Claw Ethics Checker

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:17 PM UTC
• Version: 1.0.1

Overview

The skill mostly matches its stated ethics-checking purpose, but it should be reviewed because it logs full task details by default and its install/update instructions use mutable or inconsistent remote sources.

Review this skill before installing. Prefer a pinned, verified release from a single canonical repository, avoid global or mutable install/update commands where possible, and disable or tightly control decision logging if task descriptions may contain confidential, personal, legal, or security-sensitive information. Treat any automatic approval rules as high-risk and keep human review enabled for non-trivial tasks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: INSTALLATION.md:17
• Finding: Unpinned and Unverified Remote Installation Sources<![CDATA[ ## Vulnerability Details **File Location**: `INSTALLATION.md:17`, `INSTALLATION.md:28-30`, and `INSTALLATION.md:43` **Related Location**: `package.json:21-24` **Vulnerability Type**: Supply-chain exposure through mutable and unverified dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # INSTALLATION.md:17 npm install -g clawdhub ``` ```bash # INSTALLATION.md:28-30 git clone https://github.com/openclaw/claw-ethics-checker.git # Or download directly wget https://github.com/openclaw/claw-ethics-checker/archive/main.zip ``` ```bash # INSTALLATION.md:43 pip install claw-ethics-checker ``` The package metadata also identifies a different repository: ```json // package.json:21-24 "repository": { "type": "git", "url": "https://github.com/openclaw-skills/claw-ethics-checker" }, ``` ### Technical Analysis The installation instructions retrieve packages and source code from remote locations without pinning an exact package version, immutable Git commit, release artifact digest, or cryptographic signature. The npm and pip commands resolve the package version available from their registries at installation time. The Git clone and ZIP download retrieve the mutable default branch. Consequently, the effective code installed by these commands can change after this Skill has been reviewed. The global npm installation is particularly sensitive because npm packages may define lifecycle scripts that execute during installation. Such scripts run with the permissions of the user performing the installation. The Python package can similarly execute build or installation logic depending on its packaging configuration. There is also a provenance inconsistency: `INSTALLATION.md` downloads from `openclaw/claw-ethics-checker`, while `package.json` declares `openclaw-skills/claw-ethics-checker`. This ambiguity makes it harder for users to determine which repository is authoritative and increases the risk of installing substituted or unrelated conten ...[truncated 2065 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin npm and pip dependencies to reviewed, exact versions: ```bash npm install -g clawdhub@<reviewed-version> python3 -m pip install claw-ethics-checker==<reviewed-version> ``` 2. Pin manual installations to an immutable Git commit: ```bash git clone https://github.com/<canonical-owner>/claw-ethics-checker.git cd claw-ethics-checker git checkout <full-reviewed-commit-hash> ``` 3. Publish release artifacts with SHA-256 checksums and verify them before extraction: ```bash wget https://github.com/<canonical-owner>/claw-ethics-checker/releases/download/<version>/claw-ethics-checker.zip echo "<expected-sha256> claw-ethics-checker.zip" | sha256sum --check - ``` 4. Cryptographically sign releases or commits and document signature verification. 5. Reconcile `INSTALLATION.md`, `EXAMPLES.md`, and `package.json` so every reference identifies one canonical repository owner and URL. 6. Avoid global npm installation unless it is required. Prefer a dedicated, least-privileged environment and review package lifecycle scripts before installation. 7. Use a Python virtual environment rather than installing into a shared or privileged interpreter: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` 8. Configure automated dependency and provenance checks to detect repository ownership changes, unexpected package releases, and checksum mismatches. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This markdown file presents all user-facing instructions in Chinese, including headings, setup steps, troubleshooting, and support guidance. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Session Persistence

Medium

• Category: Rogue Agent

Content

wget https://github.com/openclaw/claw-ethics-checker/archive/main.zip

# 2. 复制到OpenClaw技能目录
mkdir -p ~/.openclaw/skills/
cp -r claw-ethics-checker ~/.openclaw/skills/

# 3. 配置OpenClaw

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

wget https://github.com/openclaw/claw-ethics-checker/archive/main.zip

# 2. 复制到OpenClaw技能目录
mkdir -p ~/.openclaw/skills/
cp -r claw-ethics-checker ~/.openclaw/skills/

# 3. 配置OpenClaw

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

custom_rules:
    - name: '公司特定规则'
      condition: 'client == "内部使用"'
      action: 'auto_approve'
    
    - name: '高风险客户'
      condition: 'client in ["高风险列表"]'

• Confidence: 85% confidence
• Finding: The documented rule action `auto_approve` allows tasks matching a simple condition to bypass human review, which weakens a safety-control component meant to gate risky actions. In an ethics/compliance checker, fail-open automation is more dangerous because misclassification or overly broad rules could authorize sensitive workflows without oversight.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

# 检查技能目录
ls ~/.openclaw/skills/
# 确保目录结构正确
# 应该是: ~/.openclaw/skills/claw-ethics-checker/SKILL.md
```

**Q: 配置不生效**

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The natural-language content of the skill from the title onward is exclusively in Chinese, with no note that the skill is region-specific or that other languages are supported. This can violate language/locale policy because it effectively forces one language on users without opt-in or justification.

Session Persistence

Medium

• Category: Rogue Agent

Content

clawdhub install claw-ethics-checker

# 或手动安装
mkdir -p ~/.openclaw/skills/claw-ethics-checker
cp -r ./* ~/.openclaw/skills/claw-ethics-checker/
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: Most docstrings, recommendations, warnings, and example outputs are written in Chinese, which indicates the skill expects or returns a specific language by default. The file does not offer user opt-in for language selection or explain that the tool is intentionally limited to a Chinese-language or region-specific context.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The module presents itself as an ethics/compliance checker, but it also stores full task descriptions and task details in an internal decision log and can export them to disk. In this context, that creates unnecessary data retention and function creep: users may submit sensitive business, legal, or personal data for evaluation, and the checker preserves those inputs beyond what is needed for the analysis.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The decision log records raw task_description and full task_details, which may contain personal data, confidential prompts, or sensitive operational information. Because this component is specifically likely to receive ethically sensitive inputs, silent capture of full inputs increases privacy and confidentiality risk if logs are later accessed, leaked, or reused outside the original purpose.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Exporting the accumulated decision log writes potentially sensitive task data directly to a caller-supplied file path without any safeguards or warning. This increases exposure by creating durable plaintext copies on disk, which can be exfiltrated, mishandled, or retained longer than intended.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The package description is written entirely in Chinese ("伦理合规检查器 - AI助手的伦理和法律合规检查工具"), which implies a fixed language presentation for the skill metadata. Under the policy, locale or language constraints should either be optional for users or clearly justified as region-specific; neither is indicated here.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The FAQ says the tool '目前主要支持英语和中文任务描述', which imposes a language limitation in the natural-language documentation. Under the policy, language constraints should either offer user choice/opt-in or be clearly justified as region-specific; neither appears here.

Natural-Language Policy Violations

Low

• Confidence: 97% confidence
• Finding: This Python file contains user-facing docstrings and print statements entirely in Chinese, including the module description and all runtime output. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation unless the regional constraint is clearly documented and justified.

Static analysis

No suspicious patterns detected.