally sourced changelog content or faulty detection logic could cause the skill's instructions to be altered and then redistributed.

Content

Scanner excerpt · references/release-tracking.md (reported line 123)May include surrounding context.

3. Update the skill

   bash

   # Edit SKILL.md
   nvim /home/marius/.openclaw/workspace/skills/openclaw-master-ops/SKILL.md
   
   # Update references
   

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/release-tracking.md (reported line 130)May include surrounding context.

nvim /home/marius/.openclaw/workspace/skills/openclaw-master-ops/references/

text

4. **Update skill_knowledge table**
```bash
sqlite3 release-history.db "UPDATE skill_knowledge SET last_verified_version='2026.4.11', needs_update=FALSE WHERE topic='gateway commands';"

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/release-tracking.md (reported line 153)May include surrounding context.

nvim /home/marius/.openclaw/workspace/skills/openclaw-master-ops/references/

text

4. **Update skill_knowledge table**
```bash
sqlite3 release-history.db "UPDATE skill_knowledge SET last_verified_version='2026.4.11', needs_update=FALSE WHERE topic='gateway commands';"

Self-Modification

High

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

Republishing the skill after updating tracking data creates a persistence and supply-chain risk: modified skill content can be pushed to downstream users. In combination with release-driven edits, this allows poisoned or mistaken updates to propagate broadly, making the context more dangerous than a private local edit.

Content

Scanner excerpt · references/release-tracking.md (reported line 132)May include surrounding context.

4. Update skill_knowledge table

   bash

   sqlite3 release-history.db "UPDATE skill_knowledge SET last_verified_version='2026.4.11', needs_update=FALSE WHERE topic='gateway commands';"
   

5. Republish to ClawHub

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs use of shell commands, local file/database access, cron automation, and networked update/sync operations, but it does not declare any explicit tool scope or permissions boundary. That makes the operational blast radius unclear to the invoking agent and increases the chance the skill will be run with broader capabilities than necessary.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill presents itself as the definitive solution for nearly any OpenClaw operations task, which can cause over-invocation of a high-capability skill in situations where narrower skills would be safer. In a security-sensitive agent ecosystem, overly broad activation criteria increase the chance of unnecessary shell, filesystem, or network actions being authorized.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The phrase 'Use this skill whenever the user needs to' followed by an expansive list creates ambiguous activation logic and encourages use across many privileged workflows. Because the skill includes guidance for destructive, security-sensitive, and automation-related actions, ambiguous triggering increases risk of misuse or accidental execution in the wrong context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This section includes destructive operations such as reset, deletion, force-stop, repair, and allowlist modification, but warning language is not consistently attached to each risky command. In an agent setting, examples often become executable guidance, so insufficient per-command safeguards can lead to state loss, service disruption, or weakened security posture.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 319)May include surrounding context.

md

openclaw channels status <channel>

# 2. Verify credentials exist
ls -la ~/.openclaw/credentials/

# 3. Re-authenticate
openclaw channels auth <channel>

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/release-tracking.md (reported line 124)May include surrounding context.

3. Update the skill

   bash

   # Edit SKILL.md
   nvim /home/marius/.openclaw/workspace/skills/openclaw-master-ops/SKILL.md
   
   # Update references
   nvim /home/marius/.openclaw/workspace/skills/openclaw-master-ops/references/
   

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/release-tracker.py (reported line 70)May include surrounding context.

python

def get_openclaw_version():
    """Get current OpenClaw version."""
    try:
        result = subprocess.run(
            ["openclaw", "--version"],
            capture_output=True, text=True, timeout=10
        )

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/release-tracker.py (reported line 103)May include surrounding context.

python

# Try GitHub API
    try:
        import urllib.request
        url = "https://api.github.com/repos/openclaw/openclaw/releases"
        with urllib.request.urlopen(url, timeout=10) as response:
            github_releases = json.loads(response.read())
            for rel in github_releases[:10]:  # Last 10 releases

Static analysis

No suspicious patterns detected.