Security Audit Hand

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:35 AM UTC
• Version: 1.0.0

Overview

This security-audit skill has a coherent purpose, but it can expose API keys, sensitive logs, host details, and retained audit history without clear consent or redaction safeguards.

Review this skill before installing or running it. Use it only if you are comfortable with an agent inspecting OpenClaw configuration, local logs, process/network details, and possibly credential files. Prefer a revised version that checks file permissions and key presence without printing key values, redacts log matches, asks before outbound network calls, and disables scheduled audits, notifications, or saved history unless explicitly enabled.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:92
• Finding: Sensitive Credentials and Log Data Are Exposed to the Agent Context## Vulnerability Details **File Location**: `SKILL.md`, lines 92 and 101-107 **Vulnerability Type**: Excessive access to credential-bearing files and unsafe secret handling **Risk Level**: High ### Vulnerable Code ```bash cat ~/.openclaw/.api-keys.md | grep -E "sk-|nvapi-" grep -i "error\|fail\|unauthorized" /tmp/openclaw/*.log grep -c "error" /tmp/openclaw/openclaw-*.log grep -E "sk-[a-zA-Z0-9]+" /tmp/openclaw/*.log ``` ### Technical Analysis The skill explicitly reads a file named `.api-keys.md` and searches it for API-key prefixes. It also searches application logs for token-shaped strings and returns the matching lines. Because this is a prompt-only skill, command output is expected to enter the agent's execution context. A matching line can contain the complete credential rather than a redacted indicator. This violates least-privilege and secret-minimization principles: validating whether a key exists or whether file permissions are safe does not require disclosing the key value. Log matches may also include authentication tokens, request payloads, user data, error context, or other operationally sensitive information. The skill includes report history and notification features, creating a potential secondary disclosure route if raw command output is incorporated into persistent reports or messages. ### Attack Path 1. A user or automated schedule invokes the security-audit skill. 2. The skill reads `~/.openclaw/.api-keys.md`. 3. The `grep` command emits lines containing prefixes such as `sk-` or `nvapi-`, potentially revealing complete API keys. 4. The skill searches `/tmp/openclaw/*.log` for errors and token-shaped values. 5. Matching credentials and sensitive log lines enter the agent context. 6. The exposed values may subsequently be included in an audit report, retained report history, or configured notification channel. 7. Anyone with access to those contexts or reports could reuse a valid credenti ...[truncated 770 chars]
• Remediation: ## Remediation Suggestions 1. Remove the command that reads the contents of `.api-keys.md`. 2. Audit only file metadata and permissions, for example: ```bash stat -c '%a %U %G %n' ~/.openclaw/.api-keys.md ``` 3. Determine whether credentials are configured without returning their values. Emit only a Boolean result, provider name, file path, and remediation status. 4. Perform secret detection through a local redaction routine that replaces values with a fixed marker or a short, non-reversible fingerprint. 5. Never include raw matching log lines in reports. Report the file name, line number, match category, and a fully redacted excerpt. 6. Require explicit user authorization before accessing credential stores or logs. 7. Apply restrictive permissions such as `0600` to credential files and audit-report files. 8. Sanitize all findings before saving report history or sending notifications. 9. If this skill has already been used, inspect generated reports and agent logs for exposed keys, delete unsafe copies, and rotate any credential that may have been disclosed.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:60
• Finding: Overbroad Host Reconnaissance and Unnecessary External IP Disclosure## Vulnerability Details **File Location**: `SKILL.md`, lines 60-68 and line 95 **Vulnerability Type**: Excessive system enumeration and third-party network disclosure **Risk Level**: Medium ### Vulnerable Code ```bash uname -a whoami pwd df -h free -h netstat -tlnp curl ifconfig.me ps aux | grep openclaw ``` ### Technical Analysis The workflow gathers the kernel and operating-system profile, current identity, working directory, filesystem capacity, memory information, listening network services, and process details. This produces a consolidated reconnaissance profile that is broader than an application-scoped OpenClaw configuration audit. Depending on the invoking account, `netstat -tlnp` and `ps aux` may expose service names, process arguments, listening ports, account names, and operational metadata. Process command lines can sometimes contain paths, configuration arguments, endpoints, or credentials. The `curl ifconfig.me` request contacts an external third-party service. This reveals the audit host's public source IP address and request timing to that service. The endpoint is not pinned, authenticated, or identified as an approved audit dependency. Public-IP discovery is not necessary for most local security checks and should not occur without explicit consent. ### Attack Path 1. A user requests a general audit or an automated schedule triggers the skill. 2. The skill enumerates host identity, operating-system details, resource information, listening services, and OpenClaw-related processes. 3. The resulting output enters the agent context and may be copied into an audit report. 4. The skill sends an outbound request to `ifconfig.me`. 5. The third party observes the audit host's public IP address and request metadata. 6. Anyone who later obtains the audit report can use the consolidated host, process, and port data to identify exposed services and prioritize further attacks. ### Impact Assessmen ...[truncated 563 chars]
• Remediation: ## Remediation Suggestions 1. Default to an OpenClaw-only audit and require explicit authorization before performing host-wide enumeration. 2. Define a documented audit scope and allow users to opt into network, process, filesystem, and operating-system checks separately. 3. Remove `curl ifconfig.me` from the default workflow. 4. If public-IP verification is required, use an organization-controlled service, require explicit consent, enforce HTTPS verification, and document the metadata disclosed. 5. Replace full `ps aux` output with a narrowly scoped status command that excludes command-line arguments and environment data. 6. Filter listening-port output to the relevant OpenClaw process and redact unrelated service information. 7. Avoid collecting the current working directory, storage inventory, or memory details unless those values are necessary for a specific audit control. 8. Redact hostnames, usernames, addresses, process arguments, and internal paths before persisting reports. 9. Protect retained reports with restrictive access controls and a short, enforced retention period.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The skill content and usage instructions are entirely in Chinese, and there is no statement that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking audience. This can violate language or locale policy where user choice or explicit justification is required.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The workflow includes an external IP lookup via a network request without warning the user that system metadata will be sent to a third party. Even if the request is simple, it can disclose that the host is performing an audit, reveal its public IP to the external service, and violate privacy or network policy expectations.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill directs inspection of sensitive local files and likely secrets, including grepping API key material and examining OpenClaw configuration, without a clear warning or consent model. This is dangerous because an audit run could expose credentials in output, logs, memory, or saved reports, turning a diagnostic task into secret exfiltration or unnecessary data handling.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

### Phase 4: 权限检查
```bash
# 文件权限
ls -la ~/.openclaw/
ls -la ~/.openclaw/workspace/

# API Key 权限

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

### Phase 4: 权限检查
```bash
# 文件权限
ls -la ~/.openclaw/
ls -la ~/.openclaw/workspace/

# API Key 权限

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The manual trigger phrase is broad enough to match ordinary user requests for help with security, which can cause the skill to activate unexpectedly. In this skill, unexpected activation is risky because the workflow includes host inspection, reading local files, log scraping, and possible exposure of sensitive configuration and credential material.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The additional example phrases describe generic intents like checking the current security score or scheduling weekly audits, which overlap with normal conversation. Because the skill can perform sensitive audit behavior, broad activation boundaries increase the chance of unintentional execution and collection of private system information.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The skill states that historical reports are read and retained, but it does not clearly warn that audit data may persist over time. Audit reports often contain sensitive system details, so silent retention increases the risk of later disclosure or accumulation of high-value reconnaissance data.

Static analysis

No suspicious patterns detected.