ClawHub
Back to skill

Security audit

Claw Problem Diagnoser

Security checks for vulnerabilities and agentic risk

Overview

This OpenClaw troubleshooting skill is mostly aligned with diagnosis and repair, but its automatic repair and installation behavior is too broad and under-explained for a routine install.

Review this skill before installing. Use diagnosis/report modes first, avoid running it with sudo, and do not enable auto-fix unless you are comfortable with it installing Python packages, starting or initializing OpenClaw, and changing permissions under ~/.openclaw. Treat generated reports as potentially sensitive because they can include host and environment details.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
claw_problem_diagnoser.py:437
Finding

Shell-Based Automatic Permission Repair Creates a Command-Injection Surface

Content
View full analysis
bool: if issue.fix_script: try: result = subprocess.run(issue.fix_script.split(), capture_output=True, text=True, shell=True) if result.returncode == 0: logger.info(f"Successfully repaired permissions: {issue.title}") return True else: logger.error(f"Permission repair failed: {result.stderr}") return False except Exception as e: logger.error(f"Repair execution failed: {e}") ...[truncated 2296 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
package.json:47
Finding

Python Packages Are Declared as Unpinned npm Dependencies

Content
View full analysis
=5.9.0", "requests": ">=2.25.1", "colorama": ">=0.4.6", "tabulate": ">=0.9.0" }, "devDependencies": { "pytest": ">=7.0.0", "pytest-mock": ">=3.10.0" } ``` ### Technical Analysis The manifest declares Python import and distribution names in an npm `package.json` dependency section. An npm-compatible installer resolves these names from the npm registry, not from the Python Package Index. Packages with matching names in different ecosystems are not necessarily maintained by the corresponding Python projects and may contain unrelated code. The use of open-ended minimum constraints also allows future versions to be selected automatically. No npm lockfile or integrity-pinned Python dependency file was present in the audited project. This prevents the reviewed package contents from establishing a reproducible dependency graph. npm packages may define lifecycle scripts that execute during installation. Consequently, treating this manifest as a conventional npm package can introduce code that was not part of the audited skill. ### Attack Path 1. A user, CI system, or skill platform detects `package.json` and runs `npm install`. 2. npm resolves `psutil`, `requests`, `colorama`, `tabulate`, `pytest`, and `pytest-mock` from the npm registry. 3. The selected packages may be unrelated to the intended Python distributions or may later become compromised. 4. npm downloads the resolved package versions. 5. Any permitted package lifecycle scripts execute with the privileges of the installer. 6. The dependency code can access the build environment, project files, user credentials exposed to the process, and CI secrets. ### Impact Assessment The immediate scope is the account or automation worker performing insta ...[truncated 435 chars]
Remediation
View remediation

other

Warning
Location
claw_problem_diagnoser.py:315
Finding

Excessive Host, Skill, and Process Reconnaissance Exposes Sensitive Metadata

Content
View full analysis
90: issue = DiagnosticIssue( id="high_memory_usage", category=DiagnosticCategory.PERFORMANCE, severity=IssueSeverity.HIGH, title="Memory usage is too high", description=f"Memory usage: {memory.percent}%", cause="Insufficient system memory may affect performance", recommendation="Close unnecessary processes or add memory", location="System memory", auto_fixable=False ) issues.append(issue) cpu_percent = psutil.cpu_percent(interval=1) disk = psutil.disk_usage('/') ``` ```python def _collect_system_info(self) -> Dict[str, Any]: return { "platform": platform.platform(), "python_version": platform.python_version(), "hostname": platform.node(), "cpu_count": psutil.cpu_count(), "total_memory": psutil.virtual_memory().total, "total_disk": psutil.disk_usage('/').total, } ``` ```python skills_dir = os.path.expanduser("~/.openclaw/skills") if os.path.exists(skills_dir): try: skills = [d for d in os.listdir(skills_dir) if os.path.isdir(os.path.join(skills_dir, d))] info["skills_installed"] = len(skills) except: pass ``` ### Technical Analysis Constructing `ProblemDiagnoser` automatically collects the hostname, operating-system details, Python version, CPU co ...[truncated 1984 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (27)

Tainted flow: 'issue' from requests.get (line 348, network input) → subprocess.run (code execution)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

External input (network, user) flows to a code execution sink. This enables remote code execution or command injection.

Content

Scanner excerpt · claw_problem_diagnoser.py (reported line 404)May include surrounding context.

python
def fix(self, issue: DiagnosticIssue) -> bool:
        if issue.id == "openclaw_not_running" and issue.fix_script:
            try:
                result = subprocess.run(issue.fix_script.split(), 
                                      capture_output=True, text=True)
                if result.returncode == 0:
                    logger.info("成功启动OpenClaw服务")

Tainted flow: 'issue' from requests.get (line 348, network input) → subprocess.run (code execution)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The specific taint path from the localhost HTTP request is doubtful, but the sink is still dangerous because it executes issue.fix_script with shell=True. In a skill/plugin context where issue objects may be extended, deserialized, or influenced by other components, this generic command-execution sink materially increases the blast radius of any upstream input flaw.

Content

Scanner excerpt · claw_problem_diagnoser.py (reported line 492)May include surrounding context.

python
def fix(self, issue: DiagnosticIssue) -> bool:
        if issue.fix_script:
            try:
                result = subprocess.run(issue.fix_script.split(), 
                                      capture_output=True, text=True, shell=True)
                if result.returncode == 0:
                    logger.info(f"成功修复权限: {issue.title}")

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill prominently promises automatic diagnosis and repair, but does not clearly warn that it may change local configuration, dependencies, permissions, or service state. In a diagnostic/admin context, users may run commands expecting read-only inspection and unintentionally permit destructive or destabilizing modifications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The documentation says the tool will verify API keys and credentials, but gives no guidance on how secrets are accessed, stored, masked, transmitted, or excluded from reports. Diagnostic tools often collect logs and config data, so missing secrecy/privacy guidance can expose credentials through console output, reports, or remote troubleshooting workflows.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

clawdhub install claw-problem-diagnoser

或手动安装

mkdir -p ~/.openclaw/skills/claw-problem-diagnoser cp -r ./* ~/.openclaw/skills/claw-problem-diagnoser/

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

clawdhub install claw-problem-diagnoser

或手动安装

mkdir -p ~/.openclaw/skills/claw-problem-diagnoser cp -r ./* ~/.openclaw/skills/claw-problem-diagnoser/

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The quick-start section exposes auto-fix commands as normal usage without any adjacent warning that they may alter the system. This increases the chance that users execute repair mode casually, leading to unintended configuration edits, package installation/removal, service restarts, or permission changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The remote-diagnosis feature is presented without warning that it may connect to another host and transmit system metadata, logs, configuration details, or secrets over the network. In an administrative troubleshooting tool, this materially raises confidentiality and access-boundary risks, especially if users do not realize remote collection is occurring.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
84% confidence
Finding

The documentation suggests running the diagnostic tool with 'sudo', which can grant the skill unrestricted access to files, services, packages, and network settings. For a tool that includes auto-fix, permission checks, and remote diagnostics, encouraging root execution substantially increases the blast radius of mistakes or abuse.

Content

Scanner excerpt · SKILL.md (reported line 376)May include surrounding context.

  1. 权限不足

    bash
    sudo claw-diagnose --skip-permission-checks

  2. 网络依赖

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The top-level documentation presents the skill as an OpenClaw problem diagnoser/fixer, which implies scope centered on the OpenClaw application. In practice, the code also collects hostname, CPU count, total memory, total disk, process lists, and system-wide resource usage in L0616-L0625, L0318-L0326, and L0519-L0566, which goes beyond that stated intent.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · claw_problem_diagnoser.py (reported line 227)May include surrounding context.

python
if issue.id == "config_not_found":
            try:
                # 尝试运行openclaw init
                result = subprocess.run(["openclaw", "init"], 
                                      capture_output=True, text=True)
                if result.returncode == 0:
                    logger.info("成功初始化OpenClaw配置")

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · claw_problem_diagnoser.py (reported line 275)May include surrounding context.

python
for package, description in critical_packages:
            try:
                __import__(package.replace("-", "_"))
            except ImportError:
                issue = DiagnosticIssue(
                    id=f"missing_package_{package}",

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · claw_problem_diagnoser.py (reported line 296)May include surrounding context.

python
def fix(self, issue: DiagnosticIssue) -> bool:
        if issue.fix_script:
            try:
                result = subprocess.run(issue.fix_script.split(), 
                                      capture_output=True, text=True)
                if result.returncode == 0:
                    logger.info(f"成功安装依赖: {issue.title}")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · claw_problem_diagnoser.py (reported line 404)May include surrounding context.

python
def fix(self, issue: DiagnosticIssue) -> bool:
        if issue.fix_script:
            try:
                result = subprocess.run(issue.fix_script.split(), 
                                      capture_output=True, text=True)
                if result.returncode == 0:
                    logger.info(f"成功安装依赖: {issue.title}")

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
70% confidence
Finding

Code issues a request to a loopback, link-local, or private-range host. This can reach internal services not meant to be exposed and is a common SSRF pivot.

Content

Scanner excerpt · claw_problem_diagnoser.py (reported line 346)May include surrounding context.

python
# 检查服务健康状态
            try:
                # 尝试连接本地API
                response = requests.get("http://localhost:8080/health", timeout=5)
                if response.status_code != 200:
                    issue = DiagnosticIssue(
                        id="openclaw_health_check_failed",

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · claw_problem_diagnoser.py (reported line 463)May include surrounding context.

python
title=f"配置文件可写: {os.path.basename(path)}",
                            description=f"配置文件可写可能带来安全风险: {path}",
                            cause="文件权限过于宽松",
                            recommendation=f"限制文件写权限: chmod 400 {path}",
                            location=path,
                            auto_fixable=True,
                            fix_script=f"chmod 400 {path}"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · claw_problem_diagnoser.py (reported line 466)May include surrounding context.

python
title=f"配置文件可写: {os.path.basename(path)}",
                            description=f"配置文件可写可能带来安全风险: {path}",
                            cause="文件权限过于宽松",
                            recommendation=f"限制文件写权限: chmod 400 {path}",
                            location=path,
                            auto_fixable=True,
                            fix_script=f"chmod 400 {path}"

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
99% confidence
Finding

This code combines shell=True with a command derived from issue.fix_script, which is an unnecessary and dangerous execution pattern. Even though current call sites appear to generate fix_script internally, apply_fixes() trusts issue objects and a future change, external plugin, or crafted result object could turn this into arbitrary command execution with the tool's privileges.

Content

Scanner excerpt · claw_problem_diagnoser.py (reported line 492)May include surrounding context.

python
def fix(self, issue: DiagnosticIssue) -> bool:
        if issue.fix_script:
            try:
                result = subprocess.run(issue.fix_script.split(), 
                                      capture_output=True, text=True, shell=True)
                if result.returncode == 0:
                    logger.info(f"成功修复权限: {issue.title}")

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

No manifest is available, so the only declared purpose is the code documentation describing an OpenClaw problem diagnoser. Collecting hostname, CPU count, total memory, total disk, iterating processes, and measuring system-wide CPU/memory/disk usage at L0318-L0326, L0519-L0566, and L0616-L0625 is a broader machine-inspection capability not inherently required for a narrowly scoped application diagnoser.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · claw_problem_diagnoser.py (reported line 637)May include surrounding context.

python
# 尝试获取OpenClaw版本
        try:
            result = subprocess.run(["openclaw", "--version"], 
                                  capture_output=True, text=True)
            if result.returncode == 0:
                info["openclaw_version"] = result.stdout.strip()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The auto-fix flow can execute package installation, service startup, initialization, and permission-changing commands without interactive confirmation at the execution point. In an agent skill context, this makes accidental or indirect system modification more dangerous because users may trigger broad changes by enabling --auto-fix without seeing each specific action.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest description says the skill will 'automatically diagnose and fix common OpenClaw technical problems,' but it does not specify what user request patterns or contexts should activate it. In a manifest file, this broad troubleshooting phrasing can overlap with many general support requests and lacks negative examples or explicit scope boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest advertises automatic diagnosis and fixing capabilities, including an 'auto-fix' feature, but provides no warning that fixes may modify configuration, services, dependencies, or system state. In a troubleshooting skill, this increases the risk that users or calling agents invoke state-changing behavior without informed consent or sufficient safeguards.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

Most user-facing instructional content in the file is presented in Chinese, and the document does not offer an alternative language or state that the skill is intentionally limited to a Chinese-speaking audience. Per the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

User-facing docstrings, CLI descriptions, and report text are primarily written in Chinese, which effectively imposes a specific language on users without any opt-in or fallback. The policy allows locale constraints only when the user is given a choice or the restriction is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.