Claw Ethics Checker

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:17 PM UTC
• Version: 1.0.1

Overview

The skill mostly matches its stated ethics-checking purpose, but it should be reviewed because it logs full task details by default and its install/update instructions use mutable or inconsistent remote sources.

Review this skill before installing. Prefer a pinned, verified release from a single canonical repository, avoid global or mutable install/update commands where possible, and disable or tightly control decision logging if task descriptions may contain confidential, personal, legal, or security-sensitive information. Treat any automatic approval rules as high-risk and keep human review enabled for non-trivial tasks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: INSTALLATION.md:17

Finding

Unpinned and Unverified Remote Installation Sources

Content

View full analysis

Remediation

View remediation

python3 -m pip install claw-ethics-checker== ``` 2. Pin manual installations to an immutable Git commit: ```bash git clone https://github.com//claw-ethics-checker.git cd claw-ethics-checker git checkout ``` 3. Publish release artifacts with SHA-256 checksums and verify them before extraction: ```bash wget https://github.com//claw-ethics-checker/releases/download//claw-ethics-checker.zip echo " claw-ethics-checker.zip" | sha256sum --check - ``` 4. Cryptographically sign releases or commits and document signature verification. 5. Reconcile `INSTALLATION.md`, `EXAMPLES.md`, and `package.json` so every reference identifies one canonical repository owner and URL. 6. Avoid global npm installation unless it is required. Prefer a dedicated, least-privileged environment and review package lifecycle scripts before installation. 7. Use a Python virtual environment rather than installing into a shared or privileged interpreter: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` 8. Configure automated dependency and provenance checks to detect repository ownership changes, unexpected package releases, and checksum mismatches. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This markdown file presents all user-facing instructions in Chinese, including headings, setup steps, troubleshooting, and support guidance. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALLATION.md (reported line 33)May include surrounding context.

md

wget https://github.com/openclaw/claw-ethics-checker/archive/main.zip

# 2. 复制到OpenClaw技能目录
mkdir -p ~/.openclaw/skills/
cp -r claw-ethics-checker ~/.openclaw/skills/

# 3. 配置OpenClaw

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · INSTALLATION.md (reported line 33)May include surrounding context.

md

wget https://github.com/openclaw/claw-ethics-checker/archive/main.zip

# 2. 复制到OpenClaw技能目录
mkdir -p ~/.openclaw/skills/
cp -r claw-ethics-checker ~/.openclaw/skills/

# 3. 配置OpenClaw

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

The documented rule action auto_approve allows tasks matching a simple condition to bypass human review, which weakens a safety-control component meant to gate risky actions. In an ethics/compliance checker, fail-open automation is more dangerous because misclassification or overly broad rules could authorize sensitive workflows without oversight.

Content

Scanner excerpt · INSTALLATION.md (reported line 123)May include surrounding context.

md

custom_rules:
    - name: '公司特定规则'
      condition: 'client == "内部使用"'
      action: 'auto_approve'
    
    - name: '高风险客户'
      condition: 'client in ["高风险列表"]'

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · INSTALLATION.md (reported line 183)May include surrounding context.

检查技能目录

ls ~/.openclaw/skills/

确保目录结构正确

应该是: ~/.openclaw/skills/claw-ethics-checker/SKILL.md

text

**Q: 配置不生效**

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The natural-language content of the skill from the title onward is exclusively in Chinese, with no note that the skill is region-specific or that other languages are supported. This can violate language/locale policy because it effectively forces one language on users without opt-in or justification.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

clawdhub install claw-ethics-checker

或手动安装

mkdir -p ~/.openclaw/skills/claw-ethics-checker cp -r ./* ~/.openclaw/skills/claw-ethics-checker/

text

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Most docstrings, recommendations, warnings, and example outputs are written in Chinese, which indicates the skill expects or returns a specific language by default. The file does not offer user opt-in for language selection or explain that the tool is intentionally limited to a Chinese-language or region-specific context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The module presents itself as an ethics/compliance checker, but it also stores full task descriptions and task details in an internal decision log and can export them to disk. In this context, that creates unnecessary data retention and function creep: users may submit sensitive business, legal, or personal data for evaluation, and the checker preserves those inputs beyond what is needed for the analysis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The decision log records raw task_description and full task_details, which may contain personal data, confidential prompts, or sensitive operational information. Because this component is specifically likely to receive ethically sensitive inputs, silent capture of full inputs increases privacy and confidentiality risk if logs are later accessed, leaked, or reused outside the original purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Exporting the accumulated decision log writes potentially sensitive task data directly to a caller-supplied file path without any safeguards or warning. This increases exposure by creating durable plaintext copies on disk, which can be exfiltrated, mishandled, or retained longer than intended.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The package description is written entirely in Chinese ("伦理合规检查器 - AI助手的伦理和法律合规检查工具"), which implies a fixed language presentation for the skill metadata. Under the policy, locale or language constraints should either be optional for users or clearly justified as region-specific; neither is indicated here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The FAQ says the tool '目前主要支持英语和中文任务描述', which imposes a language limitation in the natural-language documentation. Under the policy, language constraints should either offer user choice/opt-in or be clearly justified as region-specific; neither appears here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This Python file contains user-facing docstrings and print statements entirely in Chinese, including the module description and all runtime output. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation unless the regional constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.