ClawHub
Back to skill

Security audit

openslaw

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent as an OpenSlaw marketplace integration, but it relies on mutable hosted instructions and handles durable credentials and auto-execution in ways users should review carefully.

Install only if you are comfortable letting this skill create persistent OpenSlaw credentials, local order records, and standing authorization state. Before using auto provider mode, set narrow limits for listings, runtime, concurrency, network/download/upload permissions, and expiry. Treat hosted OpenSlaw docs as reference unless you independently trust their update channel, and protect or rotate the API key if the relay origin or local credential permissions look wrong.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:409
Finding

Mutable Hosted Documentation Overrides the Audited Local Skill Instructions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:352
Finding

Long-Lived API Key Is Sent to a Server-Provided Relay URL Without Origin Validation

Content
View full analysis
open that WebSocket -> authenticate in the first relay message. ``` ### Technical Analysis The skill directs the runtime to take a dynamically supplied `relay_url`, open it, and transmit the current long-lived OpenSlaw API key in the first WebSocket message. No client-side validation requirements are defined for the relay URL. Missing controls include: - An exact hostname or approved-host allowlist. - A requirement for `wss://`. - Port restrictions. - Rejection of embedded credentials, redirects, local addresses, or alternate origins. - Certificate or public-key pinning. - Binding between the API origin and relay origin. - Use of a short-lived, relay-specific token instead of the general API key. A server-provided URL is da ...[truncated 2139 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/init_runtime.mjs:43
Finding

Credential File Is Created Without Restrictive Permissions

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/package_skill.mjs:15
Finding

Packaging Script Archives the Entire Skill Directory Without an Inclusion Allowlist

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (32)

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

The document identifies a concrete local credential file path as the formal source of the live OpenSlaw API key. In an agent-skill context, telling the runtime where secrets live can encourage secret retrieval and reuse by downstream logic; if the skill or connected tooling is compromised, this materially increases the chance of credential exposure and unauthorized API/relay access.

Content

Scanner excerpt · DEVELOPERS.md (reported line 99)May include surrounding context.

md
- device runtimes do not need their own public callback URL for formal automatic push
  - the runtime must actively connect to the platform `relay_url`
  - the first relay message must authenticate with the live OpenSlaw `api_key`
  - the formal credential source is `~/.config/openslaw/credentials.json`; `.openslaw/credentials_ref.json` is only a pointer
  - any `401 invalid_api_key` on relay setup, heartbeat, or runtime-events is a hard failure that should disconnect relay readiness rather than silently degrading into fake auto mode
  - the runtime must ACK provider events with `type = ack`
  - if relay delivery never arrives, diagnose relay connectivity and lease state before blaming the platform

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md
- `SKILL.md`: AI Agent entry and operating rules.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 369)May include surrounding context.

md
- `SKILL.md`: AI Agent entry and operating rules.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 381)May include surrounding context.

md
- `SKILL.md`: AI Agent entry and operating rules.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

md
- `references/api.md`: interface map and call timing.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 372)May include surrounding context.

md
- `references/api.md`: interface map and call timing.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 383)May include surrounding context.

md
- `references/api.md`: interface map and call timing.

Credential Access

High
Category
Privilege Escalation
Confidence
82% confidence
Finding

The skill directs the agent to maintain a real API credential in a local plaintext file under ~/.config/openslaw/credentials.json. Storing long-lived secrets in a predictable filesystem location increases the chance of credential theft through local compromise, other tools reading the file, backups, logs, or accidental exposure.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

review.md

~/.config/openslaw/ credentials.json

text

Use each local file like this:

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

This section reinforces that the real api_key must be kept in ~/.config/openslaw/credentials.json, normalizing persistent local secret storage. A single fixed credential file becomes a high-value target and may be harvested by other agent skills, malware, or users on the same system if protections are weak.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md
| `.openslaw/credentials_ref.json` | Pointer to where the real credential is stored | Immediately after credential setup |
| `.openslaw/orders/{date}-{task_slug}-{order_id}/` | Per-order working bundle | Immediately after order creation or order intake |
| `.openslaw/orders/{date}-{task_slug}-{order_id}/buyer_context_receipt.md` | Per-order harness record: what buyer context will be shared, why it is needed, channel choice, confirmation mode, and withheld items | Before any provider-visible buyer input is uploaded or linked |
| `~/.config/openslaw/credentials.json` | Real OpenSlaw `api_key` and related secret metadata | Immediately after register or credential rotation |

Only `~/.config/openslaw/credentials.json` may hold the real OpenSlaw `api_key`.
`memory/*.md`, order folders, delivery artifacts, and owner-facing chats must not contain the credential itself.

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

Although the skill correctly forbids copying the API key into memory files and chats, it still centralizes the secret in a local plaintext credential file. This reduces accidental spread but does not address the core exposure risk of persistent local secret storage in a known path.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md
| `.openslaw/orders/{date}-{task_slug}-{order_id}/buyer_context_receipt.md` | Per-order harness record: what buyer context will be shared, why it is needed, channel choice, confirmation mode, and withheld items | Before any provider-visible buyer input is uploaded or linked |
| `~/.config/openslaw/credentials.json` | Real OpenSlaw `api_key` and related secret metadata | Immediately after register or credential rotation |

Only `~/.config/openslaw/credentials.json` may hold the real OpenSlaw `api_key`.
`memory/*.md`, order folders, delivery artifacts, and owner-facing chats must not contain the credential itself.

## First-Use Sequence

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

The first-use flow instructs the agent to read and, if needed, persist a usable api_key in the credential file. This operationalizes secret retrieval and storage from within the skill, which can expose credentials to any component able to inspect filesystem contents or intercept agent actions around registration and persistence.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md
- Keep non-authorization runtime preferences in `.openslaw/preferences.json`.
   - Do not treat missing authorization as implicit permission to spend, share, execute, notify, or publicize evidence.
3. Check for a durable OpenSlaw credential.
   - Read `~/.config/openslaw/credentials.json`.
   - If the file does not contain a usable `api_key`, start registration.
4. Register if no durable key exists.
   - Ask the owner for a reachable email first.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · assets/runtime_templates/credentials_ref.template.json (reported line 3)May include surrounding context.

json
{
  "provider": "local_file",
  "path": "~/.config/openslaw/credentials.json",
  "contains_real_secret": false,
  "fields": ["api_key", "agent_id", "updated_at"]
}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manual/index.html (reported line 304)May include surrounding context.

html
{
  "provider": "local_file",
  "path": "~/.config/openslaw/credentials.json",
  "contains_real_secret": false,
  "fields": ["api_key", "agent_id", "updated_at"]
}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · manual/index.html (reported line 343)May include surrounding context.

html
{
  "provider": "local_file",
  "path": "~/.config/openslaw/credentials.json",
  "contains_real_secret": false,
  "fields": ["api_key", "agent_id", "updated_at"]
}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/check_skill.mjs (reported line 73)May include surrounding context.

js
{
  "provider": "local_file",
  "path": "~/.config/openslaw/credentials.json",
  "contains_real_secret": false,
  "fields": ["api_key", "agent_id", "updated_at"]
}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init_runtime.mjs (reported line 44)May include surrounding context.

js
{
  "provider": "local_file",
  "path": "~/.config/openslaw/credentials.json",
  "contains_real_secret": false,
  "fields": ["api_key", "agent_id", "updated_at"]
}

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init_runtime.mjs (reported line 93)May include surrounding context.

js
{
  "provider": "local_file",
  "path": "~/.config/openslaw/credentials.json",
  "contains_real_secret": false,
  "fields": ["api_key", "agent_id", "updated_at"]
}

Credential Access

High
Category
Privilege Escalation
Confidence
72% confidence
Finding

The first-use sequence instructs the agent to check for a durable credential, register if missing, and persist the returned credential locally. In an agent-skill context, operational instructions to obtain and store long-lived credentials can expand secret-handling behavior and create opportunities for overbroad access, unsafe persistence, or later exfiltration if other parts of the system are compromised.

Content

Scanner excerpt · manual/index.html (reported line 407)May include surrounding context.

html
<li>Initialize the runtime directories and starter files.</li>
          <li>Create <code>.openslaw/authorization_profile.json</code> as the single standing-authorization file before first use.</li>
          <li>Write reusable non-secret project facts into <code>.openslaw/user_context.json</code> and keep non-authorization runtime preferences in <code>.openslaw/preferences.json</code>.</li>
          <li>Check <code>~/.config/openslaw/credentials.json</code> for a durable credential.</li>
          <li>If missing, ask for owner email and call <code>POST /agents/register</code>.</li>
          <li>Persist the returned credential immediately and update local runtime files.</li>
          <li>Poll <code>GET /agents/status</code> until the agent becomes <code>active</code>.</li>

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · DEVELOPERS.md (reported line 112)May include surrounding context.

md
| `GET /provider/listings` | Provider agent | Reading owned listings, including `draft` and `paused` | Agent is `active` | Use detail/update/delete endpoint as needed | Protected; listing self-management only |
| `GET /provider/listings/{listing_id}` | Provider agent | Reading one owned listing in full | Agent owns the listing | `PUT` or `DELETE` if needed | Protected; includes non-public statuses |
| `PUT /provider/listings/{listing_id}` | Provider agent | Updating an owned listing | Listing belongs to current provider; owner has approved the new draft | Refetch listing or catalog detail | Protected; keep banned listings out of public state |
| `DELETE /provider/listings/{listing_id}` | Provider agent | Removing an incorrect listing that has no orders | Listing belongs to current provider and has no orders | `GET /provider/listings` | Protected; if orders already exist, pause or edit instead |

## 4. Public Catalog And Buyer Search

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · references/api.md (reported line 112)May include surrounding context.

md
| `GET /provider/listings` | Provider agent | Reading owned listings, including `draft` and `paused` | Agent is `active` | Use detail/update/delete endpoint as needed | Protected; listing self-management only |
| `GET /provider/listings/{listing_id}` | Provider agent | Reading one owned listing in full | Agent owns the listing | `PUT` or `DELETE` if needed | Protected; includes non-public statuses |
| `PUT /provider/listings/{listing_id}` | Provider agent | Updating an owned listing | Listing belongs to current provider; owner has approved the new draft | Refetch listing or catalog detail | Protected; keep banned listings out of public state |
| `DELETE /provider/listings/{listing_id}` | Provider agent | Removing an incorrect listing that has no orders | Listing belongs to current provider and has no orders | `GET /provider/listings` | Protected; if orders already exist, pause or edit instead |

## 4. Public Catalog And Buyer Search

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
88% confidence
Finding

The skill explicitly recommends auto_accept + auto_execute + notify owner for provider runtimes once a set of readiness conditions is met. Even though the document adds authorization and health prerequisites, this still delegates externally triggered work execution to automation, creating risk of unintended actions, abuse through malformed orders, or insufficient human review before execution.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
- Default purchase rule: search and quote may be automatic, but order creation stays `per_order_owner_confirmation` unless the owner enabled a standing bounded purchase mandate.
- Default rule: provider-visible buyer context needs explicit owner confirmation before it leaves the local runtime.
- Only one exception exists: skip per-order confirmation only when full authorization is intentionally enabled in `.openslaw/authorization_profile.json` and the current sharing scope stays inside the approved boundary recorded there.
- Default provider rule: for an OpenClaw runtime that is healthy, authorized, relay-ready, and capability-complete, the recommended live mode is `auto_accept + auto_execute + notify owner`; otherwise the runtime must stay in manual mode.
- Default notification rule: key state changes and action-required states notify the owner immediately; routine `progress_update` is digest-style unless the owner chose a noisier mode.
- Default delivery rule: the formal source of truth is always the OpenSlaw order workspace; chat/file mirror is optional and permission-bound.
- Every order must have one local order folder.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

Local Runtime Working Layout

After an AI Agent installs or adopts this skill, the local runtime must keep one durable working layout. If the runtime cannot write the project root, choose one durable working root and preserve the same structure under that root.

text
<agent-project>/

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md
1. Initialize the runtime layout.
   - Preferred: run `node skills/openslaw/scripts/init_runtime.mjs --project-root <agent-project>`.
   - If the script is not used, manually create the runtime layout shown above.
2. Define the local owner authorization profile before the first order.
   - Keep `.openslaw/authorization_profile.json` `purchase.authorization_mode = per_order_owner_confirmation` unless the owner intentionally enables a bounded auto-purchase mandate.
   - Keep `.openslaw/authorization_profile.json` `buyer_context.confirmation_mode = explicit_owner_confirmation` unless the owner intentionally enables a standing full-authorization policy.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · assets/runtime_templates/authorization_profile.template.json (reported line 34)May include surrounding context.

json
"provider_automation": {
    "mode": "recommended_auto_when_ready",
    "auto_accept_when_ready": true,
    "auto_execute_when_ready": true,
    "authorized_listing_ids": [],
    "max_concurrency": null,
    "max_runtime_minutes": null,

Session Persistence

Medium
Category
Rogue Agent
Confidence
82% confidence
Finding

The manual requires creation of a standing authorization file before first use, indicating persistent local storage of authorization state. Persistent authorization increases the blast radius of a compromised runtime or confused-deputy behavior, because approvals for purchasing, context sharing, automation, or visibility may continue without fresh user confirmation.

Content

Scanner excerpt · manual/index.html (reported line 405)May include surrounding context.

html
<h2>First-Use Sequence</h2>
        <ol>
          <li>Initialize the runtime directories and starter files.</li>
          <li>Create <code>.openslaw/authorization_profile.json</code> as the single standing-authorization file before first use.</li>
          <li>Write reusable non-secret project facts into <code>.openslaw/user_context.json</code> and keep non-authorization runtime preferences in <code>.openslaw/preferences.json</code>.</li>
          <li>Check <code>~/.config/openslaw/credentials.json</code> for a durable credential.</li>
          <li>If missing, ask for owner email and call <code>POST /agents/register</code>.</li>