ClawHub
Back to skill

Security audit

OpenClaw JSON Editing Masterclass

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches OpenClaw configuration editing, but it includes commands that can expose credentials and make authenticated provider requests without clear safeguards.

Review before installing if your OpenClaw config may contain plaintext API keys, tokens, or passwords. Do not run the secret-search, raw config dump, effective config dump, or provider curl examples unless you explicitly intend to expose those values to the agent/session and contact the named provider APIs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:353
Finding

Raw Credential Disclosure Through Recursive Configuration Audit Command

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 353
Vulnerability Type: Sensitive information exposure
Risk Level: Medium

Vulnerable Code

bash
# Deep search for all API keys (for audit)
jq '.. | objects | .apiKey? // .token? // .password? | select(.)' ~/.openclaw/config.json

Technical Analysis

The documented jq command recursively searches the OpenClaw configuration for fields named apiKey, token, or password and writes their raw values to standard output.

Displaying secret values is not required to establish whether credentials exist. The command therefore exceeds the minimum access and disclosure necessary for a configuration audit. When an AI agent executes it, the output may also enter the agent's context, session transcript, terminal capture, debug logs, monitoring systems, or other downstream tools.

Although the Skill separately recommends environment-variable references, users may still have resolved or plaintext credentials in the configuration. The command does not redact, hash, or otherwise protect those values.

Attack Path

  1. A user has an API key, bot token, gateway token, or password stored in ~/.openclaw/config.json.
  2. The Skill is used to audit the configuration.
  3. The agent follows the documented command at line 353.
  4. jq recursively finds matching fields and prints their complete values.
  5. The command output is captured in an agent transcript, terminal log, observability system, or another accessible context.
  6. A party with access to that output obtains the credentials and reuses them against the associated services.

This issue does not itself transmit credentials to an attacker-controlled endpoint, but it materially increases their exposure and creates a practical disclosure channel.

Impact Assessment

An exposed credential grants the permissions assigned to that credential. Depending on the configuration, the impact may include:

  • Unauthorized use of paid model-provider A ...[truncated 438 chars]
Remediation
View remediation

Remediation Suggestions

Replace the command with one that reports only matching configuration paths and never emits secret values:

bash
jq -r '
  paths(scalars) as $p
  | select(
      ($p[-1] | tostring)
      | test("^(apiKey|token|password|botToken|appToken)$"; "i")
    )
  | $p | map(tostring) | join(".")
' ~/.openclaw/config.json

Apply the following additional hardening measures:

  1. Explicitly state that raw credentials must never be printed, logged, copied into agent context, or included in audit reports.
  2. If value inspection is unavoidable, redact all but a minimal suffix and perform it only with informed user approval.
  3. Prefer checking whether a secret is represented by an environment-variable reference rather than resolving or displaying it.
  4. Avoid commands such as openclaw config get --json for secret auditing unless the tool guarantees redaction.
  5. Ensure configuration and audit-output files use restrictive permissions such as 0600.
  6. Rotate any credential that has already appeared in command output, transcripts, or logs.
  7. Add examples of safe audit output containing field paths and status indicators such as present, missing, or uses environment reference.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
70% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · SKILL.md (reported line 220)May include surrounding context.

md
return /\$\{[^}]+\}/.test(value);
}

// Collect all env var paths in an object
function collectEnvRefPaths(
  value: unknown,
  path: string,

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
71% confidence
Finding

The jq examples explicitly enumerate fields likely to contain secrets and environment-variable references across the user's config. While framed as audit operations, this materially increases the skill's ability to surface secret-bearing locations and could facilitate credential discovery if used by an over-permissive agent.

Content

Scanner excerpt · SKILL.md (reported line 355)May include surrounding context.

md
# Deep search for all API keys (for audit)
jq '.. | objects | .apiKey? // .token? // .password? | select(.)' ~/.openclaw/config.json

# Collect all environment variable references
jq -r '.. | strings | select(contains("${"))' ~/.openclaw/config.json

# Validate JSON structure (returns true/false)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 361)May include surrounding context.

Validate JSON structure (returns true/false)

jq 'if has("gateway") and has("agents") then true else false end' ~/.openclaw/config.json

Create minimal config from full config

jq '{ gateway: .gateway, agents: { main: .agents.main } }' ~/.openclaw/config.json

text

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 464)May include surrounding context.

bash
# If config is corrupted, OpenClaw keeps backups
ls -la ~/.openclaw/config.json.*

# Restore from backup
cp ~/.openclaw/config.json.2024-01-15T10-30-00.bak ~/.openclaw/config.json

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 545)May include surrounding context.

md
| `Trailing comma` | Trailing comma in array | Use JSON5 parser |
| `Env var not substituted` | Missing env var | Check `${VAR:-default}` |
| `Validation failed` | Schema mismatch | Run `openclaw config validate` |
| `Permission denied` | Wrong file permissions | `chmod 600 config.json` |

### Debug Commands

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill is scoped as JSON editing, but this section instructs the agent to perform credential-backed network discovery against third-party model APIs. That expands capabilities from local configuration editing into external data transmission and remote service interaction, which can expose secrets, trigger unintended outbound requests, and violate least-privilege expectations for the skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This line instructs an authenticated curl request to xAI's external API using a bearer token. In the context of a JSON-editing skill, that is unnecessary outbound transmission and creates risk of credential misuse, secret leakage through logs/history, and unintended third-party disclosure.

Content

Scanner excerpt · SKILL.md (reported line 574)May include surrounding context.

md
# xAI example - requires XAI_API_KEY
XAI_API_KEY="your-key"
curl -s -H "Authorization: Bearer $XAI_API_KEY" \
  https://api.x.ai/v1/models | jq '.data[] | {id: .id, name: .object}'

# OpenAI example
curl -s -H "Authorization: Bearer $OPENAI_API_KEY" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This example sends a bearer-authenticated request to OpenAI's models endpoint, which is external network activity unrelated to basic local JSON editing. It risks transmitting credentials and metadata to a third party and may encourage automatic execution by an agent operating beyond its stated scope.

Content

Scanner excerpt · SKILL.md (reported line 578)May include surrounding context.

md
# OpenAI example
curl -s -H "Authorization: Bearer $OPENAI_API_KEY" \
  https://api.openai.com/v1/models | jq '.data[] | select(.id | contains("gpt")) | .id'

# Together AI example
curl -s -H "Authorization: Bearer $TOGETHER_API_KEY" \

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

This line shows a credential-backed call to Together AI's external API, again expanding the skill into third-party communications. The danger is not the URL itself but the documented instruction to transmit authenticated requests from a skill whose declared purpose is local JSON manipulation.

Content

Scanner excerpt · SKILL.md (reported line 582)May include surrounding context.

Together AI example

curl -s -H "Authorization: Bearer $TOGETHER_API_KEY"
https://api.together.xyz/v1/models | jq '.[] | {id: .id, name: .display_name}'

text

### Provider Configuration Schema

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 637)May include surrounding context.

md
"models": {
    "providers": {
      "xai": {
        "baseUrl": "https://api.x.ai/v1",
        "api": "openai-completions",
        "apiKey": "${XAI_API_KEY}",
        "models": [

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 694)May include surrounding context.

md
"models": {
    "providers": {
      "xai": {
        "baseUrl": "https://api.x.ai/v1",
        "api": "openai-completions",
        "apiKey": "${XAI_API_KEY}",
        "models": [

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 725)May include surrounding context.

md
// OpenAI - with response API and reasoning
      "openai": {
        "baseUrl": "https://api.openai.com/v1",
        "api": "openai-responses",
        "apiKey": "${OPENAI_API_KEY}",
        "models": [

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation extends beyond editing JSON into testing remote model providers and connectivity, including live validation of provider behavior. For a JSON-editing skill, this broadens the operational surface unnecessarily and may prompt the agent to contact external services or spend user credentials while the user only requested local file changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The example writes changes through a temporary file and then moves it over the original config, which is a destructive overwrite pattern. Without a nearby warning or backup requirement, users or agents may clobber important configuration data accidentally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

These examples send authenticated requests to provider APIs but do not warn about secret handling, network egress, logging exposure, or billing implications. Even if intended as documentation, they normalize pasting credential-bearing commands into shells without safeguards.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.