Agent Self Repair

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:58 PM UTC
• Version: 1.0.0

Overview

This skill is a self-repair helper, but it tells agents to make automatic system-affecting changes without clear approval or working safeguards.

Review carefully before installing. Use this only in a sandbox or after changing it to require explicit approval for package installs, service restarts, deletion, and retries; avoid --break-system-packages; add package allowlists, backups, rollback, result checking, and log redaction before enabling automatic repair.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:203

Finding

Unvalidated system-level dependency installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 203-209
Vulnerability Type: Untrusted package installation and software supply-chain exposure
Risk Level: High

Vulnerable Code:

python

def _install_dependency(self, details):
    # Install dependency
    pkg = details.get('package')
    if pkg:
        subprocess.run(['pip3', 'install', '--break-system-packages', pkg])
        return {'success': True, 'message': f'Installed {pkg}'}
    return {'success': False}

Technical Analysis

The package identifier is obtained from the details object supplied to the automatic repair executor and passed directly to pip3 install. Although the list-based subprocess invocation prevents shell metacharacter injection, it does not make the requested package trustworthy.

There is no package allowlist, version pinning, hash verification, trusted-index enforcement, isolated virtual environment, or human approval. The --break-system-packages option also bypasses Python's externally managed environment protection and permits modification of the system Python installation.

Python package installation can execute package-controlled build hooks or other installation logic. Consequently, an attacker who can influence a repair instruction could select a malicious, dependency-confusion, or typosquatted package and obtain code execution under the account running the repair framework. The code also fails to set check=True or inspect the return code, so it reports success even if installation fails.

Attack Path

1. An attacker influences an error diagnosis, generated repair plan, or JSON repair instruction.
2. The attacker selects the install_dependency repair type and supplies a malicious or attacker-controlled package name in details.package.
3. apply_fix dispatches the request to _install_dependency.
4. The executor invokes pip3 install --break-system-packages for the untrusted package.

...[truncated 725 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove unrestricted automatic package installation from the repair workflow.
2. Require explicit operator approval before installing or changing dependencies.
3. Maintain an allowlist of reviewed package names, exact versions, and permitted repair scenarios.
4. Install dependencies in a dedicated virtual environment rather than using --break-system-packages.
5. Pin every permitted dependency and validate package hashes with a locked requirements file.
6. Restrict installation to an explicitly configured and trusted package index.
7. Reject package names containing direct URLs, local paths, VCS references, extras, or unapproved version specifiers.
8. Run the installer under a sandboxed, least-privileged account with restricted network and filesystem access.
9. Use subprocess.run(..., check=True) and report success only after verifying the installed package and version.
10. Record the approved request, package source, resolved version, integrity hash, output, and result in an audit log.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:181

Finding

Unauthorised and incorrectly verified disruptive repair operations

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 181-193 and 211-222
Vulnerability Type: Unauthorised service control, unsafe deletion logic, and false success reporting
Risk Level: Medium

Vulnerable Code:

python

def apply_fix(self, fix_type, details):
    fixes = {
        'increase_timeout': self._increase_timeout,
        'fix_file_path': self._fix_file_path,
        'install_dependency': self._install_dependency,
        'restart_service': self._restart_service,
        'clear_cache': self._clear_cache
    }
    
    if fix_type in fixes:
        return fixes[fix_type](details)
    else:
        return {'success': False, 'error': 'Unknown fix type'}

python

def _restart_service(self, details):
    # Restart service
    subprocess.run(['openclaw', 'gateway', 'restart'])
    return {'success': True, 'message': 'Service restarted'}

def _clear_cache(self, details):
    # Clear cache
    cache_dir = os.path.expanduser('~/.openclaw/cache')
    if os.path.exists(cache_dir):
        subprocess.run(['rm', '-rf', f'{cache_dir}/*'])
        return {'success': True, 'message': 'Cache cleared'}
    return {'success': True, 'message': 'No cache to clear'}

Technical Analysis

The repair dispatcher permits a supplied repair type to trigger gateway restart or cache deletion without an approval check, authorization policy, maintenance-window restriction, or verification that the action is necessary. Restarting the gateway is an availability-affecting operation and should not be performed solely because an automatically generated repair instruction requests it.

Neither subprocess call checks its return code, but both methods unconditionally return a successful result. This can cause the framework to treat a failed or incomplete operation as a verified repair.

The cache deletion command also passes f'{cache_dir}/*' as a literal argument to rm. Because th ...[truncated 1595 chars]

Remediation

View remediation

Remediation Suggestions

1. Require explicit authorization for service restarts, deletion, package installation, and other disruptive actions.
2. Define a least-privilege policy specifying which repair types may run automatically.
3. Add rate limits, maintenance-window controls, and restart-loop prevention.
4. Use subprocess.run(..., check=True) with bounded timeouts and captured output.
5. Return success only after checking the process result and verifying the postcondition.
6. Replace external rm execution with safe Python filesystem APIs.
7. Resolve and validate the cache directory before deletion, reject symlinks, and enforce containment beneath the expected .openclaw/cache directory.
8. Delete only known cache entries rather than all directory contents.
9. Create a backup or use a reversible quarantine operation where appropriate.
10. Log the requesting identity, authorization decision, operation, affected paths, result, and rollback status.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:75

Finding

Sensitive diagnostic information stored without protective controls

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 75-96
Vulnerability Type: Plaintext sensitive-data exposure through diagnostic logging
Risk Level: Medium

Vulnerable Code:

python

class ErrorCatcher:
    def __init__(self, log_file='~/.openclaw/logs/errors.jsonl'):
        self.log_file = log_file
    
    def capture(self, error, context=None):
        entry = {
            'timestamp': datetime.now().isoformat(),
            'error_type': type(error).__name__,
            'error_message': str(error),
            'traceback': traceback.format_exc(),
            'context': context or {}
        }
        
        # Write to log
        with open(self.log_file, 'a') as f:
            f.write(json.dumps(entry) + '\n')
        
        return entry['error_type']

Technical Analysis

Exception messages, complete tracebacks, and arbitrary caller-provided context are written verbatim to a plaintext JSON Lines file. These fields frequently contain API tokens, authorization headers, request parameters, user records, filesystem paths, environment details, or application secrets.

The implementation does not redact sensitive fields, minimize collected data, establish restrictive file permissions, limit file size, rotate records, define retention, or protect log integrity. The documented default path also contains ~, but the implementation does not call os.path.expanduser; unless the caller supplies an expanded path or the runtime environment happens to contain a literal ~ directory, logging may fail. This reliability problem does not mitigate the disclosure risk when a valid path is provided.

No network exfiltration was found in the audited file. The exposure is local and depends on another user or process being able to read the resulting log.

Attack Path

1. A request, configuration value, credential, token, or sensitive user value is included in runtime context or ...[truncated 932 chars]

Remediation

View remediation

Remediation Suggestions

1. Define a strict schema for diagnostic context and reject arbitrary fields.
2. Redact passwords, tokens, cookies, authorization headers, private keys, connection strings, and personal data before serialization.
3. Avoid recording full request bodies or environment variables.
4. Expand and normalize the configured path, then verify it is contained in the approved log directory.
5. Create the log directory and file with permissions restricted to the service account, such as mode 0700 for the directory and 0600 for the file.
6. Protect against symlink-based redirection by using secure file-opening semantics appropriate to the platform.
7. Implement maximum file size, rotation, retention, and disk-quota controls.
8. Encrypt highly sensitive diagnostics where operationally necessary and control access to decryption keys separately.
9. Add tests that inject representative secrets and verify that none appear in stored output.
10. Document who may access diagnostic logs and audit all retrieval or export operations.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises fully automatic error diagnosis and repair with no manual intervention, while the examples include applying fixes, installing dependencies, clearing cache, retrying tasks, and restarting services. In this context, the lack of an upfront warning and explicit approval gates is dangerous because it normalizes destructive autonomous behavior that can alter systems, availability, and software supply chains.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation claims the skill only repairs files in the working directory and avoids privileged or system-changing actions, but the included code installs Python packages with pip and restarts a gateway service. This mismatch is dangerous because operators may trust the stated safety boundaries and enable an automation workflow that can modify the wider environment and disrupt running services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The example code performs an outbound HTTP request without warning that data, URLs, credentials, or metadata may be transmitted to an external system. In a debugging/self-repair skill, this matters because automatic retries or diagnostics could unintentionally exfiltrate sensitive context or trigger side effects on remote services.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill promises backup-before-fix, logging of all fix operations, and rollback support, but the auto-fixer code does not implement those safeguards. In an automatic self-repair context, missing backups, audit logs, and rollback materially increase the chance that a bad fix causes irreversible changes and makes incident response harder.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 297)May include surrounding context.

md

1. **备份优先** - 修复前自动备份相关文件
2. **安全范围** - 仅修复工作目录内的文件
3. **权限限制** - 不执行需要 sudo 的操作
4. **日志记录** - 所有修复操作都有日志
5. **可回滚** - 修复失败可回滚到备份

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file presents key descriptive and operational content in Chinese, while also using English elsewhere, but does not indicate that the skill is intended specifically for Chinese-speaking users or provide a language option. This can violate a language/locale policy when a specific language is imposed without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.