ClawHub
Back to skill

Security audit

openclaw hardening

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local OpenClaw security audit guide whose sensitive checks are disclosed, purpose-aligned, and gated by user confirmation for changes.

Installers should understand that this skill may inspect local OpenClaw config, process state, permissions, current environment values, and secret hygiene signals. That is expected for this audit, but users should only approve actual changes after reviewing the proposed fix.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill explicitly says to proactively offer the audit whenever the user mentions setting up or reconfiguring OpenClaw. That can broaden invocation beyond explicit user requests and cause the agent to inspect local configuration, processes, or secrets in situations where the user did not clearly consent to a security review. In a security-audit skill, over-broad triggering increases privacy and scope-creep risk even if the content is otherwise defensive.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
## Guiding Principles

Before suggesting or applying any change, explain the risk in plain terms — users can only make informed decisions when they understand what they're accepting. Changes to files, permissions, users, or startup commands require explicit user confirmation, because an agent that acts without consent removes the user's ability to course-correct.

Use only local inspection. External network scans are out of scope for a local hardening audit and can create a false sense of security by checking reachability rather than configuration intent.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md
Before suggesting or applying any change, explain the risk in plain terms — users can only make informed decisions when they understand what they're accepting. Changes to files, permissions, users, or startup commands require explicit user confirmation, because an agent that acts without consent removes the user's ability to course-correct.

Use only local inspection. External network scans are out of scope for a local hardening audit and can create a false sense of security by checking reachability rather than configuration intent.

When config, process state, or permissions cannot be verified, report `Unable to verify` rather than assuming the best case. A silent false OK is worse than an honest unknown.

Unsafe Defaults

Medium
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

md
Platform-appropriate permission checks:

- On Linux or macOS, flag group/world-readable files such as `~/.openclaw/config.json` (recommended: `600`) or a directory accessible beyond the owner (recommended: `700`).
- On Windows, inspect ACLs and flag secret files readable by broad principals such as `Everyone` or `Users`.

If secrets appear in tracked history or plain config, recommend rotation and migration to environment variables or a `SecretRef` pointing to a local secrets file.