Security audit
Security checks for vulnerabilities and agentic risk
The skill appears to be a local privacy scanner, but its scan boundaries and privacy promises do not fully match its implementation.
Review this before installing if you expect strict privacy boundaries. It is local and I found no exfiltration code, but do not rely on excludePatterns, avoid scanning untrusted repositories with symlinks, and review generated reports before sharing because file paths and locations may reveal sensitive context.
claw_asset_privacy_guardian.py:596Scan-root boundary bypass through symbolic links
claw_asset_privacy_guardian.py:551Configured scan exclusions are stored but never enforced
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
pass
# 检查环境文件
if '.env' in file_path.lower():
findings.extend(self._check_env_security(content, file_path))
return findings
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
pass
# 检查环境文件
if '.env' in file_path.lower():
findings.extend(self._check_env_security(content, file_path))
return findings
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
pass
# 检查环境文件
if '.env' in file_path.lower():
findings.extend(self._check_env_security(content, file_path))
return findings
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
""",
# 环境文件测试
".env": """
DATABASE_URL=postgresql://user:password@localhost/prod
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
The skill description is presented in Chinese and sets the user-facing framing in a single language, with no indication that other languages are supported or that the user can opt in to this locale. The policy specifically calls for flagging language or locale constraints when they are imposed without user choice or documented justification.
This markdown file contains user-facing instructions and operational guidance almost exclusively in Chinese, but it does not state that the skill is Chinese-only or provide any language/locale choice. That can violate language/locale policy expectations when users are not given an explicit opt-in or alternative.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
clawdhub install claw-asset-privacy-guardian
mkdir -p ~/.openclaw/skills/claw-asset-privacy-guardian cp -r ./* ~/.openclaw/skills/claw-asset-privacy-guardian/
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
clawdhub install claw-asset-privacy-guardian
mkdir -p ~/.openclaw/skills/claw-asset-privacy-guardian cp -r ./* ~/.openclaw/skills/claw-asset-privacy-guardian/
The module name, docstrings, user-facing report text, CLI help, and console/markdown output are written in Chinese, indicating the skill is designed to communicate in a fixed language. There is no natural-language indication that users may opt into another language or that the locale restriction is required for a region-specific purpose.
The tool explicitly promises that reports contain no specific sensitive information, yet it still includes file locations with only partial path anonymization. File paths, filenames, and line references can themselves disclose usernames, project names, infrastructure details, or the presence of sensitive files, so the privacy guarantee is overstated and may leak contextual secrets.
This Python file contains user-facing descriptions, status messages, and test assertions primarily in Chinese, and the tests expect Chinese phrases such as "隐私保护声明". That implies a locale-specific behavior without any visible user opt-in or documented justification, which matches the language/locale policy violation criteria.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
# 测试基本扫描
print(" 运行命令行扫描...")
result = subprocess.run(
[sys.executable, "claw_asset_privacy_guardian.py", test_dir],
capture_output=True,
text=True,
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
# 测试JSON输出
print(" 运行JSON输出测试...")
result = subprocess.run(
[sys.executable, "claw_asset_privacy_guardian.py", test_dir, "--format", "json"],
capture_output=True,
text=True,
The markdown output asserts 'all analysis is completed locally', which is a strong operational guarantee. The current file itself does not perform network operations, but it also does not implement any enforcement, isolation, or runtime check to substantiate that guarantee beyond the present implementation, making the statement stronger than what the code guarantees.
The footer says 'all analysis is local, no data is sent to external parties'. While this file does not show outbound communication, the statement is presented as a hard guarantee in documentation/output rather than a property actively enforced by code, so it overstates what is proven by the implementation.
The code writes generated report content directly to the path provided by --output, which can overwrite an existing file. While it prints a message after saving, there is no pre-write warning, confirmation prompt, or explicit disclosure near the write operation about this side effect.
The package description is entirely in Chinese, which can constitute a language/locale policy issue when the skill does not offer an explicit language choice or document that it is intended only for Chinese-speaking users. In a manifest file, this kind of metadata may affect how the skill is presented or discovered without user opt-in.
No suspicious patterns detected.